The exam and everyday administration demand four tools: the portal, Cloud Shell, the Azure CLI and Azure PowerShell. Whoever knows only one often doesn't notice in a task that another would be shorter. This lesson sets up the tools, shows signing in and the forms of output, and settles what the rest of the course works with.

Nordlicht Reisen GmbH, a fictional travel agency, stands here for a task that every administration knows: "Show me all resource groups of the booking system in Germany, and do it before I go into the meeting." In the portal you click, in the shell you ask.

Prior knowledge: Output formats, --query with JMESPath, --output tsv in scripts and checking $LASTEXITCODE are taught in detail in K3, lesson 3.1.6. Here only what the choice of tool and the exam need is given. What a tenant and a subscription are is covered in "AZ-900 compact", lesson 2.2.

The four tools

Tool Strength Weakness
Azure portal viewing, exploring, one-off tasks not repeatable, not verifiable
Cloud Shell a signed-in shell in the browser at once, nothing to install session expires, for interactive work only
Azure CLI (az) short commands, cross-platform, good for scripts a program of its own: errors are exit codes
Azure PowerShell (Az module) objects instead of text, pipeline, good for analysis module must be installed and current

As a rule of thumb for practice: the portal for understanding, commands for repeating. An action that you need a second time belongs in a command or in a template (lessons 3.1 and 3.2). Both command tools reach the same services of Azure Resource Manager; what one can do, the other can usually do too.

The portal

The portal is available at portal.azure.com. Three things are enough for orientation:

  • The search at the top finds services, resources and documentation. Whoever types "Subscriptions", "Resource groups" or "free services" goes straight there.
  • The header bar contains the icon for Cloud Shell. One click opens a shell at the bottom of the browser.
  • Every resource has an overview page and a menu on the left. There you find settings, access control, tags, cost analysis and other items, depending on the service.

This course writes the names of the interface in English, as Microsoft calls them in its documentation. If your portal is set to another language, look for the same item under its translated name; the search box finds both.

The first thing to check in the portal is which directory you're signed in to and which subscriptions you see. A common reason for "My resource is gone" is a different directory or a filter on a different subscription.

Cloud Shell

Azure Cloud Shell is an interactive, signed-in terminal in the browser. You choose between Bash and PowerShell. You can reach it through the portal, through shell.azure.com, through the CLI and PowerShell documentation, through Azure's mobile app and through the Azure Account extension of Visual Studio Code. Azure CLI and Azure PowerShell are installed there, and Cloud Shell signs you in automatically: no az login, no Connect-AzAccount.

What you need to know about session and storage:

  • The session expires after 20 minutes without input. The shell is meant for interactive work, not for long, unattended runs. Those are ended without warning. That it be a general-purpose computer is explicitly not intended: Permanent heavy use can violate the terms of use.
  • There are two ways to start it. At the first start you choose whether to mount a storage account. With a storage account, your files are kept: Cloud Shell mounts an Azure file share as clouddrive and keeps your home directory in it. Microsoft names 5 GB for this. Without a storage account (an ephemeral session, the fastest variant), all saved files are deleted when the session ends. For the ephemeral session, the resource provider Microsoft.CloudShell must be registered in the subscription; you can do that in the portal under Subscriptions, choose the subscription, Settings, Resource providers.
  • The hosting is free, the storage account isn't. The machine the shell runs on costs nothing. The mounted storage account costs like any storage account. Cloud Shell creates it with a resource group of its own.
  • Deleting that group deletes your home directory. Whoever deletes the resource group, storage account or file share that Cloud Shell mounted loses the home directory with its files, and that can't be undone. Don't delete this group together with your exercise groups, but only when you no longer want to use Cloud Shell.
  • PowerShell in Cloud Shell has the Azure: drive. It shows resources like a file system; you see changes there after dir -Force. You can't create files there.
  • Restart and settings: In the toolbar you switch between Bash and PowerShell, restart the shell and open the Settings menu, in which Reset user settings resets the settings and detaches the mounted storage account. The file share isn't deleted in the process.

Which shell to take? For this course: The commands of the lessons are mostly Azure CLI and run in Bash and in PowerShell (only the quotation marks differ). Where Bash is meant, the code is in a bash block; otherwise it's PowerShell.

Setting up and checking the Azure CLI

The Azure CLI runs on Windows, Linux and macOS. On Windows, you set it up with WinGet:

PowerShell
winget install --exact --id Microsoft.AzureCLI

After that you must close every open terminal window and open it again. To update, there has been the command az upgrade since version 2.11.0; by default it also updates all installed extensions. You record the version like this:

PowerShell
az version

The output is a JSON object with the versions of the CLI (azure-cli, azure-cli-core, azure-cli-telemetry) and of the installed extensions (extensions). Your numbers are different from somebody else's, and the course names none, except where Microsoft names one as a requirement. Record them for yourself, so that when something fails you know what you worked with. You install extensions (for example for Resource Graph) when needed with az extension add --name <name>.

Setting up and checking Azure PowerShell

Azure PowerShell is the Az module, a rollup module that downloads the generally available modules. Microsoft recommends PowerShell 7 or higher on all platforms for it. Installation and check:

PowerShell
$PSVersionTable.PSVersion
Install-Module -Name Az -Repository PSGallery -Force
Get-InstalledModule -Name Az

The first line shows the version of your PowerShell. The last prints a line with the module's version, name, repository and description; it's your proof of what is installed. In Cloud Shell and in Microsoft's Docker images, the module is already there. You find the module's commands with:

PowerShell
Get-Command -Module Az.Resources

Signing in and choosing the subscription

Azure CLI. az login signs you in interactively. On Windows, the CLI has used the Web Account Manager by default since version 2.61.0, on Linux and macOS the browser. If your account has several subscriptions, the CLI asks at sign-in for the subscription that should count as the default. If no browser can be opened, you force sign-in with a device code:

PowerShell
az login
az login --use-device-code
az login --tenant <tenant>

--tenant takes a .onmicrosoft.com domain or the tenant's ID. In some environments you must first switch off the subscription selection with az config set core.login_experience_v2=off for that. Signing in with user name and password on the command line doesn't work with Microsoft accounts and not with accounts for which multifactor authentication applies. Since September 2025, Microsoft requires multifactor authentication for the Azure CLI and other command-line tools for user accounts; service principals and managed identities are exempt. The message "interactive authentication is needed" means: For this account only interactive sign-in works.

No password on the command line. The process list and the shell's history store input (K3, lesson 3.1.6). For exercises, always sign in interactively.

Check and switch the active subscription:

PowerShell
az account list --query "[].{Name:name, Standard:isDefault, Zustand:state}" --output table
az account show --query "{Name:name, Zustand:state}" --output table
az account set --subscription "<name or ID>"
az logout

The first line prints a table with one row per subscription. az account set determines against which subscription the following commands run. az logout signs you out; az account clear additionally empties the subscription cache, after which no command works without a new sign-in. An access token is shown by az account get-access-token: Never print it and never copy it anywhere, it's a key to your account.

Azure PowerShell. The same steps:

PowerShell
Connect-AzAccount
Get-AzSubscription
Set-AzContext -Subscription "<name or ID>"
Get-AzContext
Disconnect-AzAccount

With Connect-AzAccount -UseDeviceAuthentication you force the device code, with -Tenant and -Subscription you choose tenant and subscription. Since module version 12.0.0, PowerShell also asks when there are several subscriptions; with Update-AzConfig -DefaultSubscriptionForLogin '<name or ID>' you set a default subscription. The context (Get-AzContext) sums up account, subscription, tenant and environment. Set-AzContext changes it for the running session. In Cloud Shell, sign-in is already done; az account set and Set-AzContext you need there too if you have several subscriptions. Cloud Shell remembers your chosen subscription for future sessions.

Shaping output: CLI

Every CLI command knows --output (-o) and --query. A short version of the exam material; the depth is in K3, lesson 3.1.6:

--output Use
json default, complete, for programs
table readable table (selected fields only)
tsv values without quotation marks, for scripts
yaml, yamlc YAML without and with color
jsonc JSON with color
none no output, only the exit code

--query takes a JMESPath expression that is applied to the response before it appears. Three building blocks are enough to begin:

PowerShell
az group list --query "[].name" --output tsv
az group list --query "[?location=='germanywestcentral'].{Name:name, Ort:location}" --output table
az group list --query "[] | length(@)" --output tsv

The first line prints the names of all groups, one per line. The second filters on the region with [?condition] and names the columns with {Name:expression}. The third counts the groups. On Windows, an expression with parentheses needs a space, which is why [] | stands in front (reason in K3, lesson 3.1.6). Whoever struggles with the quotation marks fetches the JSON and filters in PowerShell.

If a CLI command fails, it ends with an exit code other than 0, but PowerShell keeps running. In scripts you check $LASTEXITCODE after every az call. With a single call in the terminal, you see the error message anyway.

Shaping output: Azure PowerShell

Azure PowerShell returns objects instead of text. Instead of a query language, you use the cmdlets you know from PowerShell:

PowerShell
Get-AzResourceGroup |
    Where-Object Location -eq 'germanywestcentral' |
    Select-Object ResourceGroupName, Location |
    Format-Table
(Get-AzResourceGroup).Count
Get-AzResourceGroup | ConvertTo-Json -Depth 3

Where-Object filters, Select-Object chooses properties, Format-Table determines the display, ConvertTo-Json turns it into JSON. The result of the first command corresponds to the second CLI line: a table with name and region per group. Remember the differences in names: The CLI calls the field name, PowerShell ResourceGroupName.

Help is available in both: az group create --help and Get-Help New-AzResourceGroup. For the exam this applies: You don't have to know every parameter by heart, but you must recognize what a command does and be able to complete the missing part of a line.

Cost and clean-up

  • What costs money by the hour: The exercises of this lesson create only an empty resource group. Cloud Shell with a mounted storage account costs like any storage account; an ephemeral session needs none.
  • Clean-up: az group delete --name rg-az104-werkzeuge --yes --no-wait, then az group wait --name rg-az104-werkzeuge --deleted and az group exists --name rg-az104-werkzeuge (must print false). In PowerShell: Remove-AzResourceGroup -Name rg-az104-werkzeuge -Force.
  • What doesn't disappear with the group: Your Cloud Shell resources. Cloud Shell creates the storage account and file share in groups of their own; deleting the exercise group doesn't touch them, and that is intended. Delete them only when you no longer use Cloud Shell, and remember that your home directory there is lost in the process.

Common mistakes

  • az is not recognized. After the installation you didn't reopen the terminal. Close all windows and open one anew.
  • Sign-in aborts with "interactive authentication is needed". You gave user name and password on the command line, but multifactor authentication applies to the account. Sign in with az login without a password.
  • The output shows resources of a different subscription. Check with az account show or Get-AzContext which one is active, and set it with az account set or Set-AzContext.
  • Cloud Shell: files are gone. You worked without a storage account or the session was reset after inactivity. Only clouddrive persists.

Exercise 1: Sign in, choose, create, analyze, delete

  1. Sign in with the Azure CLI and show your subscriptions as a table.
  2. Choose the subscription for the course and check it with az account show.
  3. Create the resource group rg-az104-werkzeuge in your region, with the tags kurs=az104 and quelle=cli.
  4. Sign in to Azure PowerShell and create the group rg-az104-werkzeuge-ps there with the tag quelle=powershell.
  5. List all groups with az as a table (name, region, tags) and with PowerShell as a table (name, region).
  6. Clean up.

How to check it: Both lists show both groups. After the clean-up, az group exists prints false for both names.

Solution 1
PowerShell
az login
az account list --query "[].{Name:name, Standard:isDefault}" --output table
az account set --subscription "<name or ID>"
az account show --query "{Name:name, Zustand:state}" --output table
az group create --name rg-az104-werkzeuge --location germanywestcentral --tags kurs=az104 quelle=cli
Connect-AzAccount
New-AzResourceGroup -Name rg-az104-werkzeuge-ps -Location germanywestcentral -Tag @{ quelle = 'powershell' }
az group list --query "[?starts_with(name, 'rg-az104-werkzeuge')].{Name:name, Ort:location, Tags:tags}" --output table
Get-AzResourceGroup | Where-Object ResourceGroupName -like 'rg-az104-werkzeuge*' | Select-Object ResourceGroupName, Location | Format-Table

Both analyses print a table with two rows. With the CLI, the Tags column shows the tags of the respective group; how the tags are displayed in the table can vary with the CLI version, if necessary use --output json. Get-AzResourceGroup shows the columns ResourceGroupName and Location.

Clean-up and check:

PowerShell
az group delete --name rg-az104-werkzeuge --yes --no-wait
Remove-AzResourceGroup -Name rg-az104-werkzeuge-ps -Force
az group wait --name rg-az104-werkzeuge --deleted
az group exists --name rg-az104-werkzeuge
az group exists --name rg-az104-werkzeuge-ps

The last two commands each print false. Remove-AzResourceGroup waits until the group is gone.

Exercise 2: Cloud Shell

  1. Open Cloud Shell in the portal and choose PowerShell. Start without a storage account if you don't want to mount one.
  2. Check your subscription there with Get-AzContext and az account show.
  3. Switch to Bash and query az group list --output table there.
  4. Create a file (echo test > probe.txt), end the session, restart and check whether the file is still there.

How to check it: In both shells you're signed in without signing in and see the same groups. Whether the file is kept depends on whether you mounted a storage account (clouddrive) or not.

Solution 2

Cloud Shell has Azure CLI and Azure PowerShell preinstalled and has already signed you in, which is why az account show and Get-AzContext work without signing in. Both show the same subscription. az group list --output table in Bash prints the same groups as in PowerShell, only in the CLI's display.

On the file: Without a storage account (ephemeral session), it's deleted when the session ends; with a storage account, it's kept in the home directory, which lies in an image in the file share. Outside the home directory, nothing persists. Whoever uses the shell only for trying things out needs no storage account and therefore has no leftovers to clean up.

What you can do now

  • You choose the right tool for a task.
  • You set up the Azure CLI and the Az module and record their versions.
  • You sign in with az login and Connect-AzAccount, check the active subscription and switch it.
  • You start Cloud Shell and know what persists and what doesn't.
  • You shape output with --output and --query and with Where-Object and Select-Object.

Further reading