azManage Azure resources with the Azure CLI
az is the Azure CLI: log in, pick a subscription, and create or query resource groups, VMs, storage and AKS clusters. Like the AWS CLI it speaks JSON and supports JMESPath --query, and its -o table output is handy for quick checks.
az <group> [<subgroup>] <command> [--resource-group RG] [--name N] [--query EXPR] [-o json|table|tsv]First use on a new machine: authenticate and make sure commands go to the lab subscription, not production.
azThe Azure CLI (Python), installed as az.
az login runs an OAuth flow against Microsoft Entra ID (browser, device code, a service principal, or a managed identity with az login --identity) and caches tokens and the list of subscriptions in ~/.azure. Every command then becomes REST calls to Azure Resource Manager (management.azure.com) with a bearer token, scoped to /subscriptions/<id>/resourceGroups/<rg>/providers/... ARM checks Azure RBAC role assignments at that scope (or inherited from the subscription or management group) before the resource provider acts. Long operations such as VM creation return 202 and the CLI polls until done (--no-wait skips that). Defaults from az configure --defaults group= location= are stored in ~/.azure/config, and -o and --query are applied locally to the JSON response.
loginAuthenticate: browser, --use-device-code, or --identity (managed identity)account show | setCurrent subscription, or switch with set -s ID (list shows all)-g, --resource-group RGResource group to act in-o table|json|tsv|yamlOutput format--query EXPRJMESPath on the resultvm deallocateStop and release compute so billing stops (vm list -d shows power state)group create / group deleteCreate a resource group / delete it and everything in itaks get-credentialsMerge an AKS cluster (-g RG -n NAME) into ~/.kube/configconfigure --defaultsSet default group= and location= so -g and -l can be omitted--no-waitReturn immediately for long-running operationsaz vm stop to save money overnightA stopped (not deallocated) VM still holds its compute allocation and is billed.
az vm deallocate (or auto-shutdown, which deallocates)Running commands right after az login without checking the subscriptionThe default subscription may be production; az happily creates or deletes there.
az account show, and az account set -s <lab-subscription>; pass --subscription in scriptsService principal secrets in CI variablesLong-lived secrets leak and expire unnoticed.
Workload identity federation (OIDC) for CI, managed identities for VMs and AKS workloadsTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox has no az or network. Practise JMESPath-style filtering with jq instead: from ~/data/servers.txt build JSON objects and print the names of servers that are running, one per line.
Write the az command that lists only the names of VMs in rg-devops-lab that are not deallocated.
Write the commands to switch to the subscription named devops-lab and confirm it.
azManage Azure resources with the Azure CLI
az is the Azure CLI: log in, pick a subscription, and create or query resource groups, VMs, storage and AKS clusters. Like the AWS CLI it speaks JSON and supports JMESPath --query, and its -o table output is handy for quick checks.
az <group> [<subgroup>] <command> [--resource-group RG] [--name N] [--query EXPR] [-o json|table|tsv]First use on a new machine: authenticate and make sure commands go to the lab subscription, not production.
azThe Azure CLI (Python), installed as az.
az login runs an OAuth flow against Microsoft Entra ID (browser, device code, a service principal, or a managed identity with az login --identity) and caches tokens and the list of subscriptions in ~/.azure. Every command then becomes REST calls to Azure Resource Manager (management.azure.com) with a bearer token, scoped to /subscriptions/<id>/resourceGroups/<rg>/providers/... ARM checks Azure RBAC role assignments at that scope (or inherited from the subscription or management group) before the resource provider acts. Long operations such as VM creation return 202 and the CLI polls until done (--no-wait skips that). Defaults from az configure --defaults group= location= are stored in ~/.azure/config, and -o and --query are applied locally to the JSON response.
loginAuthenticate: browser, --use-device-code, or --identity (managed identity)account show | setCurrent subscription, or switch with set -s ID (list shows all)-g, --resource-group RGResource group to act in-o table|json|tsv|yamlOutput format--query EXPRJMESPath on the resultvm deallocateStop and release compute so billing stops (vm list -d shows power state)group create / group deleteCreate a resource group / delete it and everything in itaks get-credentialsMerge an AKS cluster (-g RG -n NAME) into ~/.kube/configconfigure --defaultsSet default group= and location= so -g and -l can be omitted--no-waitReturn immediately for long-running operationsaz vm stop to save money overnightA stopped (not deallocated) VM still holds its compute allocation and is billed.
az vm deallocate (or auto-shutdown, which deallocates)Running commands right after az login without checking the subscriptionThe default subscription may be production; az happily creates or deletes there.
az account show, and az account set -s <lab-subscription>; pass --subscription in scriptsService principal secrets in CI variablesLong-lived secrets leak and expire unnoticed.
Workload identity federation (OIDC) for CI, managed identities for VMs and AKS workloadsTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox has no az or network. Practise JMESPath-style filtering with jq instead: from ~/data/servers.txt build JSON objects and print the names of servers that are running, one per line.
Write the az command that lists only the names of VMs in rg-devops-lab that are not deallocated.
Write the commands to switch to the subscription named devops-lab and confirm it.