CloudsLink — Azure CLI Cheat Sheet

Setup & configuration

Sign in

Opens a browser; use --use-device-code on a headless machine.

$ az login

$ az login --use-device-code

List and switch subscriptions

az account show is the "who am I / where am I" check.

$ az account list --output table

$ az account set --subscription "My Subscription"

$ az account show

Set defaults

Once set, most commands no longer need --resource-group or --location.

$ az config set defaults.group=my-rg defaults.location=westus2 core.output=table

Built-in help and examples

$ az vm create --help

$ az find "az storage blob"

Resource groups

Everything in Azure lives inside a resource group — deleting the group deletes it all.

Create a resource group

$ az group create --name my-rg --location westus2

List groups and their contents

$ az group list --output table

$ az resource list --resource-group my-rg --output table

Delete a group (and everything in it)

--no-wait returns immediately instead of blocking on the long-running delete.

$ az group delete --name my-rg --yes --no-wait

Storage

--auth-mode login uses your Entra identity instead of account keys — prefer it when you have a data-plane role.

Create a storage account and container

$ az storage account create --name mystorage123 --resource-group my-rg \
    --location westus2 --sku Standard_LRS

$ az storage container create --name assets --account-name mystorage123 --auth-mode login

Upload and download blobs

$ az storage blob upload --account-name mystorage123 --container-name assets \
    --file ./report.pdf --name reports/report.pdf --auth-mode login

$ az storage blob download --account-name mystorage123 --container-name assets \
    --name reports/report.pdf --file ./report.pdf --auth-mode login

Sync a directory

Uploads only new or changed files — the static-site deploy pattern (the $web container backs static websites).

$ az storage blob sync --account-name mystorage123 --container '$web' --source ./dist

Generate a SAS URL

Temporary, read-only access to a private blob.

$ az storage blob generate-sas --account-name mystorage123 --container-name assets \
    --name reports/report.pdf --permissions r --expiry 2026-07-09T00:00Z \
    --full-uri --output tsv

List and delete blobs

$ az storage blob list --account-name mystorage123 --container-name assets \
    --auth-mode login --output table

$ az storage blob delete-batch --account-name mystorage123 --source assets \
    --pattern 'logs/*' --auth-mode login

Virtual machines

Create a VM

$ az vm create --resource-group my-rg --name web-1 \
    --image Ubuntu2204 --size Standard_B1s \
    --admin-username azureuser --generate-ssh-keys

List VMs with IPs and power state

-d adds runtime details like public IP and power state.

$ az vm list -d --output table

Start, stop, deallocate

stop keeps you paying for compute; deallocate releases the hardware and stops the compute charge.

$ az vm deallocate --resource-group my-rg --name web-1

$ az vm start --resource-group my-rg --name web-1

Open a port

Adds an allow rule to the VM's network security group.

$ az vm open-port --resource-group my-rg --name web-1 --port 443

Run a command on the VM

$ az vm run-command invoke --resource-group my-rg --name web-1 \
    --command-id RunShellScript --scripts "uptime"

Entra ID & RBAC

Create a service principal for CI

Returns a client ID and secret scoped to the role and scope you grant — the secret is shown once.

$ az ad sp create-for-rbac --name ci-deployer \
    --role Contributor \
    --scopes /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg

Grant a role

$ az role assignment create --assignee user@example.com \
    --role "Storage Blob Data Reader" \
    --scope /subscriptions/<sub-id>/resourceGroups/my-rg

See who has access

$ az role assignment list --resource-group my-rg --output table

App Service & Functions

List web apps and function apps

$ az webapp list --output table

$ az functionapp list --output table

Deploy a zip package

$ az webapp deploy --resource-group my-rg --name my-app \
    --src-path app.zip --type zip

Set app settings (environment variables)

$ az webapp config appsettings set --resource-group my-rg --name my-app \
    --settings STAGE=prod LOG_LEVEL=info

Tail live logs

$ az webapp log tail --resource-group my-rg --name my-app

AKS

Connect kubectl to a cluster

Merges the cluster's credentials into your kubeconfig.

$ az aks get-credentials --resource-group my-rg --name my-cluster

List clusters

$ az aks list --output table

Scale the node pool

$ az aks scale --resource-group my-rg --name my-cluster --node-count 3

Container Registry

Log Docker in to ACR

$ az acr login --name myregistry

Build and push in the cloud

Builds the image on ACR's infrastructure and pushes it — no local Docker daemon needed.

$ az acr build --registry myregistry --image my-app:latest .

List repositories and tags

$ az acr repository list --name myregistry

$ az acr repository show-tags --name myregistry --repository my-app

Monitor

Recent activity in a resource group

The audit trail of who changed what.

$ az monitor activity-log list --resource-group my-rg --offset 2h \
    --query '[].[eventTimestamp,operationName.localizedValue,caller]' --output table

Query a metric

$ az monitor metrics list --resource <resource-id> \
    --metric "Percentage CPU" --interval PT5M --output table

No commands match "" — try a service name or verb like sync, deploy, tail.