Azure CLI first steps: sign in, pick the right subscription, set defaults and read the output

Most "I deleted the wrong thing" stories start the same way: the engineer ran a correct command in the wrong subscription. This post covers the handful of CLI habits that prevent that, and the output tricks that make the CLI pleasant to use.

#Install or open Cloud Shell

You can skip installing anything by opening Cloud Shell from the Azure portal (the >_ icon). It comes signed in, with the CLI already updated. To run it locally, install it from Microsoft's documentation for your OS, then check the version:

az version
az upgrade        # updates the CLI in place on supported installs

#Sign in

az login                       # opens a browser
az login --use-device-code     # for a jump box or SSH session without a browser
az login --tenant contoso.onmicrosoft.com   # when your account is in several tenants

After sign-in the CLI lists every subscription you can see. That list is the first thing to read carefully.

Tip

On a shared jump host, run az logout when you finish. The token cache lives in your profile (~/.azure), and anyone using the same profile inherits your session.

#Always confirm the subscription

az account show --output table
az account list --output table
az account set --subscription "Contoso-Prod-01"     # name or ID

Make az account show a reflex before any command that creates, changes or deletes something. In scripts, pass --subscription explicitly on each command rather than relying on whatever was set last.

#Set defaults to save typing

az config set defaults.group=rg-app-dev defaults.location=westeurope
az config get defaults
az config unset defaults.group

With a default group, az vm list and az vm show -n vm01 work without -g. Defaults are per user profile, so they can surprise you later. Unset them when you switch projects.

#Choose an output format

az vm list -o table      # human-readable
az vm list -o json       # full detail (default)
az vm list -o tsv        # plain values for scripts
az vm list -o yamlc      # coloured YAML

Use table to look, tsv to feed values into another command, and json when you need every field.

#Filter with --query (JMESPath)

--query runs on the client and trims the JSON before printing it.

# names only
az vm list --query "[].name" -o tsv

# chosen columns with friendly headers
az vm list --query "[].{Name:name, RG:resourceGroup, Size:hardwareProfile.vmSize}" -o table

# filter: VMs in one location
az vm list --query "[?location=='westeurope'].name" -o tsv

# one value into a variable (bash)
VNET_ID=$(az network vnet show -g rg-net -n vnet-hub --query id -o tsv)

PowerShell users: the same commands work; use backticks rather than \ for line continuation.

$id = az network vnet show -g rg-net -n vnet-hub --query id -o tsv

#Find the command you need

az find "create storage account"     # example commands
az storage account create --help     # every parameter
az interactive                        # autocomplete shell

#A safe first session, end to end

az login
az account set --subscription "Contoso-Dev-01"
az account show --query "{sub:name, user:user.name}" -o table
az group create -n rg-cli-lab -l westeurope --tags owner=me purpose=lab
az group show -n rg-cli-lab -o table
az resource list -g rg-cli-lab -o table
az group delete -n rg-cli-lab --yes --no-wait

Warning

az group delete removes everything inside the group. Run az resource list -g <group> -o table first and read the list.

#Common first-week errors

#Prevent it next time

• Show the active subscription in your shell prompt, or run az account show before every change.
• Give production its own account or use Privileged Identity Management so day-to-day sessions cannot change prod.
• In scripts, set --subscription explicitly and use set -euo pipefail (bash) so a failed lookup stops the run.
• Keep the CLI current; many "unrecognized arguments" errors are an old CLI version.