Azure CLI Installation Guide

# Version, core version and installed extensions
az version
 
# List the installed extensions
az extension list
 
# The CLI comes with Bicep — no separate install needed
az bicep version

# Opens a browser
az login
 
# For a headless machine, print a code and open it on any device
az login --use-device-code
 
# Log in to a specific tenant
az login --tenant <tenant-id>
 
# See what you are signed in to
az account show

# Create the app registration
az ad sp create-for-rbac \
  --name my-app \
  --role Contributor \
  --scopes /subscriptions/<subscription-id>

# Add a certificate credential and export the public key
az ad sp credential reset \
  --id <app-id> \
  --append \
  --cert "$(openssl req -new -x509 -nodes -days 365 -out /dev/null -subj '/CN=azure-cli' | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | base64 -w0)"
 
# Log in with the certificate
az login --service-principal \
  --username <app-id> \
  --tenant <tenant-id> \
  --cert @cert.pem

# Inside a VM, AKS pod or App Service with a managed identity
az account show
 
# On GitHub Actions, use the OIDC federation
az login --service-principal \
  --username <app-id> \
  --tenant <tenant-id> \
  --federated-token "$AZURE_FEDERATED_TOKEN"

# GitHub Actions
permissions:
  id-token: write
  contents: read
steps:
  - uses: azure/login@v2
    with:
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

# List the subscriptions you can see
az account list --output table
 
# Switch the active subscription
az account set --subscription "My Subscription"
 
# List every subscription in a directory
az account list --all --output table

# Set the defaults you always want
az configure --defaults output=json location=westus2
 
# See the current defaults
az configure --list-defaults
 
# Export them for another environment
az configure --defaults output=table group=myResourceGroup

// ~/.azure/config
{
  "defaults": {
    "group": "myResourceGroup",
    "location": "westus2",
    "vm": {
      "image": "UbuntuLTS",
      "size": "Standard_DS2_v2"
    }
  }
}

az group create --name myResourceGroup --location westus2 --tags Environment=Production
az group list --output table
az group delete --name myResourceGroup --yes

# Create a VM
az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image UbuntuLTS \
  --admin-username azureuser \
  --generate-ssh-keys
 
# List, start and stop
az vm list --output table
az vm start --resource-group myResourceGroup --name myVM
az vm stop --resource-group myResourceGroup --name myVM
 
# Open a shell (Cloud Shell)
az vm ssh --resource-group myResourceGroup --name myVM

# Deploy an ARM template
az deployment group create \
  --resource-group myResourceGroup \
  --template-file template.json \
  --parameters parameters.json
 
# Deploy Bicep — az bicep is included with the CLI
az bicep build main.bicep --outfile main.json
az deployment group create --resource-group myResourceGroup --template-file main.json
 
# Deploy straight from a Bicep file
az deployment group create \
  --resource-group myResourceGroup \
  --template-file main.bicep \
  --parameters env=prod

# List the extensions in the index
az extension list-available --output table
 
# Install one
az extension add --name aks-preview
 
# Update or remove
az extension update --name aks-preview
az extension remove --name aks-preview

# Check the current version
az version
 
# Upgrade the CLI
az upgrade
 
# If the automatic upgrade is blocked, install the latest package
sudo apt update && sudo apt install --only-upgrade azure-cli