Azure CLI cheat sheet

Azure CLI cheat sheet: the commands you actually use

By Captain O8 min read

There are hundreds of az commands. You use maybe two dozen of them all day. This cheat sheet groups the ones that earn their keep — sign-in, resource groups, VMs, AKS, and Key Vault — so you can find the exact command you need without scrolling the reference.

New to cloud? CAMPUX is a free, build-first course. Start here →

The Azure CLI (az) is a cross-platform command-line tool for creating and managing Azure resources from your terminal or a CI/CD pipeline. The commands you reach for most cover sign-in, resource groups, virtual machines, AKS, and Key Vault — this cheat sheet groups them so you can find the one you need fast. Everything below is a real, valid command you can paste and adapt.

Figure — Every Azure CLI command follows the same shape: az, then a resource group of commands (vm, aks, keyvault…), then an action, then options. Learn the pattern and the whole tool becomes guessable — and it runs the same in your terminal and in a pipeline.

What the Azure CLI is and when to use it

The Azure CLI is the same tool whether you are on Windows, macOS, or Linux, and it talks to the same Azure Resource Manager APIs as the portal. The difference is that a command is repeatable and a click is not. Once you can write the command, you can put it in a script, drop it into a pipeline, and run it a hundred times the same way. That is the whole reason engineers move off the portal.

A command follows a predictable shape: az <group> <subgroup> <action> --flags. So az vm create creates a VM, az group list lists resource groups, and az aks get-credentials pulls cluster credentials. When you forget a flag, append --help to any command and the CLI prints exactly what it accepts:

az vm create --help

Keep that habit. It is faster than a web search and it is always correct for the version you have installed.

Sign in and pick a subscription

Nothing works until you authenticate. az login opens a browser, you sign in once, and the CLI caches the token:

az login

Most engineers have access to more than one subscription, and the CLI only acts on the active one. Set it by name or ID, then confirm you are pointed where you think you are:

az account set --subscription "Campux-Production"
az account show

az account show prints the active subscription, tenant, and the account you signed in as. Run it whenever a command fails with a permissions error — half the time you are simply in the wrong subscription. To see every subscription your account can reach:

az account list -o table

Resource groups

A resource group is the container everything else lives in, so it is usually the first thing you create and the last thing you delete. Create one by name and region:

az group create --name campux-rg --location eastus

List what you have, in a readable table instead of raw JSON:

az group list -o table

When you are done with a whole environment, deleting the resource group removes every resource inside it in one call. --yes skips the confirmation prompt and --no-wait returns immediately instead of blocking your terminal while Azure tears things down:

az group delete --name campux-rg --yes --no-wait

This is the cleanup command that keeps a test subscription from filling up with forgotten resources. Group your throwaway work into its own resource group and one line clears it.

Virtual machines

Creating a VM is one command with a handful of flags. This one builds an Ubuntu VM and generates an SSH key pair if you do not already have one:

az vm create \
  --resource-group campux-rg \
  --name campux-vm \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys

The backslashes just continue one command across several lines so it stays readable — on Windows CMD you would use a caret instead, and in PowerShell a backtick. Once VMs exist, listing them in a table is far easier to scan than JSON:

az vm list -o table

Starting and stopping is where day-to-day cost control happens. Note the difference between the two ways to stop a VM:

az vm start --resource-group campux-rg --name campux-vm
az vm stop --resource-group campux-rg --name campux-vm
az vm deallocate --resource-group campux-rg --name campux-vm

That middle line matters more than people expect. az vm stop shuts the guest OS down but keeps the compute allocated, so you keep paying for it. az vm deallocate releases the compute, which is what actually stops the meter. If your goal is to save money overnight, deallocate — do not just stop.

The flag that saves the most money

Stopping a VM from inside the OS, or with az vm stop, leaves it in the "Stopped" state — still allocated, still billed for compute. Only az vm deallocate moves it to "Stopped (deallocated)" and stops the compute charge. Check the state with az vm get-instance-view if you are unsure which one a VM is in.

AKS (Kubernetes)

Azure Kubernetes Service has its own command group. Creating a small cluster with monitoring enabled is a single call, though it takes a few minutes to finish:

az aks create \
  --resource-group campux-rg \
  --name campux-aks \
  --node-count 2 \
  --enable-addons monitoring \
  --generate-ssh-keys

The command you will run more than any other is the one that wires kubectl up to the cluster. It merges the cluster's credentials into your kubeconfig so every kubectl command after it targets this cluster:

az aks get-credentials --resource-group campux-rg --name campux-aks

After that, kubectl get nodes should list your two nodes. Scaling the node pool up or down is one command — handy when a workload grows or when you want to shrink a cluster to save money off-hours:

az aks scale --resource-group campux-rg --name campux-aks --node-count 4

Half of using the CLI well is knowing which command changes state and which one just reads it. Read freely; change deliberately.

Key Vault

Secrets do not belong in your scripts, they belong in Key Vault, and the CLI reads and writes them cleanly. Create a vault inside your resource group:

az keyvault create --name campux-vault --resource-group campux-rg --location eastus

Store a secret by name and value:

az keyvault secret set --vault-name campux-vault --name db-password --value "S3cr3t-value"

Read it back. By default az keyvault secret show returns the full JSON record, so to pull just the secret's value into a script variable, ask for exactly that field with --query and strip the quotes with -o tsv:

az keyvault secret show --vault-name campux-vault --name db-password --query value -o tsv

That last line is the pattern you will copy into pipelines constantly: fetch a secret at deploy time instead of hardcoding it. The vault holds the truth, the script asks for it when it runs.

Output formatting and cleanup

Two flags change how much you enjoy the CLI. The first is -o (short for --output). The default is JSON, which is right for scripts but hard on the eyes; -o table gives you a scannable grid, and -o tsv gives you tab-separated values with no quotes, which is what you want when piping a single value into another command:

az vm list -o table
az group list --query "[].name" -o tsv

The second is --query, which filters and reshapes the JSON using JMESPath before it ever reaches your screen. Instead of dumping a VM object and hunting for one field, ask for the field directly:

az vm show --resource-group campux-rg --name campux-vm --query "hardwareProfile.vmSize" -o tsv

You can pull several fields at once and rename them, which turns a raw list into a report:

az vm list --query "[].{name:name, size:hardwareProfile.vmSize}" -o table

And when the work is finished, the cleanup command from earlier is the one to remember. Deleting the resource group deletes everything you created in this cheat sheet in a single line:

az group delete --name campux-rg --yes --no-wait

That is the loop: sign in, create a resource group, build what you need inside it, read state with -o table and --query, and delete the group when you are done. Learn these two dozen commands and you can run most of Azure from a terminal — and everything you just typed will run unchanged inside a pipeline.

Questions people also ask

What is the Azure CLI used for?

The Azure CLI is a cross-platform command-line tool for creating and managing Azure resources. You use it to sign in, create resource groups, spin up virtual machines and AKS clusters, read and write Key Vault secrets, and script any of it. Because every command is text, the same az calls that work in your terminal also run in a CI/CD pipeline.

What is the difference between Azure CLI and Azure PowerShell?

Both manage the same Azure resources through the same APIs. The Azure CLI uses a flat command style, az group create, and returns JSON, which fits engineers who work across Linux, macOS, and Bash pipelines. Azure PowerShell uses verb-noun cmdlets like New-AzResourceGroup and returns objects, which suits teams already living in PowerShell. Pick the one your scripts and teammates already use.

How do I log in to the Azure CLI?

Run az login, which opens a browser to authenticate. If you manage several subscriptions, set the active one with az account set --subscription and confirm it with az account show. For automation where no browser exists, sign in with a service principal or a managed identity instead of the interactive browser flow.

Can I use the Azure CLI in a CI/CD pipeline?

Yes. The Azure CLI is built for pipelines. You authenticate non-interactively with a service principal or a managed identity, then run the same az commands you would locally. GitHub Actions and Azure Pipelines both ship tasks that handle the sign-in, so your workflow can create resource groups, deploy VMs, and read secrets without a human at the keyboard.