Azure CLI 2.0 cheatsheet for Login, Resources, VMs, Resource groups, Storage, Batch, and Containers.

az login

az login -u myemail@address.com

az account list

az account set --subscription "xxx"

az account list-locations

az resource list

azure --version

azure help

az vm list-sizes --location eastus

az vm image list --output table

az vm create --resource-group myResourceGroup --name myVM --image ubuntults

az vm create --resource-group myResourceGroup --name myVM --image win2016datacenter

az group create --name myresourcegroup --location eastus

az storage account create -g myresourcegroup -n mystorageaccount -l eastus --sku Standard_LRS

az group delete --name myResourceGroup

az vm list

az vm start --resource-group myResourceGroup --name myVM

az vm stop --resource-group myResourceGroup --name myVM

az vm deallocate --resource-group myResourceGroup --name myVM

az vm restart --resource-group myResourceGroup --name myVM

az vm redeploy --resource-group myResourceGroup --name myVM

az vm delete --resource-group myResourceGroup --name myVM

az image create --resource-group myResourceGroup --source myVM --name myImage

az vm create --resource-group myResourceGroup --name myNewVM --image myImage

az vm extension list --resource-group azure-playground-resources --vm-name azure-playground-vm

az vm extension delete --resource-group azure-playground-resources --vm-name azure-playground-vm --name bootstrapper

az batch account create -g myresourcegroup -n mybatchaccount -l eastus

az storage account create -g myresourcegroup -n mystorageaccount -l eastus --sku Standard_LRS

az batch account set -g myresourcegroup -n mybatchaccount --storage-account mystorageaccount

We can now authenticate directly against the account for further CLI interaction.

az batch account login -g myresourcegroup -n mybatchaccount

az batch account show -g myresourcegroup -n mybatchaccount

az batch application create --resource-group myresourcegroup --name mybatchaccount --application-id myapp --display-name "My Application"

az batch application package create --resource-group myresourcegroup --name mybatchaccount --application-id myapp --package-file my-application-exe.zip --version 1.0

az batch application set --resource-group myresourcegroup --name mybatchaccount --application-id myapp --default-version 1.0

az batch pool node-agent-skus list

az batch pool create \
    --id mypool-linux \
    --vm-size Standard_A1 \
    --image canonical:ubuntuserver:16.04.0-LTS \
    --node-agent-sku-id “batch.node.ubuntu 16.04”

az batch pool resize --pool-id mypool-linux --target-dedicated 5

az batch pool show --pool-id mypool-linux

az batch node list --pool-id mypool-linux

If a particular node in the pool is having issues, it can be rebooted or reimaged. A typical node ID will be in the format 'tvm-xxxxxxxxxx_1-'.

az batch node reboot --pool-id mypool-linux --node-id tvm-123_1-20170316t000000z

az batch node delete \
    --pool-id mypool-linux \
    --node-list tvm-123_1-20170316t000000z tvm-123_2-20170316t000000z \
    --node-deallocation-option requeue

az batch job create --id myjob --pool-id mypool

…where is your preferred shell for execution (/bin/sh, /bin/bash, /bin/ksh etc.), and /path/to/script.sh is, of course, the full path of the shell script you’re invoking to get things started.

az batch task create --job-id myjob --task-id task1 --application-package-references myapp#1.0 --command-line "/bin/<shell> -c /path/to/script.sh"

az batch task create --job-id myjob --json-file tasks.json

Now that all the tasks are added - we can update the job so that it will automatically be marked as completed once all the tasks are finished.

az batch job set --job-id myjob --on-all-tasks-complete terminateJob

az batch job show --job-id myjob

az batch task show --job-id myjob --task-id task1

az batch job delete --job-id myjob

If you HAVE AN SSH run this to create an Azure Container Service Cluster (~10 mins)

az acs create -n acs-cluster -g acsrg1 -d applink789

If you DO NOT HAVE AN SSH run this to create an Azure Container Service Cluster (~10 mins)

az acs create -n acs-cluster -g acsrg1 -d applink789 --generate-ssh-keys

az acs list --output table

az acs list -g acsrg1 --output table

az acs show -g acsrg1 -n acs-cluster --output list

az acs scale -g acsrg1 -n acs-cluster --new-agent-count 4

az acs delete -g acsrg1 -n acs-cluster

$ az config set core.output=table
Command group 'config' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

$ az config set extension.use_dynamic_install=yes_prompt
Command group 'config' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

$ az config set extension.run_after_dynamic_install=yes
Command group 'config' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

https://learn.microsoft.com/en-us/cli/azure/azure-cli-configuration

# turn persisted parameters on
az config param-persist on

# Create a resource group which will store "resource group" and "location" in persisted parameter.
az group create --name RGlocalContext --location westeurope

# Create an Azure storage account omitting location and resource group.
az storage account create \
  --name sa1localcontext \
  --sku Standard_LRS

# Create a serverless function app in the resource group omitting storage account and resource group.
az functionapp create \
  --name FAlocalContext \
  --consumption-plan-location westeurope \
  --functions-version 2

# See the stored parameter values
az config param-persist show```
<https://learn.microsoft.com/en-us/cli/azure/param-persist-howto>

## How to use Fiddler (web proxy) with the CLI?

```bash
export HTTP_PROXY="http://localhost:8888" HTTPS_PROXY="http://localhost:8888"

export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1

az login
az account list
az account set -s <subscription>

az configure --defaults location=<location_name>
az configure --defaults group=<resourceGroupName>

Set an environment variable VAULT_NAME to your the name of your Key Vault resource,e.g.:

set VAULT_NAME=pvb-uat-euw-kv

Then run these commands:

del %VAULT_NAME%.csv

for /f %i in ('az keyvault secret list --vault-name %VAULT_NAME%') do @az keyvault secret show --vault-name %VAULT_NAME% --name %i -o tsv --query "{name:name, value:value}" >> %VAULT_NAME%.csv

more %VAULT_NAME%.csv

az webapp list [-g group] [-s sub]

set APP_NAME=pvb-live-euw-admin-as
az webapp config appsettings list -g  pvb-live -n  %APP_NAME% -o tsv > %APP_NAME%.settings.csv

az functionapp config appsettings list -g  pvb-live -n  pvb-live-euw-admin-as

set RG=pvb-uat

for /f %i in ('az webapp list -g %RG%' -o tsv --query "[].{name:name}"') do @az webapp config appsettings list -g %RG% -n %i -o tsv >> %RG%.%i.settings.csv

az account set -s Playground
RG=pvb-uat

az resource list -g $RG --query "[].{ name: name, kind: kind, type: type, location: location }" --output table

az account set -s Playground
RG=pvb-uat

az role assignment list --resource-group $RG --output json --query '[].{principalName:principalName, roleDefinitionName:roleDefinitionName, scope:scope}'

az account set -s Playground
RG=pvb-uat

# NB bash on Windows (WSL) may need the CR trimming:
# for scope in "$(az resource list -g $1 -o tsv --query '[].{ id: id }' | tr -d '\r')"; do
for scope in "$(az resource list -g $RG -o tsv --query '[].{ id: id }')"; do
    echo IAM for $scope
    az role assignment list --scope $scope -o table
done

for rg in $(az group list -o tsv --query "[].{name:name}" | tr -d '\r'); do
  #echo resources in $rg

  for scope in "$(az resource list -g $rg -o tsv --query '[].{ id: id }' | tr -d '\r')"; do
      echo "$scope"
      az role assignment list --scope "$scope" -o table
  done
done

You can list all your Cosmos DBs in a subscription with something like this:

az cosmosdb list --subscription %subscriptionId% --query "[].{name:name, kind:kind, location:location, resourceGroup:resourceGroup}"

Given all your subscriptions IDs are:

az account list -o tsv --query "[].{id:id}"

Then all your "Cosmoses" can be queried like so:

for /f %s in ('az account list -o tsv --query "[].{id:id}"') do @az cosmosdb list --subscription %s --query "[].{name:name, kind:kind, location:location, resourceGroup:resourceGroup}" -o tsv

^* In these examples, the type is "MongoDB". You could remove that ?kind=='MongoDB' filter from the query and list all as above.

for /f %s in ('az account list -o tsv --query "[].{id:id}"') do @az cosmosdb list --subscription %s --query "[?kind=='MongoDB'].{name:name, kind:kind, location:location, resourceGroup:resourceGroup}" -o json

for sub in $(az account list -o tsv --query '[].{id:id}' | tr -d '\r'); do
  az cosmosdb list --subscription $sub --query "[?kind=='MongoDB'].{name:name, kind:kind, location:location, resourceGroup:resourceGroup}" -o json
done

for sub in $(az account list -o tsv --query '[].{id:id}' | tr -d '\r'); do
  for sql in $(az sql server list --subscription $sub --query "[].{name:name}" | tr -d '\r'); do
    echo $sql
    # az sql elastic-pool list --subscription $sub -o table
  done
done

$ az webapp deployment source config-zip -g pvb-qat-rg -n pvb-qat-euw-myapp-as --src .\bin\Release\netcoreapp3.1\publish.zip

Getting scm site credentials for zip deployment
Starting zip deployment. This operation can take a while to complete ...
Deployment endpoint responded with status code 202
Active    Author    Author_email    Complete    Deployer    End_time                      Is_readonly    Is_temp    Last_success_end_time         Log_url                                                                             Message                        Progress    Received_time               Site_name                  Start_time                    Status    Status_text    Url
--------  --------  --------------  ----------  ----------  ----------------------------  -------------  ---------  ----------------------------  ----------------------------------------------------------------------------------  -----------------------------  ----------  --------------------------  -------------------------  ----------------------------  --------  -------------  ------------------------------------------------------------------------------
True      N/A       N/A             True        ZipDeploy   2021-01-30T11:53:11.3202611Z  True           False      2021-01-30T11:53:11.3202611Z  https://pvb-qat-euw-myapp-as.scm.azurewebsites.net/api/deployments/latest/log  Created via a push deployment              2021-01-30T11:53:09.85145Z  pvb-qat-euw-myapp-as  2021-01-30T11:53:10.3827205Z  4                        https://pvb-qat-euw-myapp-as.scm.azurewebsites.net/api/deployments/latest

$

az monitor metrics alert create -n "InfoCapchaSqlDtuOver80pct" -g "pvb-qat-rg" --scopes "dtu_used" --condition "avg Percentage DTU > 80" --description "Check to see if the Avg DTU exceeds 80%."

for group in "$(az group list -o tsv --query '[].{name:name}' | tr -d '\r')"; do
  az monitor metrics alert list -g $group;
done

These notes assume that you already have an app service plan running a number of sites (web apps) that ALL want the same wildcard cert.

The problem being solved was how to point a number of sites to a company domain.

The aliases (e.g. alias trainer.foo-uk.com onto CNAME pvb-live-eun-trainer-as.azurewebsites.net) MUST already be configured in DNS -- Azure will check!

You might instead want to query a Resource Group. I chose a plan because I had another plan in the same resource group that I didn't want to configure. In this exmaple I want the LIVE sites running in EU North, i.e. pvb-live-eun-asp.

$ az webapp list -g $resourceGroup --query "[?ends_with(appServicePlanId, '-eun-live-asp')].{name: name, plan: appServicePlanId}" -o table

Name                     Plan
-----------------------  -------------------------------------------------------------------------------------------------
 pvb-live-eun-trainer-as  /subscriptions/.../resourceGroups/foo-live/providers/Microsoft.Web/serverfarms/ pvb-live-eun-asp
 pvb-live-eun-manager-as  /subscriptions/.../resourceGroups/foo-live/providers/Microsoft.Web/serverfarms/ pvb-live-eun-asp
 pvb-live-eun-booking-as  /subscriptions/.../resourceGroups/foo-live/providers/Microsoft.Web/serverfarms/ pvb-live-eun-asp
 pvb-live-eun-admin-as    /subscriptions/.../resourceGroups/foo-live/providers/Microsoft.Web/serverfarms/ pvb-live-eun-asp
 pvb-live-eun-driver-as   /subscriptions/.../resourceGroups/foo-live/providers/Microsoft.Web/serverfarms/ pvb-live-eun-asp

declare -A aliases=( \
  [" pvb-live-eun-trainer-as"]="trainer" \
  [" pvb-live-eun-manager-as"]="app-manager" \
  [" pvb-live-eun-booking-as"]="booking" \
  [" pvb-live-eun-admin-as"]="admin" \
  [" pvb-live-eun-driver-as"]="app" \
)

pfxPassword=********
domain=pvb-uk.com
pfxPath=pvb-uk.pfx
resourceGroup=pvb-live

...

for webappname in $(az webapp list -g $resourceGroup --query "[?ends_with(appServicePlanId, 'eun-live-asp')].{name: name}" -o tsv); do
    # Map the prepared custom domain name to the web app, lookiing up the mapping in dictionary (associative array) above
    fqdn=${aliases[$webappname]}.$domain
    echo Adding hostname $fqdn to $webappname...
    az webapp config hostname add --webapp-name $webappname --resource-group $resourceGroup --hostname $fqdn
    echo $fqdn added to $webappname.

    # Upload the SSL certificate and get the thumbprint.
    echo Uploading cert tp $webappname...
    thumbprint=$(az webapp config ssl upload --certificate-file $pfxPath --certificate-password $pfxPassword --name $webappname --resource-group $resourceGroup --query thumbprint --output tsv)
    echo Cert uploaded.

    # Binds the uploaded SSL certificate to the web app.
    echo Binding $thumbprint to $webappname...
    # read -p "Press [Enter] key when ready ..."
    az webapp config ssl bind --certificate-thumbprint $thumbprint --ssl-type SNI --name $webappname --resource-group $resourceGroup
    echo "You can now browse to https://$fqdn"

    read -p "Press [Enter] key to continue..."
done

if [ $? -ne 0 ]; then
    echo "Failed to add hostname to $webappname"
    # exit 1
fi

• https://github.com/Azure/azure-cli/blob/dev/doc/use_cli_effectively.md
• https://docs.microsoft.com/en-us/cli/azure/query-azure-cli?view=azure-cli-latest
• https://www.lytzen.name/2019/04/11/add-user-to-all-azure-subs.html
• https://docs.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest#az-webapp-list

• Installation
• Virtual Machines
  • VM-UTIL: List all virtual machines
  • VM-UTIL: List all stopped virtual machines
  • VM-UTIL: Check status of all virtual machines
  • VM-UTIL: Get all ip addresses from stopped virtual machines
  • VM-UTIL: List all snapshots in the date specified
  • VM-SEC: List all snapshot in the date specified and without encryption
  • VM-SEC: List SecurityGroups with SSH (22) open to Internet
  • VM-SEC: List all server certificates
• Keys & Access Management
  • KAM-UTIL: List all policies
  • KAM-UTIL: List all groups
  • KAM-UTIL: Get users for a specified for a given group
  • KAM-SEC: Check if user has MFA enabled
  • KAM-SEC: Check if user has MFA enabled
  • KAM-SEC: Check users with no MFA enabled
• Storage
  • STR-UTIL: List all storages
  • STR-UTIL: Check alerts for storage accounts
• SQL
  • SQL-SEC: Check if a database has transparent data encryption enabled

Ref: https://docs.microsoft.com/es-es/cli/azure/?view=azure-cli-latest

az vm list

az vm list -d \
    --query "[?powerState=='VM deallocated'] || [?powerState=='VM stopped'] || [?powerState=='VM unknown']"

az vm list -d \
    --query "[].[name, powerState]"

az vm list -d \
    --query "[?powerState=='VM deallocated'].[name, powerState, publicIps] || [?powerState=='VM stopped'].[name, powerState, publicIps] || [?powerState=='VM unknown'].[name, powerState, publicIps]"

az snapshot list \
    --query "[?timeCreated >= '2019-06-02']"

az snapshot list \
    --query "[?timeCreated >= '2019-06-02'] && [?encryptionSettingsCollection==null]"

az network nsg list \
    --query "[?securityRules[?access == 'Allow']].[name] && [?securityRules[?destinationPortRange == '22']].[name]"

az keyvault list \
    --query "[].[vaultName] \
    --out tsv"\
    |xargs -I {} bash -c 'if [[ $(az keyvault certificate list --vault-name {}) ]]; then echo {} ; fi

az policy definition list

az group list

az ad group member list \
    --group {name}

$Msolcred = Get-credential
Connect-MsolService -Credential $MsolCred
Get-MsolUser -All | where {$_.StrongAuthenticationMethods -ne $null} | Select-Object -Property UserPrincipalName, DisplayName

Get-MsolUser -All | where {$_.StrongAuthenticationMethods.Count -eq 0} | Select-Object -Property UserPrincipalName, DisplayName

az storage account list

az security alert list \
    --query "[?contains(extendedProperties.resourceType, 'Storage')]"

az sql db tde show \
    --server {name} \
    --resource-group {name} \
    --database {name}

Collection of commands I've found useful and don't want to forget or lose from my shell history.

# Set the context
az account set -s $subscriptionName
# Show context information
az account show
# Login with a service principal
az login --service-principal --username $clientId --password $clientSecret --tenant $tenantId

# Show a user
az ad user show --id $mail --query "displayName"
# Show a group
az ad group show -g $groupName --query "objectId"
# List group members
az ad group member list -g $groupName --query "[].displayName"
# List service principals
az ad sp list --display-name "Startswith..." --query "[].[displayName,objectId]"

# List projects
az devops project list --organization $orgUrl --query "value[].name" > projects
# List repositories
while read project; do az repos list --detect true --organization $orgUrl --project $project --query "[].{repoName: name,projectName: pr
oject.name}" >> repo_list; done < projects

az extension add --name $extensionName

# Set context
Set-AzContext -Subscription $SubscriptionName
# Get context
Get-AzContext

# Get role definition
$Role = Get-AzRoledefinition -Name $RoleName
# Modify permissions
$Role.Actions.Add("Microsoft.Compute/...")
$Role.Actions.Remove("Microsoft.Compute/...")
# Update role
Set-AzRoleDefinition -Role $Role

I think there's been a change in behaviour in WSL or the Azure CLI that had me puzzled for a bit.

When you run an az command in bash on Windows you might get a CRLF (\r\n) in the response rather than just the LF (\n) you'd have on POSIX/linux environments.

I'm using Ubuntu 20.04 (Ubuntu 20.04.1 LTS) in WSL2 on Windows 10 (20H2 / 19042.746).

If you capture an az command into a variable, e.g.:

local slotId=$(az $resourceType deployment slot list --name pvb-live-euw-mywebapp-as --resource-group pvb-live-rg -o tsv --query [].id) >/dev/null

echo "stop deployment slot with id $slotId"
az resource invoke-action --action stop --ids $slotId

and try to use it in a command you'll get an error, e.g.:

BadRequestError: Operation failed with status: 'Bad Request'. Details: 400 Client Error: Bad Request for url:
https://management.azure.com/subscriptions/453dead-9ac1-cafe-2805-decafbad755f/resourceGroups/pvb-
live-rg/providers/Microsoft.Web/sites/pvb-live-euw-mywebapp-as/slots/staging%0D/stop?api-version=2020-09-01

See the %0D (CR) in that URL? (It's at the end just before the query string.) That's what's causing the HTTP 400. The reason it's there is because the slotId I got back from the previous command has the CR of CRLF in it .

I'm not sure if that's a bug, but one solution is to pipe bash's transform, | tr -d '\r', to trim the trailing CR:

local slotId=$(az $resourceType deployment ... -o tsv --query [].id | tr -d '\r') >/dev/null

Note: This is not an issue with line endings in the script, but a problem with the line endings of the "response" to stdout.

Command az monitor metrics alert create : Create a metric-based alert rule.

Arguments --condition [Required] : The condition which triggers the rule. Usage: --condition {avg,min,max,total,count} [NAMESPACE.]METRIC {=,!=,>,>=,<,<=} THRESHOLD [where DIMENSION {includes,excludes} VALUE [or VALUE ...] [and DIMENSION {includes,excludes} VALUE [or VALUE ...] ...]]

    Dimensions can be queried by adding the 'where' keyword and multiple dimensions can be
    queried by combining them with the 'and' keyword.

    Values for METRIC, DIMENSION and appropriate THRESHOLD values can be obtained from `az
    monitor metrics list-definitions` command.

    Due to server limitation, when an alert rule contains multiple criterias, the use of
    dimensions is limited to one value per dimension within each criterion.

    Multiple conditions can be specified by using more than one `--condition` argument.
--name -n              [Required] : Name of the alert rule.
--resource-group -g    [Required] : Name of resource group. You can configure the default group
                                    using `az configure --defaults group=<name>`.
--scopes               [Required] : Space-separated list of scopes the rule applies to. The
                                    resources specified in this parameter must be of the same
                                    type and exist in the same location.
--action -a                       : Add an action group and optional webhook properties to fire
                                    when the alert is triggered.
    Usage:   --action ACTION_GROUP_NAME_OR_ID [KEY=VAL [KEY=VAL ...]]

    Multiple action groups can be specified by using more than one `--action` argument.
--auto-mitigate                   : Automatically resolve the alert.  Allowed values: false,
                                    true.
--description                     : Free-text description of the rule.
--disabled                        : Create the rule in a disabled state.  Allowed values: false,
                                    true.
--evaluation-frequency            : Frequency with which to evaluate the rule in "##h##m##s"
                                    format.  Default: 1m.
--region --target-resource-region : The region of the target resource(s) in scopes. This must be
                                    provided when scopes is resource group or subscription.
--severity                        : Severity of the alert from 0 (critical) to 4 (verbose).
                                    Default: 2.
--tags                            : Space-separated tags: key[=value] [key[=value] ...]. Use ""
                                    to clear existing tags.
--target-resource-type --type     : The resource type of the target resource(s) in scopes. This
                                    must be provided when scopes is resource group or
                                    subscription.
--window-size                     : Time over which to aggregate metrics in "##h##m##s" format.
                                    Default: 5m.

Global Arguments --debug : Increase logging verbosity to show all debug logs. --help -h : Show this help message and exit. --only-show-errors : Only show errors, suppressing warnings. --output -o : Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc. Default: table. --query : JMESPath query string. See http://jmespath.org/ for more information and examples. --subscription : Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID. --verbose : Increase logging verbosity. Use --debug for full debug logs.

• Create a high CPU usage alert on a VM with no action.

 az monitor metrics alert create -n alert1 -g {ResourceGroup} --scopes {VirtualMachineID} --condition "avg Percentage CPU > 90" --description "High CPU"

• Create a high CPU usage alert on a VM with email and webhook actions.

az monitor metrics alert create -n alert1 -g {ResourceGroup} --scopes {VirtualMachineID} \
--condition "avg Percentage CPU > 90" --window-size 5m --evaluation-frequency 1m \
--action "/subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.Insights/actionGroups/<actionGroupName>" apiKey={APIKey} type=HighCPU \
--description "High CPU"

• Create an alert when a storage account shows a high number of slow transactions, using multi-dimensional filters.

az monitor metrics alert create -g {ResourceGroup} -n alert1 --scopes {StorageAccountId} \
    --description "Storage Slow Transactions" \
    --condition "total transactions > 5 where ResponseType includes Success" \
    --condition "avg SuccessE2ELatency > 250 where ApiName includes GetBlob"

• Create a metric-based alert rule that monitors a custom metric.

az monitor metrics alert create -n "metric alert rule on a custom metric" -g "Demos"
--scopes {VirtualMachineID} \
    --condition "max Azure.VM.Windows.GuestMetrics.Memory\Available Bytes > 90" \
--window-size 5m --evaluation-frequency 1m

• Create a high CPU usage alert on several VMs with no actions.

az monitor metrics alert create -n alert1 -g {ResourceGroup} --scopes {VirtualMachineID1}
{VirtualMachineID2} {VirtualMachineID3} \
--condition "avg Percentage CPU > 90" --description "High CPU"

For more specific examples, use: az find "az monitor metrics alert create"

Please let us know how we are doing: https://aka.ms/azureclihats