AZ-104 Azure CLI and PowerShell Reference
The Azure CLI and Azure PowerShell commands AZ-104 asks you to read and pick between, plus the resource types those commands create. Written for the Azure Administrator exam and useful revision after AZ-900.
AZ-104 Azure CLI and PowerShell Reference · firsttry.app/cheatsheets/azure-admin-cli · original reference written from published exam objectives. Not affiliated with any certification body.
Azure CLI essentials
| Command | What it does |
|---|---|
| az login | Sign in interactively in the browser |
| az account show | Show the subscription and tenant you are working in |
| az account list --output table | List every subscription your account can reach |
| az account set --subscription "<name or id>" | Change the active subscription |
| az group create --name <rg> --location <region> | Create a resource group |
| az group delete --name <rg> --yes | Delete a resource group and everything inside it |
| az resource list --resource-group <rg> -o table | List the resources in a group |
| az vm list -d -o table | List VMs with their power state (-d shows details) |
| az vm start --resource-group <rg> --name <vm> | Start a stopped VM |
| az vm stop --resource-group <rg> --name <vm> | Shut the guest down; the VM stays allocated and still bills |
| az vm deallocate --resource-group <rg> --name <vm> | Release the compute so compute charges stop; disks still bill |
| az storage account create --name <name> --resource-group <rg> --sku Standard_LRS | Create a storage account with a redundancy SKU |
| az network nsg rule create --resource-group <rg> --nsg-name <nsg> --name <rule> --priority 200 --access Allow | Add a rule to a network security group |
| az role assignment create --assignee <user> --role "Reader" --scope <scope> | Assign a built-in RBAC role at a scope |
| az deployment group create --resource-group <rg> --template-file <file> | Deploy an ARM or Bicep template into a resource group |
Azure PowerShell equivalents
| Cmdlet | What it does |
|---|---|
| Connect-AzAccount | Sign in to Azure |
| Get-AzContext | Show the current subscription and tenant context |
| Get-AzSubscription | List the subscriptions you can reach |
| Set-AzContext -Subscription "<id>" | Change the active subscription |
| New-AzResourceGroup -Name <rg> -Location <region> | Create a resource group |
| Remove-AzResourceGroup -Name <rg> -Force | Delete a resource group and its contents |
| Get-AzResource -ResourceGroupName <rg> | List the resources in a group |
| Get-AzVM -Status | List VMs with their power state |
| Start-AzVM -ResourceGroupName <rg> -Name <vm> | Start a VM |
| Stop-AzVM -ResourceGroupName <rg> -Name <vm> | Stop and deallocate a VM by default |
| Stop-AzVM -StayProvisioned | Stop the VM but keep it allocated |
| New-AzStorageAccount | Create a storage account |
| New-AzRoleAssignment -SignInName <user> -RoleDefinitionName <role> -Scope <scope> | Assign an RBAC role |
| New-AzResourceGroupDeployment -ResourceGroupName <rg> -TemplateFile <file> | Deploy a template into a resource group |
Core resource types
| Resource | What it is for |
|---|---|
| Management group | Container above subscriptions; policy and RBAC assigned here inherit downward |
| Subscription | Billing and quota boundary; holds resource groups |
| Resource group | Lifecycle container; every resource belongs to exactly one group |
| Virtual network | Private address space in one region |
| Subnet | A slice of the virtual network address space |
| Network security group | Allow and deny rules by source, destination, port and protocol; attach to a subnet or a NIC |
| NSG rule priority | Lower number is evaluated first; user rules use 100 to 4096 |
| Application security group | Groups NICs so NSG rules can name a group instead of IP addresses |
| Route table | User defined routes that override Azure system routes |
| Azure Bastion | RDP and SSH to VMs from the portal without a public IP on the VM |
| Load Balancer | Layer 4 distribution across a backend pool, public or internal |
| Application Gateway | Layer 7 routing by URL path or host, with an optional web application firewall |
| Availability set | Spreads VMs across fault domains and update domains inside one datacenter |
| Availability zone | Physically separate locations within one region |
| Virtual machine scale set | Identical VMs that scale out and in on a rule |
Storage services, tiers and redundancy
| Item | What it means |
|---|---|
| Blob storage | Object storage for unstructured data, organized in containers |
| Azure Files | Managed SMB and NFS shares you can mount from a client |
| Queue storage | Message store for decoupling application components |
| Table storage | NoSQL key attribute store for structured, non-relational data |
| Hot tier | Frequent access; highest storage cost, lowest access cost |
| Cool tier | Infrequent access; 30 day minimum retention before early deletion charges |
| Cold tier | Rarer access; 90 day minimum retention |
| Archive tier | Offline; 180 day minimum retention, and the blob must be rehydrated before it can be read |
| LRS | Three synchronous copies inside a single datacenter in the primary region |
| ZRS | Three synchronous copies across three availability zones in the primary region |
| GRS | LRS in the primary region plus asynchronous replication to a secondary region |
| GZRS | ZRS in the primary region plus asynchronous replication to a secondary region |
| RA-GRS and RA-GZRS | Same as GRS and GZRS, with read access to the secondary endpoint |
Built-in RBAC roles
| Role | What it grants |
|---|---|
| Owner | Full management of resources, including assigning roles to others |
| Contributor | Full management of resources, but cannot assign roles |
| Reader | View resources, change nothing |
| User Access Administrator | Manage who has access to resources, without managing the resources |
| Virtual Machine Contributor | Manage VMs, but not the virtual network or storage account they connect to |
| Network Contributor | Manage networking resources, but not access to them |
| Storage Blob Data Contributor | Read, write and delete blob data (data plane, not the account itself) |
| Storage Blob Data Reader | Read and list blob data |
| Role assignment | Security principal plus role definition plus scope; assignments inherit to child scopes |
Governance: policy, locks and tags
| Feature | What it does |
|---|---|
| Azure Policy | Evaluates resources against rules and acts on the result |
| Deny effect | Blocks the create or update request outright |
| Audit effect | Allows the request and records non-compliance |
| Append and Modify effects | Add or change fields such as tags on the resource being written |
| DeployIfNotExists | Deploys a related resource when the condition is not met; needs a managed identity |
| Initiative | A set of policy definitions assigned and reported as one unit |
| CanNotDelete lock | Read and modify allowed, delete blocked |
| ReadOnly lock | Read allowed, changes and deletes blocked |
| Lock inheritance | Locks apply to child scopes, and the most restrictive lock wins |
| Tags | Name and value pairs for cost reporting; child resources do not inherit them by default |
Exams covered
Try it here
Two verified practice questions on this material. Answer one, and see the official page behind the answer.
Monitor and maintain Azure resources
What is the longest the soft delete retention period for backup data can be extended to?
Describe cloud concepts
An engineer adds more CPUs and RAM to an existing virtual machine to handle a heavier workload. Which type of scaling is this?
Five free questions on every practice exam. No account, no card.