Azure CLI

Volume 4 — Azure Foundations

The Azure CLI (az) is the command-line interface to everything in Azure — every action available in the Portal has an az equivalent, and most things are faster to do or script this way once you know the shape of the commands.

az login                          # interactive browser login
az account show                   # confirm which subscription/account you're currently using
az account list --output table    # list all subscriptions you have access to
az account set --subscription "Traxs Production"   # switch active subscription

az login opens a browser for interactive auth — the right choice for a developer at a terminal. Pipelines use a different login method entirely (Section 6), since there's no human present to complete a browser flow.

2. Command Structure

danger

REMINDER The references to specific API's is to be used as an example. Replace the product name with the name of the product you are working on

Every az command follows the same shape:

az <service> <resource> <action> [parameters]

az webapp list --resource-group traxs-prod
az webapp restart --name roundtrip-api --resource-group traxs-prod
az sql db show --name RoundTrip --server roundtrip-sql --resource-group traxs-prod

Nested resources add another segment:

az webapp config appsettings list --name roundtrip-api --resource-group traxs-prod
az keyvault secret show --vault-name traxs-vault --name ConnectionStrings--Default

If you're not sure of the exact command shape, az <service> --help (or just -h) lists every sub-command and parameter for that service — faster than searching for it most of the time.

3. Output Formats

az webapp list --output table    # human-readable table
az webapp list --output json     # full JSON (the default)
az webapp list --output tsv      # tab-separated, ideal for piping into other commands/scripts

Format	Best for
`table`	Quickly scanning results as a human
`json`	Full detail, or feeding into `jq`/further processing
`tsv`	Scripting — easy to extract a single value with `cut` or `awk`

4. Filtering with `--query` (JMESPath)

Every az command supports --query, using JMESPath syntax to extract exactly the fields you need instead of scrolling through full JSON output.

az webapp list --query "[].{Name:name, State:state}" --output table
az webapp show --name roundtrip-api --resource-group traxs-prod --query "defaultHostName" --output tsv
az sql db list --resource-group traxs-prod --query "[?status=='Online'].name" --output tsv

--query combined with --output tsv is the standard pattern for capturing a single value into a shell variable:

API_URL=$(az webapp show --name roundtrip-api --resource-group traxs-prod --query "defaultHostName" --output tsv)
echo "https://$API_URL"

5. Scripting with the CLI

Because az is just a CLI tool, everything from the Bash Reference chapter applies directly — variables, loops, conditionals, piping.

#!/bin/bash
set -e

for app in roundtrip-api roundtrip-web; do
    echo "Restarting $app..."
    az webapp restart --name "$app" --resource-group traxs-prod
done

# Confirm every App Service in the resource group is actually running before proceeding
STOPPED=$(az webapp list --resource-group traxs-prod --query "[?state!='Running'].name" --output tsv)
if [ -n "$STOPPED" ]; then
    echo "Not all apps are running: $STOPPED"
    exit 1
fi

az login's interactive browser flow doesn't work in a pipeline — there's no human to click through it. Pipelines authenticate using a service principal instead (covered in depth in the Microsoft Entra ID chapter):

az login --service-principal \
  --username "$AZURE_CLIENT_ID" \
  --password "$AZURE_CLIENT_SECRET" \
  --tenant "$AZURE_TENANT_ID"

In Azure DevOps pipelines specifically, this is usually handled by the built-in AzureCLI@2 task referencing a Service Connection, rather than a raw az login call in a script step — the task manages the login/logout lifecycle around whatever script you provide.

- task: AzureCLI@2
  inputs:
    azureSubscription: "Traxs Production"
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      az webapp restart --name roundtrip-api --resource-group traxs-prod

7. Common Commands by Service

# App Service
az webapp list --resource-group traxs-prod
az webapp log tail --name roundtrip-api --resource-group traxs-prod
az webapp restart --name roundtrip-api --resource-group traxs-prod
az webapp config appsettings set --name roundtrip-api --resource-group traxs-prod --settings "Key=Value"

# Azure SQL
az sql db list --server roundtrip-sql --resource-group traxs-prod
az sql server firewall-rule list --server roundtrip-sql --resource-group traxs-prod

# Storage
az storage account list --resource-group traxs-prod
az storage blob list --account-name traxsstorage --container-name documents

# Key Vault
az keyvault secret list --vault-name traxs-vault
az keyvault secret show --vault-name traxs-vault --name SecretName

8. Troubleshooting Playbook

Symptom	Likely cause	What to check
`az: command not found`	CLI not installed, or not on PATH	Reinstall/confirm installation; `which az`
`Please run 'az login' to setup account`	Session expired, or never logged in on this machine	`az login` again
Commands running against the wrong subscription	Multiple subscriptions available, wrong one active	`az account show`; `az account set --subscription "name"`
`--query` returns nothing, no error	JMESPath syntax typo, or field name doesn't match actual JSON structure	Run without `--query` first, inspect the raw JSON, then build the query against the actual field names
Service principal login fails in a pipeline	Expired client secret, or wrong tenant/subscription ID in the service connection	Check secret expiration in Entra ID app registration; verify the Azure DevOps service connection's configured values
Command succeeds locally, fails identically in pipeline	Different `az` CLI version, or the service principal lacks a role assignment the interactive user has	`az --version` comparison; check the service principal's RBAC role assignments (see Azure RBAC chapter)

9. Quick Reference

Category	Command	Purpose
Auth	`az login`	Interactive browser login
Auth	`az login --service-principal ...`	Non-interactive login for pipelines
Context	`az account show`	Show current subscription
Context	`az account set --subscription "name"`	Switch subscription
Output	`--output table\|json\|tsv`	Control output format
Filter	`--query "JMESPath"`	Extract specific fields
Help	`az <service> --help`	List sub-commands and parameters
App Service	`az webapp log tail`	Stream live logs
App Service	`az webapp restart`	Restart an app
Key Vault	`az keyvault secret show`	Retrieve a secret's value

Part of the Traxs Engineering Handbook — Volume 4: Azure Foundations. Companion chapters in this volume: Azure RBAC, Azure Networking, Azure Storage, Azure Key Vault, Microsoft Entra ID.

1. Installation and Login​

2. Command Structure​

3. Output Formats​

4. Filtering with --query (JMESPath)​

5. Scripting with the CLI​

6. Non-Interactive Login (Service Principals)​

7. Common Commands by Service​

8. Troubleshooting Playbook​

9. Quick Reference​

1. Installation and Login