Introduction to Azure

Azure organizes everything under a subscription — the billing and access boundary tied to an Azure AD tenant — and inside a subscription, resource groups collect related resources so you can manage, tag, and delete them together. A VM, its disk, its network interface, and its public IP are usually four separate resources living in one resource group; deleting the group deletes all four.

Azure’s local-emulator story is thinner than AWS’s LocalStack. Azurite emulates Blob, Queue, and Table storage, and Functions Core Tools run functions locally, but VMs, networking, and most PaaS services have no local stand-in. This track runs against a real subscription — the free tier covers every example here, as long as you clean up resource groups when you’re done with them.

Installing the CLI and logging in

az version

$ az version
{
  "azure-cli": "2.65.0",
  "azure-cli-core": "2.65.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {}
}

az login

$ az login
A web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize.
Please continue the login in the web browser. If no web browser is available or if the web
browser fails to open, use device code flow with `az login --use-device-code`.

Retrieving tenants and subscriptions for the selection...

[Tenant and subscription selection]

No     Subscription name        Subscription ID                       Tenant
-----  -----------------------  ------------------------------------  ----------------
[1] *  Azure subscription 1     3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33  Default Directory

The default is marked with an *; the default tenant is 'Default Directory' and subscription
is 'Azure subscription 1' (3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33).

[Announcements]
With the new Azure CLI Login Experience, you can select the subscription you want to use more
easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271236

"az login" completed successfully. Output of "az account list" stored to
"C:\Users\reader\.azure\azureProfile.json".

az login opens a browser, authenticates against Azure AD, and — because this account has only one subscription — picks it as the default automatically. With more than one subscription, the CLI prompts you to choose, or you switch later with az account set.

Confirming which subscription is active

az account show --output table

$ az account show --output table
EnvironmentName    HomeTenantId                          IsDefault    Name                  State    TenantId
-----------------  ------------------------------------  -----------  --------------------  -------  ------------------------------------
AzureCloud         a1e4f6b2-8c3d-4f19-b7e2-5d9c1a0f3e88  True         Azure subscription 1  Enabled  a1e4f6b2-8c3d-4f19-b7e2-5d9c1a0f3e88

IsDefault: True matters more than it looks — every command that doesn’t pass --subscription runs against this subscription. On an account with a production subscription and a sandbox one, running az vm create right after a login without checking this is how you provision test resources into production billing.

Creating a resource group

Every resource you create in this track needs a resource group to live in. Groups are scoped to a region (Azure calls it a “location”) at creation time, though the resources inside can span regions.

az group create --name learn-rg --location eastus

$ az group create --name learn-rg --location eastus
{
  "id": "/subscriptions/3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33/resourceGroups/learn-rg",
  "location": "eastus",
  "managedBy": null,
  "name": "learn-rg",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

az group list --output table

$ az group list --output table
Name       Location    Status
---------  ----------  ---------
learn-rg   eastus      Succeeded

az group create returns immediately with provisioningState: Succeeded because creating an empty folder is instant — the wait only shows up once you start putting billable resources inside it. Keep this resource-group name; every following lesson in this track creates resources inside learn-rg so a single az group delete at the end tears down everything.

Practice

az account list --output table

$ az account list --output table
Name                  CloudName    SubscriptionId                        TenantId                              State    IsDefault
--------------------  -----------  ------------------------------------  ------------------------------------  -------  -----------
Azure subscription 1  AzureCloud   3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33  a1e4f6b2-8c3d-4f19-b7e2-5d9c1a0f3e88  Enabled  True

az account set --subscription "3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33"
az account show --query name --output tsv

$ az account set --subscription "3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33"
$ az account show --query name --output tsv
Azure subscription 1

az group update --name learn-rg --tags owner=reader environment=learning

$ az group update --name learn-rg --tags owner=reader environment=learning
{
  "id": "/subscriptions/3b1f9c2a-6d4e-4a7b-9c11-2f5e8a0b7d33/resourceGroups/learn-rg",
  "location": "eastus",
  "name": "learn-rg",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": {
    "environment": "learning",
    "owner": "reader"
  },
  "type": "Microsoft.Resources/resourceGroups"
}

az group create --name broken-rg --location us-nowhere

$ az group create --name broken-rg --location us-nowhere
ERROR: InvalidLocationCriteria: The location 'us-nowhere' is not a valid subscription location. The
Get-AzLocation cmdlet (Azure PowerShell) or `az account list-locations` (Azure CLI) can be used to
get the list of valid locations.

az account list-locations --query "[].name" --output tsv

$ az account list-locations --query "[].name" --output tsv
eastus
eastus2
westus
westus2
westeurope
northeurope
southeastasia
uksouth
...

Next: Entra ID — creating a role assignment, and the authorization error you get when you scope it wrong.