# Azure CLI Cheat Sheet — Configuration & Identity

> **Tool:** Azure CLI (az)
> **Category:** Cloud CLIs
> **Verified against:** Azure CLI 2.87.0, flags verified via `az <cmd> --help`, 2026-08-20
> **Official docs:** https://learn.microsoft.com/cli/azure

Logging in, switching subscriptions, resource groups, and the identity commands — service principals and role assignments.

## Logging in and switching subscriptions

```bash
az login                                              # interactive browser login
az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant-id>
az account list --output table                         # every subscription this account can see
az account show                                          # the currently active subscription
az account set --subscription "My Subscription Name"     # switch active subscription
```

Unlike AWS/GCP's profile-per-account model, Azure CLI has one active login session with potentially many subscriptions under it — `az account set` switches which subscription commands target, it does not re-authenticate.

## Resource groups

```bash
az group create --name my-rg --location eastus
az group list --output table
az group show --name my-rg
az group delete --name my-rg --yes --no-wait            # delete without confirmation prompt, don't block on completion
```

Every Azure resource lives inside exactly one resource group — the closest Azure analogue to how AWS resources live in a region/account and GCP resources live in a project. Deleting a resource group deletes everything inside it; `--yes` skips the interactive confirmation, so double-check the `--name` before scripting this.

## Service principals (for automation/CI)

```bash
az ad sp create-for-rbac --display-name my-ci-sp --role Contributor --scopes /subscriptions/<sub-id>/resourceGroups/my-rg
```

This prints the `appId`/`password`/`tenant` needed to authenticate as this identity from a pipeline (via `az login --service-principal`). Scope the `--role`/`--scopes` as narrowly as the automation actually needs — `Contributor` on a whole subscription is far broader than most CI jobs require; scope to a specific resource group when possible.

## Role assignments (RBAC)

```bash
az role assignment create --assignee <user-or-sp-id> --role Reader --scope /subscriptions/<sub-id>/resourceGroups/my-rg
az role assignment list --assignee <user-or-sp-id> --all
az role assignment list --scope /subscriptions/<sub-id>/resourceGroups/my-rg
```

## Looking up users and groups (Entra ID / Azure AD)

```bash
az ad user list --filter "displayname eq 'Jane Doe'"
az ad user show --id jane@example.com
```