AZ-104 Azure CLI and PowerShell Reference
The Azure CLI and Azure PowerShell commands AZ-104 asks you to read and pick between, plus the resource types those commands create. Written for the Azure Administrator exam and useful revision after AZ-900.
Azure CLI essentials
| Command | What it does |
|---|---|
| az login | Sign in interactively in the browser |
| az account show | Show the subscription and tenant you are working in |
| az account list --output table | List every subscription your account can reach |
| az account set --subscription "<name or id>" | Change the active subscription |
| az group create --name <rg> --location <region> | Create a resource group |
| az group delete --name <rg> --yes | Delete a resource group and everything inside it |
| az resource list --resource-group <rg> -o table | List the resources in a group |
| az vm list -d -o table | List VMs with their power state (-d shows details) |
| az vm start --resource-group <rg> --name <vm> | Start a stopped VM |
| az vm stop --resource-group <rg> --name <vm> | Shut the guest down; the VM stays allocated and still bills |
| az vm deallocate --resource-group <rg> --name <vm> | Release the compute so compute charges stop; disks still bill |
| az storage account create --name <name> --resource-group <rg> --sku Standard_LRS | Create a storage account with a redundancy SKU |
| az network nsg rule create --resource-group <rg> --nsg-name <nsg> --name <rule> --priority 200 --access Allow | Add a rule to a network security group |
| az role assignment create --assignee <user> --role "Reader" --scope <scope> | Assign a built-in RBAC role at a scope |
| az deployment group create --resource-group <rg> --template-file <file> | Deploy an ARM or Bicep template into a resource group |
Azure PowerShell equivalents
| Cmdlet | What it does |
|---|---|
| Connect-AzAccount | Sign in to Azure |
| Get-AzContext | Show the current subscription and tenant context |
| Get-AzSubscription | List the subscriptions you can reach |
| Set-AzContext -Subscription "<id>" | Change the active subscription |
| New-AzResourceGroup -Name <rg> -Location <region> | Create a resource group |
| Remove-AzResourceGroup -Name <rg> -Force | Delete a resource group and its contents |
| Get-AzResource -ResourceGroupName <rg> | List the resources in a group |
| Get-AzVM -Status | List VMs with their power state |
| Start-AzVM -ResourceGroupName <rg> -Name <vm> | Start a VM |
| Stop-AzVM -ResourceGroupName <rg> -Name <vm> | Stop and deallocate a VM by default |
| Stop-AzVM -StayProvisioned | Stop the VM but keep it allocated |
| New-AzStorageAccount | Create a storage account |
| New-AzRoleAssignment -SignInName <user> -RoleDefinitionName <role> -Scope <scope> | Assign an RBAC role |
| New-AzResourceGroupDeployment -ResourceGroupName <rg> -TemplateFile <file> | Deploy a template into a resource group |
Core resource types
| Resource | What it is for |
|---|---|
| Management group | Container above subscriptions; policy and RBAC assigned here inherit downward |
| Subscription | Billing and quota boundary; holds resource groups |
| Resource group | Lifecycle container; every resource belongs to exactly one group |
| Virtual network | Private address space in one region |
| Subnet | A slice of the virtual network address space |
| Network security group | Allow and deny rules by source, destination, port and protocol; attach to a subnet or a NIC |
| NSG rule priority | Lower number is evaluated first; user rules use 100 to 4096 |
| Application security group | Groups NICs so NSG rules can name a group instead of IP addresses |
| Route table | User defined routes that override Azure system routes |
| Azure Bastion | RDP and SSH to VMs from the portal without a public IP on the VM |
| Load Balancer | Layer 4 distribution across a backend pool, public or internal |
| Application Gateway | Layer 7 routing by URL path or host, with an optional web application firewall |
| Availability set | Spreads VMs across fault domains and update domains inside one datacenter |
| Availability zone | Physically separate locations within one region |
| Virtual machine scale set | Identical VMs that scale out and in on a rule |
Storage services, tiers and redundancy
| Item | What it means |
|---|---|
| Blob storage | Object storage for unstructured data, organized in containers |
| Azure Files | Managed SMB and NFS shares you can mount from a client |
| Queue storage | Message store for decoupling application components |
| Table storage | NoSQL key attribute store for structured, non-relational data |
| Hot tier | Frequent access; highest storage cost, lowest access cost |
| Cool tier | Infrequent access; 30 day minimum retention before early deletion charges |
| Cold tier | Rarer access; 90 day minimum retention |
| Archive tier | Offline; 180 day minimum retention, and the blob must be rehydrated before it can be read |
| LRS | Three synchronous copies inside a single datacenter in the primary region |
| ZRS | Three synchronous copies across three availability zones in the primary region |
| GRS | LRS in the primary region plus asynchronous replication to a secondary region |
| GZRS | ZRS in the primary region plus asynchronous replication to a secondary region |
| RA-GRS and RA-GZRS | Same as GRS and GZRS, with read access to the secondary endpoint |
Built-in RBAC roles
| Role | What it grants |
|---|---|
| Owner | Full management of resources, including assigning roles to others |
| Contributor | Full management of resources, but cannot assign roles |
| Reader | View resources, change nothing |
| User Access Administrator | Manage who has access to resources, without managing the resources |
| Virtual Machine Contributor | Manage VMs, but not the virtual network or storage account they connect to |
| Network Contributor | Manage networking resources, but not access to them |
| Storage Blob Data Contributor | Read, write and delete blob data (data plane, not the account itself) |
| Storage Blob Data Reader | Read and list blob data |
| Role assignment | Security principal plus role definition plus scope; assignments inherit to child scopes |
Governance: policy, locks and tags
| Feature | What it does |
|---|---|
| Azure Policy | Evaluates resources against rules and acts on the result |
| Deny effect | Blocks the create or update request outright |
| Audit effect | Allows the request and records non-compliance |
| Append and Modify effects | Add or change fields such as tags on the resource being written |
| DeployIfNotExists | Deploys a related resource when the condition is not met; needs a managed identity |
| Initiative | A set of policy definitions assigned and reported as one unit |
| CanNotDelete lock | Read and modify allowed, delete blocked |
| ReadOnly lock | Read allowed, changes and deletes blocked |
| Lock inheritance | Locks apply to child scopes, and the most restrictive lock wins |
| Tags | Name and value pairs for cost reporting; child resources do not inherit them by default |
Ready to test yourself?
Memorizing a table is a start, practice questions make it stick.