How do I install the Azure CLI skill?

Run npx skillmds@latest add alivirgo/azure-cli in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Azure CLI skill do?

Operational skill for agents to manage Microsoft Azure via az CLI - subscriptions, resource groups, AKS, App Service, Key Vault, and RBAC hygiene. It is listed under DevOps & Infra on SkillMD.

Is Azure CLI safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Azure CLI?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Azure CLI free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Azure CLI?

alivirgo (@alivirgo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Azure CLI by alivirgo — Agent Skill

Name: Azure CLI
Author: alivirgo

Azure CLI (az) AI Skill Guide

Overview

The Azure CLI (az) talks to Azure Resource Manager (ARM). Work is scoped by subscription and usually grouped under a resource group. Agents should always resolve tenant, subscription, and default location before mutating resources - Azure errors often look like "NotFound" when the real issue is the wrong subscription context.

az login / identity
        |
        v
+-------------------+     +--------------------+
| Subscription      | --> | Resource groups    |
| Tenant / RBAC     |     | AKS / App Service  |
+-------------------+     | Storage / Key Vault|
                          +--------------------+

When to use

Creating resource groups, App Services, AKS clusters, or storage accounts
Wiring managed identities and role assignments
Fetching AKS kubeconfig or App Service logs
Scripting ARM-friendly deployments without full Bicep/Terraform yet

Operational directives

Start every session with az account show and az account list -o table.
Prefer explicit --resource-group / --subscription on write commands.
Use managed identities over client secrets when the platform supports it.
Prefer --output json for scripting; use JMESPath --query instead of fragile greps.
Never print Key Vault secret values into chat or CI logs unless the user explicitly needs them redacted.

Concrete examples

Account and defaults

az login
az account set --subscription "Prod Engineering"
az configure --defaults group=rg-prod-api location=eastus
az account show --query "{name:name, id:id, tenant:tenantId}" -o json

Resource group + App Service

az group create -n rg-prod-api -l eastus
az appservice plan create -g rg-prod-api -n plan-api --sku P1v3 --is-linux
az webapp create -g rg-prod-api -p plan-api -n app-api-prod --runtime "NODE:20-lts"
az webapp config appsettings set -g rg-prod-api -n app-api-prod \
  --settings WEBSITE_NODE_DEFAULT_VERSION=20

AKS credentials

az aks get-credentials -g rg-prod-api -n aks-prod --overwrite-existing
az aks show -g rg-prod-api -n aks-prod --query "powerState.code" -o tsv

RBAC with managed identity

PRINCIPAL=$(az identity show -g rg-prod-api -n id-api --query principalId -o tsv)
az role assignment create \
  --assignee-object-id "$PRINCIPAL" \
  --assignee-principal-type ServicePrincipal \
  --role "AcrPull" \
  --scope /subscriptions/<sub>/resourceGroups/rg-prod-api/providers/Microsoft.ContainerRegistry/registries/acrprod

Extension and query tips

Goal	Pattern
Filter list	`az webapp list -g rg --query "[].{name:name, state:state}" -o table`
Wait for ready	`az webapp show ... --query state -o tsv` in a retry loop
Install extension	`az extension add --name <name>` then pin in docs
What-if deploy	Prefer Bicep/ARM what-if for large templates

Best practices

Name resources with a consistent scheme (rg-<env>-<app>, aks-<env>).
Lock production resource groups against accidental delete when policy allows.
Prefer Key Vault references for App Service secrets over plain app settings.
Document required CLI version and extensions in the repo README.

Limitations

az imperative scripts drift; graduate shared infra to Bicep/Terraform/Pulumi.
Cross-tenant and Azure AD permission prompts may need interactive login (hard in headless CI).
Some preview features require extension versions that break older pipelines.

Related skills

kubernetes - AKS workload operations after get-credentials
vault - compare with Key Vault secret workflows
docker - images for ACR / App Service containers
gcloud-cli - analogous multi-cloud CLI patterns

Azure CLI

File contents