Using Azure CLI: Essential Commands for Beginners

Why Use the CLI Instead of the Portal

The portal is good for one-off tasks and visual exploration. The CLI starts to pay off the moment you need to do anything more than once. A CLI command is a line of text — you can save it in a script, check it into version control, paste it into a runbook, or drop it into a CI/CD pipeline. A sequence of portal clicks is harder to document and impossible to automate.

The CLI is also faster for power users. Once you know the command pattern for a service, executing it in a terminal is quicker than navigating a multi-tab form in the portal. And if you are managing resources in multiple subscriptions or regions at once, scripting with the CLI is the only practical option.

If you want to run the CLI without installing anything locally, Azure Cloud Shell provides a browser-based terminal with the CLI pre-installed. For a full local install walkthrough, see Installing Azure CLI.

How Azure CLI Commands Are Structured

Every Azure CLI command follows the same pattern:

az [group] [subgroup] [command] [--parameters]

For example, az storage account create breaks down as: az (the CLI tool), storage (the service group), account (the resource subgroup), create (the operation). Parameters are passed as named flags like —name, —resource-group, and —location.

This consistent structure means that once you learn how one service works, the pattern for others is familiar. You can also add —help to any command at any level to see its options:

az storage account --help
az storage account create --help

8 Essential Commands Every Beginner Needs

1. az login

Authenticates your terminal session with Azure. Running this opens a browser window where you sign in with your Microsoft account or work account. After sign-in, the CLI stores a token locally so you stay logged in across sessions without re-entering credentials.

az login

On a server or any environment without a browser, use device code flow:

az login --use-device-code

This prints a URL and a code. You open the URL on any device, enter the code, and sign in there. The terminal session authenticates once you complete the browser flow.

2. az account list

Lists all Azure subscriptions your account has access to. The output shows the subscription name, ID, tenant ID, and whether each is currently active (the “isDefault” field).

az account list --output table

Use the —output table flag to get a readable columns-based view instead of raw JSON.

3. az account set

Sets the active subscription for all subsequent commands. This is the most commonly skipped step that causes confusing errors. If you have access to multiple subscriptions and do not set the correct one, your commands will succeed but create resources in the wrong place.

az account set --subscription "my-dev-subscription"

You can use either the subscription name or its ID (a UUID). After running this, az account show confirms which subscription is now active.

4. az account show

Shows the currently active subscription. Use this to confirm you are targeting the right subscription before running any create or delete commands.

az account show --output table

5. az group create

Creates a resource group. A resource group is a container that holds related Azure resources. Every resource in Azure must belong to a resource group, so you create one before you create anything else.

az group create \
  --name myapp-dev-rg \
  --location eastus

The —location value is an Azure region identifier. Use az account list-locations —output table to see all available region names. See Azure Regions and Availability Zones for guidance on choosing a region.

6. az resource list

Lists all resources in a subscription, optionally filtered by resource group or resource type.

# All resources in a resource group
az resource list --resource-group myapp-dev-rg --output table

# All resources of a specific type in the subscription
az resource list --resource-type Microsoft.Compute/virtualMachines --output table

This is useful for auditing what exists in an account, especially when inheriting a subscription someone else set up.

7. az group delete

Deletes a resource group and every resource inside it. This is the fastest way to clean up after an experiment.

az group delete --name myapp-dev-rg --yes --no-wait

The —yes flag skips the confirmation prompt. The —no-wait flag returns control to the terminal immediately rather than waiting for deletion to finish (which can take minutes for large groups). Without —no-wait, the terminal blocks until all resources are gone.

8. az configure

Sets default values so you do not have to type them on every command. Useful defaults include a default location and a default resource group.

az configure --defaults location=eastus group=myapp-dev-rg

After setting these, commands like az vm create —name myvm —image Ubuntu2204 will automatically use the configured location and resource group. Run az configure —list-defaults to see what defaults are currently set.

Output Formats

By default, most Azure CLI commands return JSON. Azure CLI supports four output formats via the —output (or -o) flag:

• json — the default. Full structured output. Best for piping to tools like jq or for use in scripts that need to parse fields.
• table — a human-readable columns view. Drops most fields and shows a summary. Best for interactive terminal use.
• tsv — tab-separated values. No headers, no formatting. Best for shell scripting where you want to assign a value to a variable.
• yaml — YAML format. Useful if you are more comfortable reading YAML than JSON.

# Get just the ID of a resource group as a plain string for use in a script
az group show --name myapp-dev-rg --query id --output tsv

The —query flag accepts a JMESPath expression to filter or reshape the output. This is powerful but has a learning curve. For simple cases, —query name or —query id extracts a single field.

You can set a default output format so you do not have to type —output table constantly:

az configure --defaults output=table

The Subscription Scoping Problem

The single most common CLI mistake for people with access to multiple subscriptions is running commands in the wrong subscription. The CLI always operates in the currently active subscription — the one set by your most recent az account set call. There is no subscription selector you need to click before every command. Whatever was active last session is still active this session.

This means if you were working in a production subscription yesterday and you run az vm create today without explicitly setting your dev subscription first, you create a VM in production.

Two habits that prevent this:

1. Start every CLI session with az account show —output table to confirm the active subscription.
2. Set your shell prompt to include the active Azure subscription. Several community tools (like the Azure PowerShell prompt module or custom .zshrc snippets) do this automatically.

You can also scope individual commands to a specific subscription using the —subscription flag available on most commands, without changing the global active subscription:

az resource list --subscription "my-prod-subscription" --output table

For more on subscriptions and how they relate to billing and organization, see Azure Subscriptions.

Getting Help from the CLI Itself

You do not need to memorize every command. The CLI has built-in help at every level:

# See all top-level command groups
az --help

# See commands in a group
az storage --help

# See all options for a specific command
az storage account create --help

The help output includes required parameters (marked with a square bracket notation) and examples. Reading the examples section of —help is often faster than searching documentation.

The CLI also has an interactive mode that autocompletes commands as you type:

az interactive

This is worth trying when you are learning a new service area — it shows parameter names and descriptions as you type.