Azure CLI commands cheat sheet

Sign in to Azure with your user account.

Uses Web Account Manager on Windows and a browser on Linux and macOS, and falls back to device code when neither is available.

Sign in with a code you enter on another device.

Useful over SSH or on servers without a browser.

Sign in with the managed identity of the Azure resource you are running on.

Add --client-id or --resource-id to pick a user-assigned identity.

Show the subscription the CLI is currently using.

List the subscriptions your account can use.

Add --all to include disabled subscriptions and other clouds, or --refresh to re-read them from the server.

Switch the active subscription.

List the regions available to the current subscription.

Set a default resource group and region so you can omit -g and -l.

Saved to ~/.azure/config; --local saves it for the current folder only. The az config group is marked experimental.

Show the installed Azure CLI, module and extension versions.

Upgrade Azure CLI and its extensions.

Preview command. --yes skips the confirmation prompt.

Sign out and remove access to your Azure subscriptions from this machine.

Show results as a readable table instead of JSON.

--output (-o) accepts json, jsonc, table, tsv, yaml, yamlc and none.

Return a single raw value, ready to use in a script variable.

tsv strips the JSON quotes, so the value pastes cleanly into other commands.

Pick and rename fields with a JMESPath projection.

Filter results with a JMESPath condition.

Make table the default output format for every command.

Create a resource group in a region.

List the resource groups in the subscription.

Return true or false depending on whether the group exists.

List every resource in a resource group.

Find resources that carry a given tag.

Add a tag to a resource while keeping its existing tags.

Without -i (--is-incremental) the tags you pass replace all existing tags.

Delete a resource group and everything in it.

Warning: Permanently deletes every resource in the group (VMs, disks, databases, storage accounts and their data). --yes skips the prompt and --no-wait returns before deletion finishes.

List popular Marketplace images and their aliases, such as Ubuntu2204.

The cached alias list changes between CLI versions. Older aliases such as UbuntuLTS no longer work; add --all to search the full Marketplace (slow).

Create a Linux VM and generate SSH keys if you do not have them.

Keys are stored in ~/.ssh. --image also accepts a full Publisher:Offer:Sku:Version URN.

List VMs with power state, public IP and FQDN.

-d (--show-details) adds the extra details but makes the command slower.

Get the public IP address of a VM.

Start a stopped or deallocated VM.

Power off a VM without releasing its compute resources.

A stopped VM is still billed for compute. Use az vm deallocate to stop the charges.

Stop a VM and release its compute so compute billing stops.

Disks are kept and still billed.

Restart a running VM.

List VM sizes available in a region, filtered by a partial size name.

Replaces az vm list-sizes, which is deprecated. Add --zone to show only sizes that support availability zones.

Change the size of a VM.

The VM restarts during the resize.

Open an inbound port on the VM's network security group.

Default rule priority is 900. To limit which source addresses can connect, use az network nsg rule create instead.

Delete a VM.

Warning: The VM is removed permanently. Depending on how it was created, its disks, NIC and public IP may be deleted with it or left behind (and keep costing money), so check the resource group afterwards.

Create a virtual network with one subnet.

If you omit --address-prefixes the VNet uses 10.0.0.0/16.

List the virtual networks in a resource group.

Create a network security group.

Add a rule to a network security group.

Priority 100 to 4096, lower runs first. Defaults are Allow, Inbound, any protocol, destination port 80.

List the rules in a network security group.

Add --include-default to show the built-in default rules too.

List public IP addresses in a resource group.

Create a storage account with locally redundant storage.

The name must be globally unique. Without --sku the default is Standard_RAGRS.

Create a blob container using your Microsoft Entra sign-in instead of an account key.

--auth-mode login needs a data-plane role such as Storage Blob Data Contributor. Containers are private by default.

Upload a local file as a blob.

Add --overwrite to replace an existing blob with the same name.

List the blobs in a container.

Add --prefix to list only names that start with a given string.

Download a blob to a local file.

Upload every file in a local folder to a container.

Use --pattern to upload only matching files.

List the runtime stacks you can use with --runtime.

Create an App Service plan (Linux by default).

Use --is-linux false to create a Windows plan.

Create a web app on an existing plan.

The app name becomes part of its default hostname, so it must be unique.

Deploy a package to a web app.

Microsoft now recommends webapp create plus webapp deploy because az webapp up is deprecated.

List the web apps in a resource group.

Stream live logs from a web app.

If nothing appears, turn on logging first with az webapp log config.

Show the Microsoft Entra user you are signed in as.

Grant a user, group or service principal a role at a scope.

Scope can be a subscription, resource group or single resource. Grant the narrowest role and scope that does the job.

List the role assignments for a user or service principal.

Show who changed what in a resource group over the last 7 days.

--offset takes a ##d##h value. Add --caller or --status to narrow the results.

List resource usage and cost details for a date range.

The consumption command group is in preview. Dates are YYYY-MM-DD in UTC and must be given together.