Azure Cloud Shell vs Azure CLI — what's the difference?
People treat these two like rival products you have to pick between. They aren't. One is a tool; the other is a room you can run the tool in.
New to cloud? CAMPUX is a free, build-first course. Start here →
Azure CLI is the command-line tool — the az program — that you install on your laptop, a server, or a build agent and run from any terminal. Azure Cloud Shell is a browser-based, pre-authenticated shell inside the Azure portal that already has the CLI (and PowerShell) installed. They are not competitors. Cloud Shell is simply one place you can run the CLI, with the install and login already done for you.
The confusion is understandable. Both give you a black terminal, both let you type az commands, and the docs mention them in the same breath. But they answer different questions. The CLI is "what tool am I using to talk to Azure." Cloud Shell is "where am I typing when I do." Once that clicks, the rest is easy.
Azure CLI — the tool
The Azure CLI is a cross-platform program you install from Microsoft. On Windows it goes in through winget or an MSI, on macOS through Homebrew, on Linux through your package manager. After it's installed you get one command — az — and every Azure action hangs off it: az vm create, az storage account list, az group delete. It talks to the same Azure Resource Manager API the portal uses, just without the clicking.
Because it lives on your machine, you have to do two setup things once. You install it, and you log in with az login, which pops a browser to authenticate you and caches a token. From then on the CLI runs as you, against whatever subscription you set as default. That local install is the thing that makes it fast, scriptable, and available offline in your own editor — and it's also the thing Cloud Shell removes.
The CLI is what you run. Cloud Shell is where you run it, with the boring parts already done.
Azure Cloud Shell — the place
Cloud Shell is a shell environment Microsoft hosts for you. You open it from the >_ icon in the top bar of the Azure portal, or by going to shell.azure.com, and a terminal spins up in the browser. It boots already signed in as your portal account — no az login — and it comes with the Azure CLI, Azure PowerShell, and a pile of tools like git, bicep, terraform, jq, and a code editor already installed. You pick Bash or PowerShell and start typing.
That's the whole pitch: zero install, zero auth, works from any machine with a browser — including a locked-down work laptop or someone else's computer. The trade is that it's a shared, ephemeral container. It's not your machine, it times out after about 20 minutes of inactivity, and anything you save has to go somewhere that survives the session ending.
By default, Cloud Shell asks to create or mount an Azure Files share backed by a storage account the first time you open it, so your home directory and scripts persist between sessions. That storage is a real billed resource — cents a month for light use, but not nothing, and it's a separate thing you now own. Microsoft has since added an ephemeral, no-storage session option that keeps nothing after you close the tab. If you've ever wondered why a storage account appeared that you don't remember making, this is usually the culprit. It's worth understanding what that account is before you accept the prompt — more on storage accounts in a companion note.
Side by side
| Azure CLI | Azure Cloud Shell | |
|---|---|---|
| What it is | A command-line tool (az) you install | A browser-hosted shell that already contains the tool |
| Where it runs | Your laptop, a VM, a CI/CD build agent — anywhere you install it | In the browser, on a container Microsoft manages |
| Install needed | Yes — winget, Homebrew, apt, MSI, etc. | None |
| Authentication | You run az login once and manage the session | Pre-authenticated as your signed-in portal account |
| Persistence / storage | Files live on your own disk; nothing extra required | Needs a backing storage account by default to persist files; an ephemeral no-storage mode is available |
| Works offline | Yes, for local scripting; API calls still need network | No — it's a web app |
| Cost | Free tool; you pay only for resources it creates | Session is free; the default storage share is billed at Azure Files rates |
| Best for | Daily work, repos, automation, pipelines, offline editing | Quick tasks, learning, locked-down machines, "I just need a terminal now" |
A tiny example, run either way
The commands are identical no matter where you type them. That's the point — you're learning one tool, and Cloud Shell is just a convenient front door to it. List your resource groups:
# works the same in Cloud Shell or a local terminal az group list --output table # create a resource group in East US az group create --name rg-demo --location eastus # see who you're logged in as and which subscription is active az account show --output table
In Cloud Shell those run immediately, because you're already authenticated. On your own machine the first one will tell you to run az login if you haven't. Same tool, same syntax, same result — only the setup differs.
Which one should you use
For your first week, use Cloud Shell. There's nothing to install, nothing to configure, and no way to get the login wrong — you can be running real commands against your subscription within a minute of signing in. It's the fastest path from "I have an Azure account" to "I typed a command and something happened," which is exactly where a beginner should spend energy.
Once you're writing scripts you want to keep, working in a Git repo, or running commands dozens of times a day, install the CLI locally. It's faster, it edits files in your own editor with your own extensions, and it plays properly with version control. Automation and CI/CD pipelines almost always use the installed CLI on a build agent, not Cloud Shell — so if you're heading toward a real job, you'll need the local install eventually anyway.
This isn't an either/or you resolve once. Every working cloud engineer I know uses both, without thinking about it. Cloud Shell for a fast one-off from the portal or a phone, the local CLI for the day job. Knowing a cert question calls one a "tool" and the other an "environment" is worth a mark on the exam. Knowing why you'd reach for each — and what that storage account is quietly costing you — is what shows up in the work.
Common questions
Is Azure Cloud Shell the same as Azure CLI?
No. Azure CLI is a command-line tool — the az program — that you install on your own machine or a build server. Azure Cloud Shell is a browser-based shell environment hosted by Microsoft that already has the CLI installed inside it. Cloud Shell is one place you can run the CLI, not a replacement for it.
Does Azure Cloud Shell cost money?
The shell session itself is free, but by default Cloud Shell mounts a storage account to persist your files between sessions, and that storage is billed at normal Azure Files rates — a few cents a month for light use. You can now also run an ephemeral session with no storage attached, which keeps nothing after you close the tab. Azure CLI on your own machine is free; you only pay for the resources it creates.
Do I need to install anything to use Azure Cloud Shell?
No. That is the point of it. Cloud Shell runs in the browser from the Azure portal or shell.azure.com, comes pre-authenticated as your signed-in account, and ships with the Azure CLI, Azure PowerShell, and common tools like git, bicep, and terraform already installed. You install nothing and you log in to nothing.
Should a beginner use Cloud Shell or install the Azure CLI?
Start in Cloud Shell. There is nothing to install and no authentication to configure, so you can run your first az command a minute after signing in. Once you are writing real scripts or working in a repo every day, install the CLI locally for speed, offline editing, and version control. Most engineers end up using both.