Stage 5 · Platform

Azure Foundations

Azure CLI & Portal

az CLI, Azure Portal, Cloud Shell, and resource tagging conventions.

7 min readAzure Cloud EngineeringPlatform

Azure CLI Overview

The Azure CLI (az) is Microsoft's cross-platform command-line tool for managing Azure resources. It runs on Windows, macOS, and Linux, and provides a consistent interface for creating, configuring, and deleting Azure resources from a terminal.

Unlike PowerShell, Azure CLI uses a simpler verb-noun syntax (az vm create) and outputs JSON by default. It is the recommended tool for scripting and automation in most Azure documentation.

Install Azure CLI


# macOS
brew install azure-cli

 # Linux (Debian/Ubuntu)
curl -sL https://aka.ms/InstallAzureCLIdeb | sudo bash

 # Verify installation
az version

The az version command shows the CLI version, core extensions, and dependency versions. Keep it updated regularly — new Azure services ship with CLI updates.

Authentication

Azure CLI authenticates to Azure using several methods. The most common is interactive browser login for development, and service principals for automation.


# Interactive browser login (opens a browser tab)
az login

 # Login to a specific tenant
az login --tenant contoso.onmicrosoft.com

 # Service principal login (for automation / CI)
az login --service-principal \
  --username $APP_ID \
  --password $CLIENT_SECRET \
  --tenant $TENANT_ID

 # Managed identity login (when running inside Azure)
az login --identity

Service principal credentials should never be hardcoded. Use environment variables, Azure Key Vault, or managed identities in production.

Never commit credentials

Do not store secrets in shell history or version control. Use az login --federated-token for OIDC-based CI pipelines, or Managed Identities when running inside Azure.

Azure Portal

The Azure Portal (portal.azure.com) is a web-based interface for managing Azure resources. While the CLI is preferred for automation, the portal is invaluable for visual dashboards, live metrics, debugging networking issues, and reviewing policy compliance.

Dashboard view — Pin resources, metrics, and queries to custom dashboards
Resource Explorer — Browse resource properties in a tree view
Activity Log — Audit every ARM operation across subscriptions
Cost Management — Visualize spending by resource group, tag, or service
Policy Compliance — See which resources are compliant or violating policies

Cloud Shell

Azure Cloud Shell is a browser-based terminal with the Azure CLI and common tools pre-installed. It runs in a temporary Linux container and persists files in an Azure File Share mounted at $HOME.

Cloud Shell usage


# Access via portal.azure.com or shell.azure.com
 # Or launch directly:
az shell

 # Cloud Shell automatically mounts a file share
ls ~Clouddrive

 # Pre-installed tools include: az, kubectl, helm, docker, git, terraform

Cloud Shell is free — you only pay for the small Azure File Share it creates. It is useful when you need a quick CLI session without installing anything locally.

Querying with --query

The --query parameter uses JMESPath to filter and transform CLI output. This is essential for scripting — it lets you extract exactly the values you need without parsing raw JSON.

JMESPath query examples


# Get just the names of all resource groups
az group list --query "[].name" --output tsv

 # Get the public IP of a specific VM
az vm show \
  --resource-group rg-web \
  --name vm-web-01 \
  --query "publicIps" \
  --output tsv

 # Filter resources by type
az resource list --query "[?type=='Microsoft.Compute/vm'].{name:name, rg:resourceGroup}" --output table

 # Combine multiple filters
az account list --query "[?state=='Enabled'].{name:name, id:id}" --output table

JMESPath supports array filtering, object construction, and pipe expressions. The --output flag controls the format (json, table, tsv, yaml).

Use --output tsv for scripting

In scripts, --output tsv gives you raw values without quotes or formatting. It is the safest format for use in variable assignments and conditional logic.

CLI Scripting Patterns

Production Azure scripts should handle errors, validate inputs, and provide clear output. These patterns make your scripts reliable and maintainable.

Robust CLI script pattern


#!/usr/bin/env bash
set -euo pipefail

RESOURCE_GROUP="rg-prod-webapp"
LOCATION="eastus"

 # Check if resource group exists
if ! az group show --name "$RESOURCE_GROUP" &>/dev/null; then
  echo "Creating resource group: $RESOURCE_GROUP"
  az group create --name "$RESOURCE_GROUP" --location "$LOCATION"
else
  echo "Resource group already exists: $RESOURCE_GROUP"
fi

 # Create a VM with error handling
az vm create \
  --resource-group "$RESOURCE_GROUP" \
  --name "vm-web-01" \
  --image Ubuntu2204 \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --tags Environment=production Team=web \
  --output json

set -euo pipefail ensures the script exits on any error, undefined variable, or pipe failure. Always use this pattern in production scripts.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.