⌨️ The Azure CLI (az): Sign In, Defaults, Output and Query

How the az command is organized, the four ways to sign in, how to set a default subscription, resource group and region, how to shape the output with --output and --query, and how to ask for help with no account at all

💡 How this page was tested. Unlike the account, regions and services pages, parts of this one were run for real. On 6 October 2026 I installed Azure CLI 2.91.0 in a throwaway folder (with its own empty home directory, so nothing touched a real configuration) and ran everything that works without signing in: the version, the errors you see when you are not signed in, the defaults, --help, and a JSON query against the built-in list of clouds. Everything that needs a real account is marked from the documentation, not run here. The same approach is used on the AWS, Google Cloud and Oracle CLI pages, and the comparison page puts all four side by side.

What az is

az is the Azure command-line interface. Everything the portal can do, az can do, because they use the same front door: Azure Resource Manager (see the services map). The commands are organized as group, then subcommand, like az group create or az vm list:

Getting it

You can install it from your system's package manager, the Microsoft installer for your platform, or with pip. The documentation lists the options for each system (from the documentation, not run here). I used pip in a virtual environment, because it leaves nothing behind when you delete the folder. Or skip installing: Cloud Shell (the terminal inside the Azure portal) has az ready and already signed in.

python3 -m venv venv-az
venv-az/bin/pip install azure-cli

The version, as run:

user@lab:~$ az --version
azure-cli                         2.91.0

core                              2.91.0
telemetry                          1.1.0

Dependencies:
msal                              1.39.0
azure-mgmt-resource               24.0.0

Python location '.../venv-az/bin/python3'
Config directory '~/.azure'
Extensions directory '~/.azure/cliextensions'
[...]
Your CLI is up-to-date.

(Your CLI is up-to-date means it checked Microsoft's servers for a newer one. The config directory is ~/.azure: that folder is where it keeps your sign-in tokens, so treat it like a password file.)

Before you sign in

Run these three first. They are safe, and they show what an unsigned CLI says:

user@lab:~$ az account show
ERROR: Please run 'az login' to setup account.
user@lab:~$ az account list --output table
WARNING: Please run "az login" to access your accounts.
user@lab:~$ az vm list
ERROR: Please run 'az login' to setup account.

Please run 'az login' to setup account. is the message that means "you are not signed in". Note that az account list printed a warning and an empty list (rather than an error), which is easy to misread as "no subscriptions".

Signing in

From Microsoft's documentation (read on 6 October 2026), four ways:

Two facts to know:

After signing in, check where you are (from the documentation, not run here):

az account show
az account list --output table
az account set --subscription "SUBSCRIPTION NAME OR ID"
az logout

az account set chooses the subscription that the following commands use. If you have more than one, run az account show before every experiment.

Defaults: stop typing the same flags

Most commands need a resource group and a location. You can set defaults once, and the commands use them. This part ran for real (no sign-in is needed to store a setting):

user@lab:~$ az config set defaults.location=westeurope defaults.group=lab-rg
WARNING: Command group 'config' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
user@lab:~$ az config get
WARNING: Command group 'config' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
{
  "cloud": [
    {
      "name": "name",
      "source": "~/.azure/config",
      "value": "AzureCloud"
    }
  ],
  "defaults": [
    {
      "name": "location",
      "source": "~/.azure/config",
      "value": "westeurope"
    },
    {
      "name": "group",
      "source": "~/.azure/config",
      "value": "lab-rg"
    }
  ]
}
user@lab:~$ cat ~/.azure/config
[cloud]
name = AzureCloud

[defaults]
location = westeurope
group = lab-rg
user@lab:~$ az group create --help | sed -n 1,16p

Command
    az group create : Create a new resource group.

Arguments
    --name --resource-group -g -n [Required] : Name of the new resource group.
    --location -l                            : Location. Values from: `az account list-locations`.
                                               You can configure the default location using `az
                                               configure --defaults location=<location>`.  Config:
                                               westeurope.
    --managed-by                             : The ID of the resource that manages this resource
                                               group.
    --tags                                   : Space-separated tags: key[=value] [key[=value] ...].
                                               Use '' to clear existing tags.

Global Policy Arguments

Look at the --location entry: it ends with Config: westeurope. The help tells you that a default is in force. This is a double-edged tool: a forgotten default location puts new things in a region you did not choose, so look at az config get when something lands in a surprising place. To remove one: az config unset defaults.location.

Output: json, table, tsv and the rest

Every command takes --output (or -o). From the help text of the real CLI, the choices are json (the default), jsonc (colored), table, tsv (tab-separated, no headers), yaml, yamlc and none. When to use which:

--only-show-errors hides warnings, --verbose adds detail and --debug shows every request (this is where you look when a command fails in a way you cannot explain).

Query: pick exactly what you want

--query takes a JMESPath expression, the same little language the AWS and Oracle CLIs use (the comparison page has a primer). It runs on the CLI's side, after the answer arrives. These examples ran for real on az cloud list, which is built into the CLI (a list of Azure clouds, no account needed):

user@lab:~$ az cloud list --output table
IsActive    Name               Profile
----------  -----------------  ---------
True        AzureCloud         latest
False       AzureChinaCloud    latest
False       AzureUSGovernment  latest
False       AzureBleuCloud     latest
user@lab:~$ az cloud list --query '[].name' --output tsv
AzureCloud
AzureChinaCloud
AzureUSGovernment
AzureBleuCloud
user@lab:~$ az cloud list --query "[?isActive].{Name:name, ARM:endpoints.resourceManager}" --output json
[
  {
    "ARM": "https://management.azure.com/",
    "Name": "AzureCloud"
  }
]
user@lab:~$ az cloud list --query "[].{Name:name, Portal:endpoints.portal}" --output table
Name               Portal
-----------------  --------------------------------
AzureCloud         https://portal.azure.com
AzureChinaCloud    https://portal.azure.cn
AzureUSGovernment  https://portal.azure.us
AzureBleuCloud     https://portal.sovcloud-azure.fr

Read them in order:

  1. --output table prints everything as a table.
  2. --query '[].name' --output tsv: [] means "every item in the list", .name is the field. With tsv you get one name per line, ready to loop over.
  3. --query "[?isActive].{Name:name, ARM:endpoints.resourceManager}": [?isActive] filters (only items where isActive is true), and {Name:name, ARM:...} builds a new object with the fields you choose and the names you give them. It also reaches into nested data: endpoints.resourceManager.
  4. The same shape with --output table gives a clean table with your own column names.

The same techniques on a real subscription (from the documentation, not run here):

az vm list --output table
az vm list --query "[].{Name:name, Size:hardwareProfile.vmSize, State:powerState}" --show-details --output table
az account show --query id --output tsv
az group list --query "[?location=='westeurope'].name" --output tsv

(--show-details makes az vm list fetch the power state.) The note on JMESPath: field names are case-sensitive, string values in a filter go in single quotes, and the whole expression goes in double quotes in the shell, so the quotes do not fight.

Getting help, with no account

Help is built in, runs locally and needs no sign-in:

Habits that save you

The cheat sheet

↑ All tutorials · The AWS CLI (aws): Sign In, Profiles, Output and Query →

© 2026 TechCommune. All rights reserved.
"az is the same tool as the portal with the mouse removed. It is much faster, and so are the mistakes."