Azure CLI cheat sheet

This sheet collects the Azure CLI commands that create and inspect networking, each copied from the official CLI reference examples so flag names are documented truth, not memory: az login, az group create, az network vnet create and az network vnet subnet create, plus az vm create and az vm list for the VM half of the story.

Azure CLI signs you in either through Web Account Manager (the desktop app) on Windows or a browser on Linux and macOS, with device-code login as the fallback. Subnet-focused steps in the Microsoft docs want CLI version 2.31.0 or later; check with az version and update with az upgrade. Everything here also runs in Azure Cloud Shell, which has the CLI preinstalled and pre-authenticated.

Three flags appear on every command: --output (or -o) with table, tsv, json, jsonc, yaml or none; --query for JMESPath filtering; and --subscription to target a subscription by name or ID. You can also pin defaults — az configure --defaults group=MyResourceGroup — so -g becomes optional.

Resource-group names and VNet names follow --name/-n with --resource-group/-g. Locations come from az account list-locations.

Sign in and pick a subscription

Interactive login (default: WAM on Windows, browser on Linux/macOS)

az login

# Headless or restricted environments: device-code flow
az login --use-device-code

# Keep the session pinned to one subscription (name or ID)
az account set -s NAME_OR_ID

# Service principal with client secret
az login --service-principal --username APP_ID --password CLIENT_SECRET --tenant TENANT_ID

# Service principal with certificate
az login --service-principal --username APP_ID --certificate /path/to/cert.pem --tenant TENANT_ID

# Managed identity (system-assigned)
az login --identity

Username/password login via az login --username ... --password ... exists but is documented as strongly discouraged and does not work with Microsoft accounts or accounts with two-factor authentication. Use interactive login, a service principal, or a managed identity instead.

Resource groups

Create, list, check and delete resource groups (all examples verbatim from the CLI reference)

# Create a new resource group in the West US region
az group create -l westus -n MyResourceGroup

# List all resource groups located in the West US region
az group list --query "[?location=='westus']"

# Check whether a resource group exists
az group exists -n MyResourceGroup

# Delete a resource group (add -y to skip the prompt)
az group delete -n MyResourceGroup

Required parameters for az group create

--location / -l: region for the group; values come from az account list-locations
--name / --resource-group / -n / -g: name of the new resource group

Virtual networks

Create a VNet — with the default address space, and with an explicit one

# Default address space 10.0.0.0/16 (per the CLI reference: --address-prefixes defaults to ['10.0.0.0/16'])
az network vnet create --resource-group myResourceGroup --name myVNet

# Explicit address space plus one subnet created at the same time
az network vnet create \
  -g MyResourceGroup -n MyVnet \
  --address-prefixes 10.0.0.0/16 \
  --subnet-name MySubnet --subnet-prefixes 10.0.0.0/24

# List, inspect, and replace the address space (this overrides previous ranges)
az network vnet list -g MyResourceGroup
az network vnet show -g MyResourceGroup -n MyVNet
az network vnet update --resource-group myResourceGroup --name myVNet --address-prefixes 10.1.0.0/16

# Delete a VNet (required to be empty)
az network vnet delete --resource-group myResourceGroup --name myVNet

az network vnet create parameters

--name / -n: VNet name (required)
--resource-group / -g: resource group (required)
--address-prefixes: space-separated CIDR list; default ['10.0.0.0/16']
--subnet-name, --subnet-prefixes: create one subnet alongside; prefixes omitted → auto-reserves a /24
--location / -l: region
--dns-servers: space-separated custom DNS list
--network-security-group / --nsg: NSG applied to the initial subnet

The CLI reference examples show --address-prefix (singular) in their VNet create sample; the documented parameter is --address-prefixes, which accepts a space-separated list. Both forms are seen in the wild, but --address-prefixes is the name to use going forward.

Subnets

Create, list, show, update and delete subnets

# Create a subnet with a custom range, NSG and route table
az network vnet subnet create \
  -g MyResourceGroup --vnet-name MyVnet -n MySubnet \
  --address-prefixes 10.0.0.0/24 \
  --network-security-group MyNsg --route-table MyRouteTable

# List the subnets in a VNet
az network vnet subnet list -g MyResourceGroup --vnet-name MyVNet

# Inspect a subnet
az network vnet subnet show -g MyResourceGroup -n MySubnet --vnet-name MyVNet

# Update (associate an NSG, attach a NAT gateway, change the range)
az network vnet subnet update -g MyResourceGroup -n MySubnet --vnet-name MyVNet --network-security-group MyNsg

# Delete a subnet (must contain no resources)
az network vnet subnet delete --name MySubnet --resource-group MyResourceGroup --vnet-name MyVnet

Required parameters are --name/-n, --resource-group/-g and --vnet-name. The smallest valid --address-prefixes value is /29 (8 addresses, 3 usable); Azure does not accept /31 or /32 subnets.

Subnet flag names that differ from the VNet command

--vnet-name: required on every subnet command
--address-prefixes: space-separated CIDR list for the subnet
--nsg / --network-security-group: attach an NSG (use --nsg null to detach)
--nat-gateway: attach a NAT gateway (use null to detach)

Virtual machines

Minimal create (minimal form per the CLI reference) and a realistic quick-start create

# Minimal: image alone is enough beyond -n and -g
az vm create -n MyVm -g MyResourceGroup --image Ubuntu2204

# Typical quick start: SSH keys generated, Standard public IP
export MY_RESOURCE_GROUP_NAME="myVMResourceGroup"
export MY_VM_NAME="myVM"
export MY_USERNAME="azureuser"
export MY_VM_IMAGE="Canonical:0001-com-ubuntu-minimal-jammy:minimal-22_04-lts-gen2:latest"
az vm create \
    --resource-group $MY_RESOURCE_GROUP_NAME \
    --name $MY_VM_NAME \
    --image $MY_VM_IMAGE \
    --admin-username $MY_USERNAME \
    --generate-ssh-keys \
    --public-ip-sku Standard

# List VMs (whole subscription, or one resource group)
az vm list
az vm list -g MyResourceGroup
az vm list --show-details

Frequently used az vm create flags (official reference)

--name / -n, --resource-group / -g: required
--image: URN or shorthand — examples in docs: Ubuntu2204, Debian11, Win2012R2Datacenter, RedHat:RHEL:7-RAW:7.4.2018010506
--admin-username: admin account, pair with --admin-password for password auth
--generate-ssh-keys: create and use SSH keys for the admin user
--authentication-type: all | password | ssh
--nsg-rule: SSH (default for Linux images) | RDP | NONE
--size: VM size, e.g. Standard_DS2_v2
--vnet-name, --subnet: place the NIC in an existing VNet/subnet

PowerShell equivalents

Cmdlets as documented in the Azure Virtual Network how-to docs — full names shown; aliases are not verified and are omitted.
Task	Cmdlet
Sign in	Connect-AzAccount
Create a VNet	New-AzVirtualNetwork -ResourceGroupName myResourceGroup -Name myVNet -Location eastus -AddressPrefix 10.0.0.0/16
List / inspect VNets	Get-AzVirtualNetwork [-ResourceGroupName myResourceGroup [-Name myVNet]]
Add a subnet config	Add-AzVirtualNetworkSubnetConfig -Name MySubnet -VirtualNetwork $vnet -AddressPrefix 10.0.0.0/24, then Set-AzVirtualNetwork
Update address space / DNS	Set-AzVirtualNetwork -VirtualNetwork $virtualNetwork
Remove a subnet	Remove-AzVirtualNetworkSubnetConfig -Name MySubnet -VirtualNetwork $vnet \| Set-AzVirtualNetwork
Delete a VNet	Remove-AzVirtualNetwork -ResourceGroupName myResourceGroup -Name myVNet

The alias forms New-AzVNet/Get-AzVNet are common in the field but were not verified against the cmdlet reference during authoring, so they are not listed here. The pattern to remember: New-AzVirtualNetwork takes -AddressPrefix (a string, not a list on this cmdlet), while subnet configuration is added with Add-AzVirtualNetworkSubnetConfig and persisted with Set-AzVirtualNetwork.

FAQ

How do I log in to Azure CLI?

Run az login. Azure CLI uses Web Account Manager on Windows and browser-based login on Linux/macOS, falling back to device-code login when no browser is available. In restricted environments, force that flow with az login --use-device-code and copy the URL and code it prints.

What command creates a VNet in Azure CLI?

az network vnet create with --name and --resource-group, plus --address-prefixes for your CIDR list (the default is 10.0.0.0/16). Add --subnet-name and --subnet-prefixes to create a subnet in the same run, or run az network vnet subnet create separately with --vnet-name.

How do I list VMs with Azure CLI?

az vm list without flags lists VMs across the subscription; az vm list -g MyResourceGroup limits to a resource group. Add --show-details for richer output, and --query plus -o table for compact views.

Which flag sets the subnet address range in Azure CLI?

--address-prefixes on az network vnet subnet create (also accepted by the update command), as a space-separated list of CIDR blocks. The other required flags are --name, --resource-group and --vnet-name. The smallest accepted subnet is /29.

IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
VLSM calculator — split a block into right-sized subnets by host requirements.