# Azure CLI cheat sheet: VNet, subnet, VM commands

> Verified Azure CLI: az login, az group create, az network vnet create with --address-prefixes, subnet create, az vm create and az vm list.

- Page URL: https://itinsighthub.com/azure/cli/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# Azure CLI cheat sheet

This sheet collects the Azure CLI commands that create and inspect networking, each copied from the official CLI reference examples so flag names are documented truth, not memory: `az login`, `az group create`, `az network vnet create` and `az network vnet subnet create`, plus `az vm create` and `az vm list` for the VM half of the story.

Azure CLI signs you in either through Web Account Manager (the desktop app) on Windows or a browser on Linux and macOS, with device-code login as the fallback. Subnet-focused steps in the Microsoft docs want CLI version 2.31.0 or later; check with `az version` and update with `az upgrade`. Everything here also runs in [Azure Cloud Shell](https://shell.azure.com), which has the CLI preinstalled and pre-authenticated.

Three flags appear on every command: `--output` (or `-o`) with `table`, `tsv`, `json`, `jsonc`, `yaml` or `none`; `--query` for JMESPath filtering; and `--subscription` to target a subscription by name or ID. You can also pin defaults — `az configure --defaults group=MyResourceGroup` — so `-g` becomes optional.

Resource-group names and VNet names follow `--name`/`-n` with `--resource-group`/`-g`. Locations come from `az account list-locations`.

Published August 22, 2026

## Sign in and pick a subscription

Interactive login (default: WAM on Windows, browser on Linux/macOS)

```
az login

# Headless or restricted environments: device-code flow
az login --use-device-code

# Keep the session pinned to one subscription (name or ID)
az account set -s NAME_OR_ID

# Service principal with client secret
az login --service-principal --username APP_ID --password CLIENT_SECRET --tenant TENANT_ID

# Service principal with certificate
az login --service-principal --username APP_ID --certificate /path/to/cert.pem --tenant TENANT_ID

# Managed identity (system-assigned)
az login --identity
```

Username/password login via az login --username ... --password ... exists but is documented as strongly discouraged and does not work with Microsoft accounts or accounts with two-factor authentication. Use interactive login, a service principal, or a managed identity instead.

## Resource groups

Create, list, check and delete resource groups (all examples verbatim from the CLI reference)

```
# Create a new resource group in the West US region
az group create -l westus -n MyResourceGroup

# List all resource groups located in the West US region
az group list --query "[?location=='westus']"

# Check whether a resource group exists
az group exists -n MyResourceGroup

# Delete a resource group (add -y to skip the prompt)
az group delete -n MyResourceGroup
```

Required parameters for az group create

- **--location / -l:** region for the group; values come from az account list-locations
- **--name / --resource-group / -n / -g:** name of the new resource group

## Virtual networks

Create a VNet — with the default address space, and with an explicit one

```
# Default address space 10.0.0.0/16 (per the CLI reference: --address-prefixes defaults to ['10.0.0.0/16'])
az network vnet create --resource-group myResourceGroup --name myVNet

# Explicit address space plus one subnet created at the same time
az network vnet create \
  -g MyResourceGroup -n MyVnet \
  --address-prefixes 10.0.0.0/16 \
  --subnet-name MySubnet --subnet-prefixes 10.0.0.0/24

# List, inspect, and replace the address space (this overrides previous ranges)
az network vnet list -g MyResourceGroup
az network vnet show -g MyResourceGroup -n MyVNet
az network vnet update --resource-group myResourceGroup --name myVNet --address-prefixes 10.1.0.0/16

# Delete a VNet (required to be empty)
az network vnet delete --resource-group myResourceGroup --name myVNet
```

az network vnet create parameters

- **--name / -n:** VNet name (required)
- **--resource-group / -g:** resource group (required)
- **--address-prefixes:** space-separated CIDR list; default ['10.0.0.0/16']
- **--subnet-name, --subnet-prefixes:** create one subnet alongside; prefixes omitted → auto-reserves a /24
- **--location / -l:** region
- **--dns-servers:** space-separated custom DNS list
- **--network-security-group / --nsg:** NSG applied to the initial subnet

The CLI reference examples show --address-prefix (singular) in their VNet create sample; the documented parameter is --address-prefixes, which accepts a space-separated list. Both forms are seen in the wild, but --address-prefixes is the name to use going forward.

## Subnets

Create, list, show, update and delete subnets

```
# Create a subnet with a custom range, NSG and route table
az network vnet subnet create \
  -g MyResourceGroup --vnet-name MyVnet -n MySubnet \
  --address-prefixes 10.0.0.0/24 \
  --network-security-group MyNsg --route-table MyRouteTable

# List the subnets in a VNet
az network vnet subnet list -g MyResourceGroup --vnet-name MyVNet

# Inspect a subnet
az network vnet subnet show -g MyResourceGroup -n MySubnet --vnet-name MyVNet

# Update (associate an NSG, attach a NAT gateway, change the range)
az network vnet subnet update -g MyResourceGroup -n MySubnet --vnet-name MyVNet --network-security-group MyNsg

# Delete a subnet (must contain no resources)
az network vnet subnet delete --name MySubnet --resource-group MyResourceGroup --vnet-name MyVnet
```

Required parameters are --name/-n, --resource-group/-g and --vnet-name. The smallest valid --address-prefixes value is /29 (8 addresses, 3 usable); Azure does not accept /31 or /32 subnets.

Subnet flag names that differ from the VNet command

- **--vnet-name:** required on every subnet command
- **--address-prefixes:** space-separated CIDR list for the subnet
- **--nsg / --network-security-group:** attach an NSG (use --nsg null to detach)
- **--nat-gateway:** attach a NAT gateway (use null to detach)

## Virtual machines

Minimal create (minimal form per the CLI reference) and a realistic quick-start create

```
# Minimal: image alone is enough beyond -n and -g
az vm create -n MyVm -g MyResourceGroup --image Ubuntu2204

# Typical quick start: SSH keys generated, Standard public IP
export MY_RESOURCE_GROUP_NAME="myVMResourceGroup"
export MY_VM_NAME="myVM"
export MY_USERNAME="azureuser"
export MY_VM_IMAGE="Canonical:0001-com-ubuntu-minimal-jammy:minimal-22_04-lts-gen2:latest"
az vm create \
    --resource-group $MY_RESOURCE_GROUP_NAME \
    --name $MY_VM_NAME \
    --image $MY_VM_IMAGE \
    --admin-username $MY_USERNAME \
    --generate-ssh-keys \
    --public-ip-sku Standard

# List VMs (whole subscription, or one resource group)
az vm list
az vm list -g MyResourceGroup
az vm list --show-details
```

Frequently used az vm create flags (official reference)

- **--name / -n, --resource-group / -g:** required
- **--image:** URN or shorthand — examples in docs: Ubuntu2204, Debian11, Win2012R2Datacenter, RedHat:RHEL:7-RAW:7.4.2018010506
- **--admin-username:** admin account, pair with --admin-password for password auth
- **--generate-ssh-keys:** create and use SSH keys for the admin user
- **--authentication-type:** all | password | ssh
- **--nsg-rule:** SSH (default for Linux images) | RDP | NONE
- **--size:** VM size, e.g. Standard_DS2_v2
- **--vnet-name, --subnet:** place the NIC in an existing VNet/subnet

## PowerShell equivalents

*Cmdlets as documented in the Azure Virtual Network how-to docs — full names shown; aliases are not verified and are omitted.*

| Task | Cmdlet |
| --- | --- |
| Sign in | Connect-AzAccount |
| Create a VNet | New-AzVirtualNetwork -ResourceGroupName myResourceGroup -Name myVNet -Location eastus -AddressPrefix 10.0.0.0/16 |
| List / inspect VNets | Get-AzVirtualNetwork [-ResourceGroupName myResourceGroup [-Name myVNet]] |
| Add a subnet config | Add-AzVirtualNetworkSubnetConfig -Name MySubnet -VirtualNetwork $vnet -AddressPrefix 10.0.0.0/24, then Set-AzVirtualNetwork |
| Update address space / DNS | Set-AzVirtualNetwork -VirtualNetwork $virtualNetwork |
| Remove a subnet | Remove-AzVirtualNetworkSubnetConfig -Name MySubnet -VirtualNetwork $vnet \| Set-AzVirtualNetwork |
| Delete a VNet | Remove-AzVirtualNetwork -ResourceGroupName myResourceGroup -Name myVNet |

The alias forms New-AzVNet/Get-AzVNet are common in the field but were not verified against the cmdlet reference during authoring, so they are not listed here. The pattern to remember: New-AzVirtualNetwork takes -AddressPrefix (a string, not a list on this cmdlet), while subnet configuration is added with Add-AzVirtualNetworkSubnetConfig and persisted with Set-AzVirtualNetwork.

## References

- [Get started with Azure CLI](https://learn.microsoft.com/en-us/cli/azure/get-started-with-azure-cli) — install, sign-in and subscription selection.
- [az network vnet](https://learn.microsoft.com/en-us/cli/azure/network/vnet) — full parameter reference for the commands used here.

## FAQ

**How do I log in to Azure CLI?**

Run az login. Azure CLI uses Web Account Manager on Windows and browser-based login on Linux/macOS, falling back to device-code login when no browser is available. In restricted environments, force that flow with az login --use-device-code and copy the URL and code it prints.

**What command creates a VNet in Azure CLI?**

az network vnet create with --name and --resource-group, plus --address-prefixes for your CIDR list (the default is 10.0.0.0/16). Add --subnet-name and --subnet-prefixes to create a subnet in the same run, or run az network vnet subnet create separately with --vnet-name.

**How do I list VMs with Azure CLI?**

az vm list without flags lists VMs across the subscription; az vm list -g MyResourceGroup limits to a resource group. Add --show-details for richer output, and --query plus -o table for compact views.

**Which flag sets the subnet address range in Azure CLI?**

--address-prefixes on az network vnet subnet create (also accepted by the update command), as a space-separated list of CIDR blocks. The other required flags are --name, --resource-group and --vnet-name. The smallest accepted subnet is /29.

## Related tools

- [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/) — break any CIDR block into network, range, broadcast and usable hosts.
- [IP range to CIDR](https://itinsighthub.com/ip-range-to-cidr/) — turn an arbitrary address range into its minimal covering CIDR blocks.
- [VLSM calculator](https://itinsighthub.com/vlsm-calculator/) — split a block into right-sized subnets by host requirements.

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)