Configuration & Identity
Verified against Azure CLI 2.87.0, flags verified via `az <cmd> --help`, 2026-08-20 · official docs
Logging in, switching subscriptions, resource groups, and the identity commands — service principals and role assignments.
Logging in and switching subscriptions#
az login # interactive browser login az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant-id> az account list --output table # every subscription this account can see az account show # the currently active subscription az account set --subscription "My Subscription Name" # switch active subscription
Unlike AWS/GCP's profile-per-account model, Azure CLI has one active login session with potentially many subscriptions under it — az account set switches which subscription commands target, it does not re-authenticate.
Resource groups#
az group create --name my-rg --location eastus az group list --output table az group show --name my-rg az group delete --name my-rg --yes --no-wait # delete without confirmation prompt, don't block on completion
Every Azure resource lives inside exactly one resource group — the closest Azure analogue to how AWS resources live in a region/account and GCP resources live in a project. Deleting a resource group deletes everything inside it; --yes skips the interactive confirmation, so double-check the --name before scripting this.
Service principals (for automation/CI)#
az ad sp create-for-rbac --display-name my-ci-sp --role Contributor --scopes /subscriptions/<sub-id>/resourceGroups/my-rg
This prints the appId/password/tenant needed to authenticate as this identity from a pipeline (via az login --service-principal). Scope the --role/--scopes as narrowly as the automation actually needs — Contributor on a whole subscription is far broader than most CI jobs require; scope to a specific resource group when possible.
Role assignments (RBAC)#
az role assignment create --assignee <user-or-sp-id> --role Reader --scope /subscriptions/<sub-id>/resourceGroups/my-rg az role assignment list --assignee <user-or-sp-id> --all az role assignment list --scope /subscriptions/<sub-id>/resourceGroups/my-rg
Looking up users and groups (Entra ID / Azure AD)#
az ad user list --filter "displayname eq 'Jane Doe'" az ad user show --id jane@example.com