AKS CrashLoopBackOff, Pending Pods, and NotReady Nodes — The Real Fixes Engineers Use

Reference GuideAzure CLICloud EngineeringAdministration2026

Top 100 Azure CLI Commands Every
Cloud Engineer Should Know

Forget the portal. The engineers who move fastest in Azure operate from the terminal — provisioning resources in seconds, scripting repeatable deployments, and querying cross-subscription state in one line. This guide covers the 100 commands that actually appear in production workflows: with real examples, JMESPath output queries, and the tips that turn novice users into CLI power users.

100

Commands across 12 categories — authentication, resource management, VMs, networking, storage, App Service, AKS, ACR, Key Vault, monitoring, RBAC, and cost management

--query

The single most powerful Azure CLI flag. JMESPath expressions filter and transform JSON output — turning 200-line resource dumps into the 2 fields you actually need

-o table

The output flag that makes Azure CLI actually readable in a terminal. Every list command in this guide uses -o table so you can scan results in seconds

--no-wait

The flag that unlocks true CLI productivity: fire a long-running command (VM create, AKS scale) and immediately continue working without waiting for completion

Table of Contents — 12 Command Categories

01Authentication & Account Management (1–8)

02Resource Groups & Subscriptions (9–16)

03Virtual Machines (17–26)

04Networking (27–36)

05Storage Accounts & Blobs (37–46)

06App Service & Web Apps (47–54)

07AKS — Kubernetes (55–63)

08Azure Container Registry (64–69)

09Key Vault & Secrets (70–76)

10Monitoring & Diagnostics (77–83)

11RBAC & Identity (84–90)

12Cost, Policy & Productivity (91–100)

The Azure CLI (az) is a cross-platform command-line tool that provides complete access to every Azure resource type through a consistent verb-noun command structure: az [group] [subgroup] [command] --flags. It runs on Windows, macOS, and Linux, and is available directly in Azure Cloud Shell without any local installation. Every command in this guide has been validated against the current Azure CLI version (2.62+) and works in both Bash and PowerShell terminals.

Figure 1 — Azure CLI command anatomy: understanding the structure of every az command

Every Azure CLI command follows the same structure: az [group] [subgroup] [command] [--flags]. The -o flag controls output format. The --query flag applies a JMESPath expression to filter JSON output before formatting. Master these two flags and every command in this guide becomes twice as useful.

Figure 2 — Azure CLI scope hierarchy: how commands map to the Azure resource model

Azure CLI commands mirror the Azure resource hierarchy. Tenant → Subscription → Resource Group → Resources. Most commands target a specific resource group (--resource-group) within the currently active subscription (set with az account set).

Before You Start: Essential Setup

Install: winget install Microsoft.AzureCLI (Windows) or brew install azure-cli (macOS) or curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash (Ubuntu). Verify: az version. Set default output format once: az config set core.output=table. This saves you typing -o table on every command.

01Authentication & Account ManagementCommands 1–8

1az login

Authenticate to Azure. Opens a browser for interactive login. Returns a list of accessible subscriptions.

az login
# Device code flow (headless / SSH sessions)
az login --use-device-code
# Service principal login (CI/CD pipelines)
az login --service-principal -u APP_ID -p PASSWORD --tenant TENANT_ID

2az account list

List all subscriptions accessible to the logged-in account. Shows name, ID, state, and which is active.

az account list -o table
# List only enabled subscriptions
az account list --query "[?state=='Enabled']" -o table

3az account set

Set the active subscription for all subsequent commands. Use subscription name or ID.

az account set --subscription "My Production Sub"
# Or by ID
az account set -s xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

💡 Tip: Store the sub ID in a variable: SUB=$(az account show --query id -o tsv)

4az account show

Show the currently active subscription — useful in scripts to confirm context before running destructive commands.

az account show -o table
# Get just the subscription ID (for scripting)
az account show --query id -o tsv

5az logout

Log out and clear cached credentials. Always run before closing a shared terminal session.

az logout

6az account get-access-token

Get a raw Bearer token for the current session. Useful for calling Azure REST APIs directly in scripts.

# Get token for ARM API
TOKEN=$(az account get-access-token --query accessToken -o tsv)
curl -H "Authorization: Bearer $TOKEN" https://management.azure.com/subscriptions?api-version=2020-01-01

7az configure

Set persistent defaults for resource group, location, or web app — eliminate repetitive flags from every command.

# Set defaults so you never type --resource-group or --location again
az configure --defaults group=rg-prod location=eastus
# View current defaults
az configure --list-defaults

💡 Production tip: Set defaults per project directory using az config set --local

8az version

Show the installed Azure CLI version and all installed extensions. Run this first when troubleshooting unexpected command behavior.

az version
# Upgrade CLI and all extensions
az upgrade

02Resource Groups & SubscriptionsCommands 9–16

9az group create

Create a resource group. Every Azure resource lives in a resource group — create this first.

az group create --name rg-prod --location eastus
# With tags for cost management
az group create -n rg-prod -l eastus --tags env=prod team=platform costcenter=CC100

10az group list

List all resource groups in the active subscription. Filter by tag to find groups for a specific project.

az group list -o table
# Filter by tag
az group list --tag env=prod -o table
# Get names only
az group list --query "[].name" -o tsv

11az group show

Show details of a specific resource group including location, tags, and provisioning state.

az group show --name rg-prod -o table

12az group delete

Delete a resource group and ALL resources inside it. Irreversible. Always confirm the group name before running.

# --yes skips the confirmation prompt (dangerous in scripts without guards)
az group delete --name rg-dev --yes --no-wait

⚠ Warning: This deletes every resource in the group. Double-check with az group show first.

13az resource list

List all resources in a resource group or subscription. Essential for audits and orphan resource detection.

az resource list --resource-group rg-prod -o table
# Filter by resource type
az resource list --resource-type Microsoft.Compute/virtualMachines -o table
# List all resources across the entire subscription
az resource list -o table

14az resource tag

Add or update tags on any Azure resource. Tags are your primary cost attribution mechanism.

az resource tag --ids /subscriptions/SUB/resourceGroups/rg-prod/providers/... \
  --tags env=prod team=platform costcenter=CC100

15az deployment group create

Deploy an ARM template or Bicep file to a resource group. The IaC deployment command.

# Deploy a Bicep file
az deployment group create \
  --resource-group rg-prod \
  --template-file main.bicep \
  --parameters @params.prod.json
# What-if: preview changes without deploying
az deployment group what-if --resource-group rg-prod --template-file main.bicep

16az graph query

Run Azure Resource Graph queries across subscriptions using KQL. Requires the resource-graph extension.

# Install extension once
az extension add --name resource-graph
# Find all unattached managed disks across all subscriptions
az graph query -q "Resources | where type=='microsoft.compute/disks' \
  and properties.diskState=='Unattached' | project name, resourceGroup, location" -o table

💡 Resource Graph is the fastest way to query across 100+ subscriptions in one command.

03Virtual MachinesCommands 17–26

17az vm create

Create a virtual machine. One command provisions the VM, OS disk, NIC, public IP, and NSG by default.

az vm create \
  --resource-group rg-prod \
  --name vm-web01 \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --no-wait # Fire-and-forget

18az vm list

List all VMs in a resource group or subscription with their power state.

az vm list -g rg-prod -o table
# Include power state (running/stopped/deallocated)
az vm list -g rg-prod --show-details --query "[].{Name:name,State:powerState,Size:hardwareProfile.vmSize}" -o table

19az vm start / stop / restart

Control VM power state. deallocate (not just stop) releases compute billing — just stopping keeps billing running.

az vm start -g rg-prod -n vm-web01
az vm stop -g rg-prod -n vm-web01 # Stops OS but still billed for compute!
az vm deallocate -g rg-prod -n vm-web01 # Stops billing ← use this
az vm restart -g rg-prod -n vm-web01

💡 Always use az vm deallocate to stop billing. az vm stop keeps the VM allocated and charged.

20az vm show

Show full details of a VM including hardware profile, network interfaces, and OS disk.

az vm show -g rg-prod -n vm-web01 -o table
# Get just the public IP
az vm show -g rg-prod -n vm-web01 \
  --query "publicIpAddress" -o tsv

21az vm resize

Change the VM size (SKU). The VM must be deallocated first for most cross-family resizes.

az vm resize -g rg-prod -n vm-web01 --size Standard_D4s_v5

22az vm open-port

Open a specific port on the VM's NSG. Quick way to allow SSH, HTTP, or application ports during setup.

az vm open-port -g rg-prod -n vm-web01 --port 22
az vm open-port -g rg-prod -n vm-web01 --port 443 --priority 900

23az vm run-command invoke

Execute a shell command inside a VM without SSH. Works even when the VM has no public IP or when SSH is blocked.

az vm run-command invoke \
  -g rg-prod -n vm-web01 \
  --command-id RunShellScript \
  --scripts "df -h && free -m && uptime"

💡 Invaluable for diagnosing a locked-down VM or running emergency fixes on production instances.

24az vm list-sizes

List all available VM sizes in a region. Use before creating a VM to pick the right SKU.

az vm list-sizes --location eastus --query "[?numberOfCores<=4].{Name:name,Cores:numberOfCores,RAM:memoryInMb}" -o table

25az vm disk attach

Attach an existing managed disk to a running VM — for hot-attaching data disks.

az vm disk attach -g rg-prod --vm-name vm-web01 --name disk-data01 --new --size-gb 256 --sku Premium_LRS

26az vm delete

Delete a VM. By default leaves the OS disk, NIC, and public IP behind — delete those separately or use --force-deletion.

az vm delete -g rg-prod -n vm-web01 --yes
# Delete VM + associated disks and NICs
az vm delete -g rg-prod -n vm-web01 --yes \
  --force-deletion none

04NetworkingCommands 27–36

27az network vnet create

Create a Virtual Network with a specified address space. The foundation of all Azure networking.

az network vnet create \
  -g rg-prod -n vnet-prod \
  --address-prefix 10.0.0.0/16 \
  --subnet-name snet-web \
  --subnet-prefix 10.0.1.0/24

28az network vnet subnet create

Add a subnet to an existing VNet. Each tier of your application typically gets its own subnet.

az network vnet subnet create \
  -g rg-prod --vnet-name vnet-prod \
  -n snet-app --address-prefix 10.0.2.0/24

29az network vnet list / show

List all VNets or show details of a specific VNet including subnets and peerings.

az network vnet list -g rg-prod -o table
az network vnet show -g rg-prod -n vnet-prod --query "subnets[].{Name:name,Prefix:addressPrefix}" -o table

30az network nsg create / rule create

Create a Network Security Group and add inbound or outbound rules to control traffic.

az network nsg create -g rg-prod -n nsg-web
# Allow HTTPS inbound from internet
az network nsg rule create -g rg-prod --nsg-name nsg-web \
  -n Allow-HTTPS --priority 100 \
  --source-address-prefixes Internet \
  --destination-port-ranges 443 --access Allow --protocol Tcp

31az network public-ip create

Create a public IP address. Use Standard SKU for production — Basic is being retired in 2025.

az network public-ip create \
  -g rg-prod -n pip-lb-prod \
  --sku Standard --allocation-method Static --zone 1 2 3

32az network public-ip list

List all public IPs — useful for finding unattached (orphaned) IPs that are wasting budget.

az network public-ip list -g rg-prod -o table
# Find unattached public IPs (orphans)
az network public-ip list --query "[?ipConfiguration==null].{Name:name,RG:resourceGroup}" -o table

33az network vnet peering create

Peer two VNets so resources in each can communicate without traversing the internet.

# Peering must be created in BOTH directions
az network vnet peering create -g rg-prod \
  --vnet-name vnet-prod -n peer-to-dev \
  --remote-vnet vnet-dev --allow-vnet-access
az network vnet peering create -g rg-dev \
  --vnet-name vnet-dev -n peer-to-prod \
  --remote-vnet vnet-prod --allow-vnet-access

34az network private-endpoint create

Create a private endpoint to access a PaaS service (Key Vault, Storage, SQL) over a private IP within your VNet.

az network private-endpoint create \
  -g rg-prod -n pe-storage-prod \
  --vnet-name vnet-prod --subnet snet-app \
  --private-connection-resource-id /subscriptions/.../storageAccounts/stprod \
  --group-id blob --connection-name psc-storage

35az network dns zone / record-set

Manage Azure DNS zones and record sets. Create A, CNAME, TXT, and MX records from the CLI.

az network dns zone create -g rg-prod -n contoso.com
# Add an A record
az network dns record-set a add-record \
  -g rg-prod -z contoso.com -n www --ipv4-address 20.10.20.1

36az network lb create

Create a Standard Load Balancer — the entry point for distributing traffic across VM scale sets.

az network lb create \
  -g rg-prod -n lb-web-prod \
  --sku Standard \
  --frontend-ip-name fe-config \
  --backend-pool-name be-pool \
  --public-ip-address pip-lb-prod

05Storage Accounts & BlobsCommands 37–46

37az storage account create

Create a storage account. Set SKU for redundancy, kind for capabilities, and enable HNS for ADLS Gen2.

# Standard Blob Storage
az storage account create \
  -g rg-prod -n stprod001 -l eastus \
  --sku Standard_ZRS --kind StorageV2 \
  --allow-blob-public-access false \
  --min-tls-version TLS1_2
# ADLS Gen2 (Hierarchical Namespace)
az storage account create -g rg-prod -n stadls001 \
  --sku Standard_ZRS --kind StorageV2 --enable-hierarchical-namespace true

38az storage account list

List all storage accounts in a subscription. Filter by resource group or query specific properties.

az storage account list -g rg-prod -o table
# Get names and primary endpoints
az storage account list --query "[].{Name:name,Blob:primaryEndpoints.blob}" -o table

39az storage account keys list

Retrieve the storage account access keys. Prefer Managed Identity over keys in production.

az storage account keys list -g rg-prod -n stprod001 -o table
# Get just the primary key for scripting
KEY=$(az storage account keys list -g rg-prod -n stprod001 --query "[0].value" -o tsv)

40az storage container create

Create a blob container inside a storage account.

az storage container create \
  --account-name stprod001 \
  --name rag-documents \
  --auth-mode login # Use Entra auth, not key

41az storage blob upload

Upload a file or folder to a blob container.

# Upload single file
az storage blob upload --account-name stprod001 \
  --container-name rag-documents \
  --name report.pdf --file ./report.pdf --auth-mode login
# Upload all files in a folder
az storage blob upload-batch --account-name stprod001 \
  --destination rag-documents --source ./docs/ --auth-mode login

42az storage blob list

List blobs in a container, optionally filtered by name prefix.

az storage blob list --account-name stprod001 \
  --container-name rag-documents \
  --query "[].{Name:name,Size:properties.contentLength}" -o table --auth-mode login

43az storage blob download

Download a blob from a container to a local file.

az storage blob download --account-name stprod001 \
  --container-name rag-documents \
  --name report.pdf --file ./downloaded-report.pdf --auth-mode login

44az storage blob delete

Delete a specific blob or all blobs matching a prefix.

# Delete a single blob
az storage blob delete --account-name stprod001 \
  --container-name rag-documents --name old-report.pdf --auth-mode login

45az storage account generate-sas

Generate a time-limited SAS token for temporary delegated access to a storage account.

az storage account generate-sas \
  --account-name stprod001 \
  --expiry 2026-12-31 \
  --permissions rlp \
  --resource-types sco \
  --services b -o tsv

46az storage account update

Update storage account settings — change access tier, enable versioning, or update network rules.

# Enable soft delete (30-day blob recovery)
az storage account blob-service-properties update \
  --account-name stprod001 -g rg-prod \
  --enable-delete-retention true \
  --delete-retention-days 30

06App Service & Web AppsCommands 47–54

47az appservice plan create

Create an App Service Plan that defines the compute tier for your web apps.

az appservice plan create -g rg-prod -n asp-prod \
  --is-linux --sku P1v3 --number-of-workers 2

48az webapp create

Create a web app (App Service) in a plan.

az webapp create -g rg-prod -p asp-prod \
  -n app-myapi-prod --runtime "PYTHON:3.12"

49az webapp config appsettings set

Set or update environment variables (application settings) for a web app.

az webapp config appsettings set -g rg-prod -n app-myapi-prod \
  --settings AZURE_OPENAI_ENDPOINT="https://..." \
  OPENAI_DEPLOYMENT="gpt-4.1-mini" \
  KEY_VAULT_URL="https://kv-prod.vault.azure.net"

50az webapp deploy

Deploy application code to an App Service. Zip deploy is the fastest and most reliable method.

az webapp deploy -g rg-prod -n app-myapi-prod \
  --src-path ./app.zip --type zip

51az webapp identity assign

Enable a System-Assigned Managed Identity on a web app — the prerequisite for passwordless Azure service authentication.

az webapp identity assign -g rg-prod -n app-myapi-prod
# Returns the principalId needed for RBAC assignments

52az webapp log tail

Stream live application logs from App Service to your terminal. Essential for real-time debugging.

az webapp log tail -g rg-prod -n app-myapi-prod
# Download all logs as a zip
az webapp log download -g rg-prod -n app-myapi-prod --log-file ./logs.zip

53az webapp restart

Restart a web app — the first step when an app is unresponsive or showing stale behaviour after deployment.

az webapp restart -g rg-prod -n app-myapi-prod

54az webapp show

Show details of a web app including default hostname, state, and runtime configuration.

az webapp show -g rg-prod -n app-myapi-prod \
  --query "{URL:defaultHostName,State:state,SKU:sku}" -o table

07AKS — Azure Kubernetes ServiceCommands 55–63

55az aks create

Create an AKS cluster with a managed identity, monitoring, and auto-upgrade channel.

az aks create -g rg-prod -n aks-prod \
  --node-count 3 --node-vm-size Standard_D4s_v5 \
  --enable-managed-identity \
  --enable-oidc-issuer --enable-workload-identity \
  --auto-upgrade-channel patch \
  --generate-ssh-keys --no-wait

56az aks get-credentials

Download kubeconfig and merge it into your local ~/.kube/config file. The first command you run after creating an AKS cluster.

az aks get-credentials -g rg-prod -n aks-prod
# Admin credentials (bypasses RBAC for emergency access)
az aks get-credentials -g rg-prod -n aks-prod --admin

57az aks list

List all AKS clusters in a resource group or subscription.

az aks list -g rg-prod -o table
# Check Kubernetes version and upgrade channel
az aks list --query "[].{Name:name,Version:kubernetesVersion,Channel:autoUpgradeProfile.upgradeChannel}" -o table

58az aks scale

Scale the node count of an AKS node pool. Use for manual scaling before an anticipated traffic spike.

az aks scale -g rg-prod -n aks-prod \
  --node-count 5 --nodepool-name nodepool1

59az aks upgrade

Upgrade the Kubernetes version on the control plane and all node pools.

# Check available upgrade versions first
az aks get-upgrades -g rg-prod -n aks-prod -o table
# Upgrade to a specific version
az aks upgrade -g rg-prod -n aks-prod --kubernetes-version 1.32.0

60az aks nodepool add

Add a new node pool to an existing AKS cluster — for separate pools for different workload types (GPU, high-memory).

az aks nodepool add \
  -g rg-prod --cluster-name aks-prod \
  --name gpupool --node-count 2 \
  --node-vm-size Standard_NC6s_v3 \
  --node-taints sku=gpu:NoSchedule

61az aks command invoke

Run a kubectl command against a private AKS cluster without VPN or bastion host.

az aks command invoke \
  -g rg-prod -n aks-prod \
  --command "kubectl get pods -A"
az aks command invoke -g rg-prod -n aks-prod \
  --command "kubectl describe node aks-node-001"

💡 Game changer for private clusters. No VPN required — authentication goes through Azure's control plane.

62az aks update

Update cluster configuration — enable features like OIDC issuer, Workload Identity, or change auto-upgrade channel.

az aks update -g rg-prod -n aks-prod \
  --enable-oidc-issuer \
  --enable-workload-identity
# Change maintenance window
az aks maintenanceconfiguration add -g rg-prod \
  --cluster-name aks-prod --name default \
  --weekday Sunday --start-hour 2

63az aks show

Show full AKS cluster details including OIDC issuer URL, managed identity, and node pool config.

az aks show -g rg-prod -n aks-prod \
  --query "{K8sVersion:kubernetesVersion,OIDC:oidcIssuerProfile.issuerUrl,FQDN:fqdn}" -o table

08Azure Container RegistryCommands 64–69

64az acr create

Create a private container registry. Use Premium SKU for geo-replication and private endpoints.

az acr create -g rg-prod -n acrprod001 \
  --sku Premium --admin-enabled false \
  --public-network-enabled false

65az acr build

Build a Docker image in ACR directly from source code — no local Docker required. Ideal for CI/CD pipelines.

az acr build \
  --registry acrprod001 \
  --image myapp:v1.0.0 \
  --file Dockerfile .

66az acr login

Authenticate Docker CLI to your ACR using your Azure credentials. Required before docker push/pull.

az acr login --name acrprod001

67az acr repository list / show-tags

List repositories and image tags in your container registry.

az acr repository list -n acrprod001 -o table
az acr repository show-tags -n acrprod001 --repository myapp -o table

68az aks update --attach-acr

Grant an AKS cluster permission to pull images from ACR without configuring credentials in the cluster.

az aks update -g rg-prod -n aks-prod --attach-acr acrprod001

💡 This assigns the acrpull role to the AKS kubelet managed identity — no imagePullSecrets needed in pod specs.

69az acr repository delete

Delete a specific image tag or an entire repository from ACR.

# Delete a specific tag
az acr repository delete -n acrprod001 --image myapp:v0.9.0 --yes
# Delete entire repository
az acr repository delete -n acrprod001 --repository myapp-old --yes

09Key Vault & SecretsCommands 70–76

70az keyvault create

Create a Key Vault with RBAC authorization model (not legacy access policies) and soft delete enabled.

az keyvault create -g rg-prod -n kv-prod-001 \
  --location eastus \
  --enable-rbac-authorization true \
  --soft-delete-retention-days 90 \
  --sku standard

71az keyvault secret set

Create or update a secret in Key Vault. Read the value from a file to avoid shell history exposure.

# Set from inline value (visible in shell history)
az keyvault secret set --vault-name kv-prod-001 -n db-password --value "MySecurePass"
# Read from file (safer — not in shell history)
az keyvault secret set --vault-name kv-prod-001 -n db-password --file ./secret.txt

72az keyvault secret show

Retrieve a secret value from Key Vault. Requires "Key Vault Secrets User" role or higher.

az keyvault secret show --vault-name kv-prod-001 -n db-password --query value -o tsv

73az keyvault secret list

List all secrets in a vault (names and metadata only — not values).

az keyvault secret list --vault-name kv-prod-001 \
  --query "[].{Name:name,Updated:attributes.updated}" -o table

74az keyvault secret delete / purge

Soft-delete a secret (recoverable for retention period) then purge it permanently.

az keyvault secret delete --vault-name kv-prod-001 -n old-api-key
# Permanent delete (after soft-delete period)
az keyvault secret purge --vault-name kv-prod-001 -n old-api-key

75az keyvault certificate import

Import a PFX or PEM certificate into Key Vault for use with App Service, App Gateway, or custom apps.

az keyvault certificate import \
  --vault-name kv-prod-001 \
  -n tls-cert-prod \
  --file ./cert.pfx --password "PFXPassword"

76az keyvault key create

Create an RSA or EC encryption key in Key Vault for use with Azure Disk Encryption or customer-managed keys.

az keyvault key create --vault-name kv-prod-001 \
  -n disk-encryption-key \
  --kty RSA --size 2048 \
  --ops encrypt decrypt wrapKey unwrapKey

10Monitoring & DiagnosticsCommands 77–83

77az monitor log-analytics workspace create

Create a Log Analytics workspace — the destination for all diagnostic logs across your Azure environment.

az monitor log-analytics workspace create \
  -g rg-prod -n law-prod-001 \
  --location eastus --retention-time 90

78az monitor diagnostic-settings create

Enable diagnostic logging for any Azure resource and send it to a Log Analytics workspace.

az monitor diagnostic-settings create \
  --name diag-kv-prod \
  --resource /subscriptions/SUB/resourceGroups/rg-prod/providers/Microsoft.KeyVault/vaults/kv-prod-001 \
  --workspace /subscriptions/SUB/resourceGroups/rg-prod/providers/Microsoft.OperationalInsights/workspaces/law-prod-001 \
  --logs '[{"category":"AuditEvent","enabled":true}]'

79az monitor metrics list

Retrieve metric values for any Azure resource — CPU, memory, requests, errors — without opening the portal.

# Get VM CPU average over the last hour
az monitor metrics list \
  --resource /subscriptions/SUB/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm-web01 \
  --metric "Percentage CPU" \
  --aggregation Average \
  --interval PT5M -o table

80az monitor alert create

Create a metric alert rule that fires when a threshold is breached.

az monitor metrics alert create \
  -g rg-prod -n alert-high-cpu \
  --scopes /subscriptions/SUB/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm-web01 \
  --condition "avg Percentage CPU > 85" \
  --window-size 5m --evaluation-frequency 1m \
  --action /subscriptions/SUB/.../actionGroups/ag-oncall

81az monitor log-analytics query

Run a KQL query against a Log Analytics workspace directly from the CLI — no portal needed.

az monitor log-analytics query \
  --workspace /subscriptions/SUB/.../workspaces/law-prod-001 \
  --analytics-query "AzureActivity | where ActivityStatusValue == 'Failure' | summarize count() by OperationNameValue | order by count_ desc | take 10" \
  -o table

82az monitor app-insights component create

Create an Application Insights resource for application-level monitoring, tracing, and performance analysis.

az monitor app-insights component create \
  -g rg-prod --app appi-prod-001 \
  --location eastus --kind web \
  --workspace /subscriptions/SUB/.../workspaces/law-prod-001
# Get connection string for your application
az monitor app-insights component show -g rg-prod --app appi-prod-001 \
  --query connectionString -o tsv

83az monitor activity-log list

Query the Azure Activity Log — the audit trail of all control-plane operations in your subscription.

# Who deleted what in the last 24 hours?
az monitor activity-log list \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --query "[?operationName.value contains 'delete'].{Op:operationName.localizedValue,Who:caller,When:eventTimestamp}" \
  -o table

11RBAC & IdentityCommands 84–90

84az role assignment create

Assign an Azure RBAC role to a user, group, service principal, or managed identity at a specific scope.

# Grant a user Reader on a resource group
az role assignment create \
  --assignee user@contoso.com \
  --role Reader \
  --scope /subscriptions/SUB/resourceGroups/rg-prod
# Grant MI "Key Vault Secrets User" on a vault
az role assignment create \
  --assignee PRINCIPAL-ID \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/SUB/.../vaults/kv-prod-001

85az role assignment list

List all role assignments at a scope. Use for access audits and security reviews.

# All assignments in a resource group
az role assignment list -g rg-prod --include-inherited -o table
# Assignments for a specific principal
az role assignment list --assignee user@contoso.com --all -o table

86az role assignment delete

Remove a specific role assignment from a principal at a scope.

az role assignment delete \
  --assignee user@contoso.com \
  --role Contributor \
  --scope /subscriptions/SUB/resourceGroups/rg-prod

87az role definition list

List all available built-in and custom roles. Useful when selecting the minimum required role.

# Search for roles containing "OpenAI"
az role definition list --query "[?contains(roleName,'OpenAI')].{Name:roleName,ID:id}" -o table
# Show all built-in roles
az role definition list --custom-role-only false --query "[].roleName" -o tsv | sort

88az ad sp create-for-rbac

Create a service principal with an assigned role. Used for CI/CD pipeline authentication (prefer Workload Identity Federation where available).

az ad sp create-for-rbac \
  --name sp-cicd-prod \
  --role Contributor \
  --scopes /subscriptions/SUB/resourceGroups/rg-prod \
  --json-auth # Output in format ready for GitHub Actions secret

89az identity create

Create a User-Assigned Managed Identity — a standalone identity resource shareable across multiple Azure services.

az identity create -g rg-prod -n mi-shared-prod
# Get client ID and principal ID for RBAC assignments
az identity show -g rg-prod -n mi-shared-prod \
  --query "{ClientId:clientId,PrincipalId:principalId}" -o table

90az ad user / group show

Look up Entra ID user or group object IDs — needed when assigning RBAC roles to specific users or groups.

# Get user object ID
az ad user show --id user@contoso.com --query id -o tsv
# Get group object ID
az ad group show --group "Platform Engineers" --query id -o tsv

12Cost, Policy & ProductivityCommands 91–100

91az consumption usage list

Query Azure consumption usage and costs for the current billing period.

az consumption usage list \
  --start-date 2026-06-01 --end-date 2026-06-30 \
  --query "[].{Resource:instanceName,Cost:pretaxCost,Currency:currency}" \
  -o table | sort -k 3 -rn

92az disk list (orphan finder)

Find all unattached managed disks — the most common source of orphaned Azure cost waste.

az disk list \
  --query "[?diskState=='Unattached'].{Name:name,RG:resourceGroup,SizeGB:diskSizeGb,SKU:sku.name}" \
  -o table

💡 An unattached Premium SSD P30 (1TB) costs ~$135/month doing nothing. Run this monthly.

93az policy assignment create

Assign an Azure Policy to enforce governance rules — mandatory tags, allowed locations, required SKUs.

# Require a specific tag on all resources
az policy assignment create \
  --name require-env-tag \
  --scope /subscriptions/SUB \
  --policy "1e30110a-5ceb-460c-a204-c1c3969c6d62" \
  --params '{"tagName":{"value":"env"}}'

94az tag add-value / update

Add or update resource tags. Run at scale across multiple resources using a loop.

# Tag all resources in a group that are missing the env tag
az resource list -g rg-prod --query "[?tags.env==null].id" -o tsv | \
  xargs -I {} az resource tag --ids {} --tags env=prod

95az vm list-usage

Check subscription quota usage for VM cores in a region — before hitting limits on large deployments.

az vm list-usage --location eastus \
  --query "[?currentValue > 0].{Name:localName,Used:currentValue,Limit:limit}" -o table

96az find

AI-powered command discovery — describe what you want to do and get the exact CLI command. Built into the CLI.

az find "how to list all VMs that are stopped"
az find "create a private endpoint for Key Vault"
az find "enable diagnostic logging on a storage account"

💡 Best-kept secret of the Azure CLI. Type what you want to do in plain English and get the exact command.

97az interactive

Launch the Azure CLI interactive shell with auto-complete, command descriptions, and example display.

az interactive
# Install the extension if prompted, then start typing
# Tab auto-completes commands and shows descriptions inline

98az config param-persist

Turn on persistent parameter storage so resource group and location defaults are automatically used in subsequent commands within a directory.

az config param-persist on
# Now create a group — it stores rg name + location
az group create -n rg-dev -l eastus
# All following commands in this directory use rg-dev + eastus automatically
az vm create -n vm-dev01 --image Ubuntu2204 # No --resource-group needed!
az config param-persist off # Turn off when done

99az --query with JMESPath (power pattern)

Master JMESPath to extract, filter, and transform CLI output — the single most productivity-multiplying Azure CLI skill.

# Get specific fields from a list
az vm list --query "[].{Name:name,State:powerState,Size:hardwareProfile.vmSize}" -o table
# Filter list where field equals value
az vm list --query "[?powerState=='VM running'].name" -o tsv
# Get a single nested value
az vm show -g rg-prod -n vm-web01 --query "storageProfile.osDisk.diskSizeGb" -o tsv
# Count items
az vm list --query "length([])" -o tsv
# Sort and take first
az disk list --query "sort_by([?diskState=='Unattached'],&diskSizeGb)[-1].name" -o tsv

💡 Learn 5 JMESPath patterns: field selection {}, array filter [], value access .key, length(), sort_by()

100az upgrade + extension management

Keep the CLI and all extensions current. Outdated CLI versions are the most common cause of unexpected command failures.

# Upgrade CLI and all extensions
az upgrade
# List installed extensions
az extension list -o table
# Add a specific extension
az extension add --name resource-graph
az extension add --name azure-devops
az extension add --name aks-preview
# Update a specific extension
az extension update --name resource-graph

Power User Tips

Essential Power User Tips and Patterns

Set a Default Output Format Once

az config set core.output=table
# Now every command outputs a table
# Override per-command with -o json or -o tsv

Capture Values Into Bash Variables

RG="rg-prod"
LOC="eastus"
SUBID=$(az account show --query id -o tsv)
KVID=$(az keyvault show -g $RG -n kv-prod --query id -o tsv)

Use --no-wait for Long Operations

# Fire VM create and continue immediately
az vm create -g rg-prod -n vm-01 \
  --image Ubuntu2204 --no-wait
# Check status later
az vm show -g rg-prod -n vm-01 --query provisioningState

Delete Resources in a For Loop

# Delete all unattached disks
az disk list --query "[?diskState=='Unattached'].id" -o tsv | \
  while read id; do
    az disk delete --ids "$id" --yes --no-wait
  done

Use --query for TSV Piping

# Get all VMs in stopped state and start them
az vm list -g rg-dev \
  --query "[?powerState=='VM deallocated'].id" -o tsv | \
  xargs az vm start --ids

Test Destructive Commands with What-If

# Preview ARM/Bicep deployment changes
az deployment group what-if \
  -g rg-prod --template-file main.bicep
# Shows add/modify/delete before you commit

Command Quick Reference by Task

→Starting a new environment: az login → az account set → az group create → az configure --defaults → az deployment group create

→Deploying a web app: az appservice plan create → az webapp create → az webapp identity assign → az webapp config appsettings set → az webapp deploy → az webapp log tail

→Setting up AKS: az aks create → az aks get-credentials → az aks update --attach-acr → az acr create → az aks command invoke

→Security hardening: az keyvault create → az webapp identity assign → az role assignment create → az keyvault secret set → az monitor diagnostic-settings create

→Monthly FinOps cleanup: az disk list [orphans] → az network public-ip list [orphans] → az resource list [untagged] → az consumption usage list → az vm deallocate [idle VMs]

→The three flags that multiply all commands: --query (JMESPath filter) + -o tsv (pipe-friendly output) + --no-wait (async execution). Master these and every command in this list becomes twice as powerful.

→When you don't know the exact command: az find "what you want to do" gives you the answer in plain English. az interactive gives you auto-complete and inline documentation. az [command] --help gives you every flag and example.

Related FAVRITE Articles

• The Hidden Cloud Drain: How to Find and Kill Orphaned Azure Resources Automatically
• Stop Using Connection Strings: A Step-by-Step Guide to Azure Managed Identities in 2026
• Troubleshooting Azure DevOps Pipeline Timeouts: 5 Real-World Fixes That Work
• How to Fix AKS Cluster Auto-Upgrade Not Executing During Scheduled Maintenance Window