Azure Cli

---
name: azure-cli
description: "Azure CLI (az) command syntax and scripting: authentication (interactive, service principal, managed identity, SSO), output formats and JMESPath queries, resource groups, VMs, storage accounts/blobs, networking (VNets, NSGs, load balancers, DNS), Entra ID, AKS, App Service, Functions, databases (SQL, Cosmos DB, MySQL, PostgreSQL), Key Vault, Monitor/alerting, and infrastructure scripting patterns. WHEN: \"az \", \"Azure CLI\", \"az login\", \"az vm\", \"az aks\", \"az storage\", \"az keyvault\", \"az monitor\", \"az ad\", \"az group\", \"az network\", \"az webapp\", \"az functionapp\", \"az sql\", \"az cosmosdb\", \"JMESPath\", \"az account\". Do NOT use for Azure architecture, landing zones, or multi-subscription strategy — that's the `cloud-platforms` plugin. This skill is about command syntax and scripting the CLI, not deciding what to provision."
license: MIT
---

# Azure CLI Expert

This skill covers the Azure CLI (`az`) for managing Azure resources from the command line. It has deep coverage of:

- Authentication (interactive, device code, service principal, managed identity, SSO)
- Output formats (json, table, tsv, yaml) and JMESPath query language
- Configuration, extensions, and global flags
- Resource groups, tags, locks
- Compute (VMs, availability sets, VM extensions, run commands)
- Storage (accounts, containers, blobs, SAS tokens)
- Networking (VNets, subnets, NSGs, public IPs, load balancers, DNS)
- Identity (Entra ID users, groups, app registrations, role assignments)
- AKS (cluster lifecycle, node pools, scaling, upgrades, kubectl integration)
- App Service and Functions (plans, web apps, deployment slots, function apps)
- Databases (Azure SQL, Cosmos DB, MySQL Flexible Server, PostgreSQL Flexible Server)
- Key Vault (secrets, keys, certificates, RBAC access)
- Monitor and Alerting (metrics, Log Analytics, alerts, action groups, diagnostics)
- Scripting patterns (idempotent create, error handling, batch operations, async --no-wait)

## How to Approach Tasks

When you receive a request:

1. **Classify** the request type:
   - **Authentication/config** -- Load `references/core.md`
   - **Service-specific commands** -- Load `references/commands.md`
   - **Infrastructure scripting** -- Load `references/patterns.md`
   - **JMESPath queries** -- Load `references/core.md`

2. **Verify subscription** -- Remind user to verify active subscription with `az account show` before destructive operations.

3. **Prefer idempotent patterns** -- Use check-before-create for scripts. Many `az` commands are not idempotent by default.

4. **Use JMESPath for extraction** -- Combine `--query` with `--output tsv` for scripting. Use `--output table` for human display.

5. **Provide complete commands** -- Include all required flags. Show the `--resource-group` and `--name` flags explicitly.

## Core Expertise

### Authentication

```bash
# Interactive login
az login

# Device code (headless/SSH)
az login --use-device-code

# Service principal
az login --service-principal --username "$APP_ID" --password "$SP_PASSWORD" --tenant "$TENANT_ID"

# Managed identity
az login --identity

# Switch subscription
az account set --subscription "My Subscription"
az account show --query "{Sub:id, Tenant:tenantId}" --output json
```

### Output Formats and JMESPath

```bash
# Output formats: json, jsonc, table, tsv, yaml, yamlc, none
az vm list --output table

# JMESPath queries
az vm list --query "[].{Name:name, RG:resourceGroup, Location:location}" --output table
az vm list --query "[?location=='eastus'].name" --output tsv
az vm list --query "length(@)" --output tsv

# Capture value for scripting
VM_IP=$(az vm list-ip-addresses -g my-rg -n my-vm \
  --query "[0].virtualMachine.network.publicIpAddresses[0].ipAddress" --output tsv)
```

### Resource Groups

```bash
az group create --name my-rg --location eastus --tags env=prod
az group list --query "[?tags.env=='prod'].name" --output tsv
az group exists --name my-rg
az group delete --name my-rg --yes --no-wait
```

### Virtual Machines

```bash
az vm create -g my-rg -n my-vm --image Ubuntu2204 --size Standard_B2s \
  --admin-username azureuser --ssh-key-values ~/.ssh/id_rsa.pub

az vm list -g my-rg --show-details \
  --query "[].{Name:name, State:powerState, IP:publicIps}" --output table

az vm start -g my-rg -n my-vm
az vm deallocate -g my-rg -n my-vm
az vm delete -g my-rg -n my-vm --yes
```

### Storage

```bash
az storage account create -n mystorageacct -g my-rg -l eastus --sku Standard_LRS
az storage blob upload -c my-container -f ./file.csv -n reports/file.csv --connection-string "$CONN"
az storage blob list -c my-container --connection-string "$CONN" --output table
```

### Networking

```bash
az network vnet create -g my-rg -n my-vnet --address-prefix 10.0.0.0/16
az network vnet subnet create -g my-rg --vnet-name my-vnet -n app-subnet --address-prefix 10.0.1.0/24
az network nsg create -g my-rg -n web-nsg
az network nsg rule create -g my-rg --nsg-name web-nsg -n AllowHTTP \
  --priority 100 --protocol Tcp --destination-port-ranges 80 --access Allow --direction Inbound
```

### AKS

```bash
az aks create -g my-rg -n my-aks --node-count 3 --enable-managed-identity --generate-ssh-keys
az aks get-credentials -g my-rg -n my-aks --overwrite-existing
az aks scale -g my-rg -n my-aks --node-count 5
```

### Key Vault

```bash
az keyvault create -n my-kv -g my-rg -l eastus --enable-rbac-authorization true
az keyvault secret set --vault-name my-kv -n db-password --value "$DB_PASS"
az keyvault secret show --vault-name my-kv -n db-password --query value --output tsv
```

## Common Pitfalls

**1. Not setting the correct subscription**
Always verify with `az account show`. Use `az account set --subscription NAME` before running commands.

**2. Forgetting --yes on destructive commands**
`az group delete` and `az vm delete` prompt interactively by default. Add `--yes` in scripts.

**3. Not using --no-wait for long operations**
VM creation, AKS scaling, and resource group deletion can take minutes. Use `--no-wait` and poll status separately.

**4. Hardcoding storage keys instead of using SAS or RBAC**
Prefer SAS tokens with expiry or RBAC-based access (Storage Blob Data Contributor role) over shared keys.

**5. Missing --permanent on firewall-like resources**
Unlike Linux firewalld, Azure NSG rules are always persistent. But forgetting `--output tsv` in variable capture adds headers/formatting.

**6. Using `az resource show` for existence checks without suppressing errors**
Always redirect stderr: `az group show --name "$RG" &>/dev/null`

**7. Not using `--query` for variable capture**
Parsing JSON with jq works but `--query` with `--output tsv` is faster and requires no extra tool.

**8. Creating storage accounts with public blob access enabled**
Always pass `--allow-blob-public-access false` unless public access is explicitly needed.

**9. Forgetting to associate NSGs with subnets**
Creating an NSG and adding rules is not enough. Use `az network vnet subnet update --network-security-group`.

**10. Not tagging resources**
Tags enable cost tracking, automation (batch delete by tag), and ownership. Always tag with at least `env` and `owner`.

## Reference Files

Load these when you need deep knowledge for a specific area:

- `references/core.md` -- Authentication methods, output formats, JMESPath query patterns, configuration, extensions, global flags. Read for auth, querying, and CLI configuration questions.
- `references/commands.md` -- Complete command reference by service: resource groups, VMs, storage, networking, identity, AKS, App Service, databases, Key Vault, Monitor. Read for specific service commands.
- `references/patterns.md` -- Scripting patterns: idempotent create, error handling, --no-wait async, batch operations with loops and xargs, cleanup with trap. Read for infrastructure automation scripts.

## Scripts

- `scripts/01-azure-provision.sh` -- Complete idempotent environment provisioning (RG, VNet, NSG, VM, Storage)