Getting Started with Azure

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

See the section bibliography for the reference material consulted while preparing these pages.

Examples on this page target Azure CLI 2.90.0 and Azure Developer CLI (azd) 1.34.2. Command names and flags are stable across CLI patch releases, but run az upgrade before following along if a command reports itself as deprecated or missing.

Account, subscription and tenant

Three words get used almost interchangeably by newcomers, but they name three different things:

Account

The identity used to sign in — a Microsoft account (outlook.com, live.com, or any email registered as one) or a Microsoft Entra ID work/school account. An account can have access to many subscriptions across many tenants.

Subscription

The billing and access-management boundary. Every resource (a VM, a storage account, an AKS cluster) belongs to exactly one subscription, and a subscription belongs to exactly one Microsoft Entra tenant at a time (it can be transferred between tenants, but never lives in two at once). Quotas, spending limits and programmatic access all attach to the subscription.

Tenant

A dedicated, isolated instance of Microsoft Entra ID — the identity directory that holds users, groups, app registrations and the roles assigned to them. A tenant is identified by a tenant ID (a GUID) and typically one or more verified domains. One tenant can contain many subscriptions, and the same user account can be a guest in several different tenants.

The diagram below shows how these nest, down to the resource groups and resources introduced in Resource Organization:

flowchart TD T["Microsoft Entra tenant\n(contoso.onmicrosoft.com)"] S1["Subscription: Production"] S2["Subscription: Dev/Test"] RG1["Resource group: rg-bookshelf-prod"] RG2["Resource group: rg-bookshelf-shared"] RG3["Resource group: rg-bookshelf-dev"] R1["Resources: Container Apps, PostgreSQL, Redis"] R2["Resources: Key Vault, ACR"] R3["Resources: dev Container Apps, dev PostgreSQL"] T --> S1 T --> S2 S1 --> RG1 S1 --> RG2 S2 --> RG3 RG1 --> R1 RG2 --> R2 RG3 --> R3

In the Azure portal

  1. Sign in at the Azure portal and open the search bar at the top — type Subscriptions and select the service.

  2. Select a subscription to see its Overview blade: subscription ID, subscription type, and the Microsoft Entra tenant it belongs to (shown as Directory).

  3. From the same Subscriptions list, select Switch directory (or use the directory/subscription filter icon in the global top bar) to move between tenants the signed-in account has access to.

  4. Open Microsoft Entra ID from the search bar to see the tenant’s own Overview blade: Tenant ID, Primary domain, and the list of Microsoft Entra IDs (tenants) the account can switch into.

With the Azure CLI

# Show the signed-in account, active subscription and its tenant
az account show --output table

# List every subscription the signed-in account can access, across all tenants
az account list --all --output table

# List the tenants the signed-in account belongs to or is a guest in
az account tenant list --output table

References: az account, az account tenant.

Subscription types

Azure offers several subscription (offer) types; the ones a new reader is most likely to encounter:

Type What it is

Free account

A one-time signup offer: an initial credit plus a set of services free for 12 months and a longer list of services that are always free. See The free account’s current terms below.

Pay-As-You-Go

No upfront commitment; billed monthly for actual consumption. The default offer once the free account’s initial credit or 12-month period is exhausted.

Student

For eligible students verified with a school email address; includes starting credit and free-tier services, with no credit card required to sign up.

Enterprise Agreement (EA)

A negotiated, volume-based agreement between an organization and Microsoft (or a Microsoft partner), typically for larger organizations with an existing Enterprise Agreement for other Microsoft products.

Microsoft Customer Agreement (MCA)

The newer, simplified billing agreement that is gradually replacing the EA and classic Pay-As-You-Go purchase flows; billing happens directly with Microsoft or through a Microsoft partner, without a separate EA contract.

Visual Studio / MSDN subscriber benefits

Monthly Azure credit bundled with an active Visual Studio subscription, intended for dev/test workloads.

Sponsorship / CSP

Credit issued through a Microsoft sponsorship (e.g. a startup program) or purchased through a Cloud Solution Provider partner who resells and manages the subscription on the customer’s behalf.

The free account’s current terms

The terms below are Microsoft’s published terms at the time this page was last checked (2026-09-26); Azure’s free offer changes periodically, so re-verify them against azure.microsoft.com/free before relying on any number here.

  • An up-front credit (denominated in the signup currency) usable during the first 30 days after account creation. Unused credit is forfeited once those 30 days end, even if the account is later upgraded to Pay-As-You-Go.

  • A set of "popular services free" for the first 12 months, up to stated monthly quotas (for example, a capped amount of B-series virtual machine compute, a capped amount of Blob and file storage, and a capped amount of managed-disk storage).

  • A longer list of "always free" services, each capped at its own monthly quota that does not expire after 12 months — these typically include a small App Service plan, a small Functions consumption allotment, a Cosmos DB free tier, and small tiers of several monitoring and DevOps-adjacent services.

  • Signup requires a phone number, a non-prepaid credit or debit card for identity verification, and a Microsoft account or GitHub account; the card is not charged unless the account is explicitly moved to a paid plan.

To avoid unexpected charges on a free or Pay-As-You-Go account: set an Azure Cost Management budget with an alert threshold as soon as the account is created (covered in depth in Cost Management), delete or deallocate virtual machines instead of just stopping them from within the guest OS (a deallocated VM stops compute billing; a merely shut-down one does not), delete resource groups once a tutorial or proof of concept is finished rather than leaving orphaned resources behind, and periodically review the Cost analysis blade for anything running outside the free quotas.

In the Azure portal

  1. From the portal’s search bar, type Cost Management and open Cost Management + Billing.

  2. Select Cost analysis to see accumulated spend for the current billing period, broken down by resource group or service.

  3. Select Budgets → Add to create a spending threshold with an email alert, scoped to the whole subscription or to one resource group.

With the Azure CLI

# Show the current subscription's spending limit / offer type context
az account show --output table

# List active resource groups so nothing from a finished tutorial is left running
az group list --output table

References: Avoid unexpected charges with your Azure free account, az group.

A tour of the Azure portal

The Azure portal (portal.azure.com) is the web console for every Azure service. The pieces used throughout the rest of this section:

  • Search bar (top center) — the fastest way to jump to any service or resource by name; typing part of a resource’s name also lists matching resources, not just services.

  • Favorites (left navigation) — a customizable, pinned subset of services; add a service to it from its own blade’s "…​" menu or from the full services list.

  • Dashboards — customizable, shareable collections of tiles (metrics charts, resource lists, Markdown notes) that can be exported as ARM templates and version-controlled like any other infrastructure-as-code artifact.

  • Resource blades — a resource’s own page (the blade) always starts with an Overview tab showing its essential properties, and exposes related settings (networking, monitoring, access control) as tabs down the left side of the blade.

  • Cloud Shell button — the >_ icon in the top global toolbar, which opens the browser-based shell covered next.

Cloud Shell

Azure Cloud Shell is a browser-based, pre-authenticated shell (no local install needed) reachable from the portal toolbar, https://shell.azure.com, or the Azure mobile app. It comes in two flavors, chosen from a dropdown in the Cloud Shell toolbar:

  • Bash — pre-installs the Azure CLI, kubectl, Bicep, Terraform, git, and common scripting tools.

  • PowerShell — pre-installs the Az PowerShell module alongside the same Azure CLI and tooling, for readers who prefer PowerShell syntax and object pipelines.

Cloud Shell sessions are ephemeral by default (the machine backing the session is recycled after inactivity), but $HOME is preserved across sessions through a storage account that Cloud Shell provisions on first use — one 5 GB Azure Files share, mounted automatically at every session start. Because that storage account bills (minimally) for the file share, and because it exists purely to persist $HOME, it is one to be aware of when auditing a subscription for unexpected resources, per The free account’s current terms above.

In the Azure portal

  1. Select the >_ Cloud Shell icon in the top toolbar.

  2. On first use, choose Bash or PowerShell, then choose Create storage (mount an existing storage account/file share instead if one already exists for Cloud Shell in that subscription).

  3. Once open, pwd and ls show a persisted clouddrive mount backed by that storage account, distinct from the ephemeral session filesystem.

With the Azure CLI

Cloud Shell has no separate CLI of its own — it simply runs the Azure CLI (or Azure PowerShell) already signed in as the portal user. The one thing worth doing from the CLI is inspecting the storage account it created:

# List storage accounts tagged/created for Cloud Shell (name pattern varies by tenant)
az storage account list --query "[?contains(name, 'cs')].{name:name, resourceGroup:resourceGroup}" --output table

References: Azure Cloud Shell overview, Persisting files in Cloud Shell.

Installing and using the Azure CLI

The Azure CLI (az) is the cross-platform command-line tool for Azure, and the tool used throughout this documentation section.

In the Azure portal

There is no portal equivalent to installing a CLI; the closest portal feature is Cloud Shell (above), which comes with the CLI pre-installed and pre-authenticated.

With the Azure CLI

Install:

# macOS (Homebrew)
brew update && brew install azure-cli

# Linux (Debian/Ubuntu) -- Microsoft's install script
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Windows -- winget
winget install --exact --id Microsoft.AzureCLI

Sign in:

# Interactive browser sign-in
az login

# Headless / no local browser (e.g. an SSH session or Cloud Shell copy-paste)
az login --use-device-code

# Sign in against a specific tenant (useful with multiple Entra tenants)
az login --tenant <tenant-id-or-domain>

List and switch subscriptions once signed in:

az account list --output table
az account set --subscription "<subscription-id-or-name>"
az account show --output table

Persist CLI defaults so later commands can omit repeated flags:

az config set defaults.group=$RG defaults.location=$LOCATION
az config get

Shape output with --output and filter it with --query (JMESPath). A worked example — list only the name and location of every resource group whose name starts with rg-bookshelf:

export RG=rg-bookshelf
export LOCATION=eastus2

az group list \
  --query "[?starts_with(name, 'rg-bookshelf')].{name:name, location:location}" \
  --output table

Keep the CLI itself current, and manage optional extensions (many Azure services, such as containerapp or aks-preview, ship preview commands as extensions rather than in CLI core):

az upgrade

az extension add --name containerapp
az extension list --output table
az extension update --name containerapp

# Allow a command that is still preview-only in an installed extension
az containerapp create --name catalog-api --resource-group $RG --allow-preview true

References: Install the Azure CLI, Sign in with Azure CLI, Query Azure CLI command output with JMESPath, Azure CLI configuration, Use extensions with the Azure CLI.

Azure PowerShell

Azure PowerShell (the Az module) is Microsoft’s other first-party command-line tool, built on PowerShell cmdlets instead of `az’s flat command syntax. Most readers of this section only need the Azure CLI, but Azure PowerShell is common in Windows-centric and existing PowerShell automation shops:

Azure CLI Azure PowerShell

Install

brew/apt/winget package azure-cli

PowerShell Gallery module Az (Install-Module -Name Az)

Sign in

az login

Connect-AzAccount

Object model

JSON in, JSON out; filter with --query (JMESPath)

.NET objects in the pipeline; filter with Where-Object/Select-Object

Command shape

az <group> <verb>, e.g. az group create

<Verb>-Az<Noun>, e.g. New-AzResourceGroup

Cross-platform

Yes (macOS, Linux, Windows)

Yes (PowerShell 7+ on macOS, Linux, Windows)

In the Azure portal

Cloud Shell’s PowerShell mode (see above) is the fastest way to try Azure PowerShell without installing anything locally.

With the Azure CLI

Not applicable — install and sign in to Azure PowerShell directly:

# From a PowerShell 7+ prompt
Install-Module -Name Az -Scope CurrentUser -Repository PSGallery
Connect-AzAccount
Get-AzSubscription

References: Install Azure PowerShell, Sign in with Azure PowerShell.

Azure Developer CLI (azd)

azd is a higher-level, opinionated tool built on top of the Azure CLI and Bicep/Terraform: instead of scripting individual az calls, a project declares its infrastructure and services once (an azure.yaml plus Bicep/ Terraform templates) and azd provisions and deploys them together. It is introduced briefly here and used more fully in Infrastructure as Code.

In the Azure portal

Not applicable — azd is a local/CI tool with no dedicated portal blade; its provisioned resources appear as ordinary resource groups and resources once created.

With the Azure CLI

azd is installed and invoked separately from az, though it shells out to the Azure CLI’s authentication under the hood:

# Install (macOS)
brew tap azure/azd && brew install azd

# Scaffold a new azd project from a template (or an empty one)
azd init

# Provision infrastructure and deploy the application in one step
azd up

# Redeploy application code only, without re-provisioning infrastructure
azd deploy

# Tear down everything azd provisioned for this environment
azd down

References: Azure Developer CLI (azd) overview, Install azd.

VS Code, IDE tooling and SDKs

The Azure Tools extension pack for Visual Studio Code bundles resource-browsing and deployment extensions for Container Apps, Functions, App Service, Storage, Key Vault and more, letting a reader browse and act on resources without leaving the editor; JetBrains IDEs (via the Azure Toolkit for IntelliJ) and Visual Studio offer comparable integrations. Beyond interactive tooling, first-party Azure SDKs (Java, .NET, Python, JavaScript/TypeScript, Go) provide the same authentication and service clients used by application code — these are covered where relevant throughout this section, in particular DefaultAzureCredential in Identity and Access.

In the Azure portal

Not applicable — this is local editor tooling; the portal has no equivalent.

With the Azure CLI

Not applicable — install the extension pack from within VS Code’s Extensions view (search Azure Tools), which in turn uses the same Azure CLI/azd sign-in already covered above.

References: Azure Tools extension pack for VS Code, Azure Developer CLI documentation.

Registering resource providers

Azure Resource Manager only lets a subscription create resources of a given type (e.g. Microsoft.ContainerService for AKS, Microsoft.DocumentDB for Cosmos DB / Azure DocumentDB) once the corresponding resource provider is registered on that subscription. Most common providers are registered automatically the first time a matching resource is created through the portal, but scripted/CI deployments against a fresh subscription sometimes need to register a provider explicitly first.

In the Azure portal

  1. Open Subscriptions → select the subscription → Resource providers (left navigation, under Settings).

  2. Search for the provider namespace (e.g. Microsoft.App for Container Apps).

  3. Select it and choose Register (or Re-register if it shows as Unregistered after being removed).

With the Azure CLI

# Check a provider's registration state
az provider show --namespace Microsoft.App --query "registrationState" --output tsv

# Register it if not already registered
az provider register --namespace Microsoft.App

# List every provider and its current state
az provider list --query "[].{namespace:namespace, state:registrationState}" --output table

References: Resource providers and resource types, az provider.

Related pages

References