# Az CLI

> Use for Azure control-plane validation during authorized pentests. Trigger on credentialed Azure review, role and subscription checks, storage exposure review, and verifying what an approved Azure identity can access.

- Skill: `timsonner/az-cli` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/az-cli`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/az-cli/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/az-cli

---


# Azure CLI

## Purpose

Use this skill for tightly scoped Azure control-plane validation with approved tenant or subscription access.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to confirm the scope of an approved Azure identity.
- Need to inspect subscriptions, roles, or exposed resources.
- Need a low-impact retest after Azure remediation.

## Avoid When

- Tenant, subscription, or identity scope is unclear.
- Commands would change state without explicit approval.

## Inputs

- Approved tenant or subscription
- Authorized identity context
- Read-only versus mutating boundaries

## Procedure

1. Confirm the active account, tenant, and subscription.
2. Query only the services relevant to the current hypothesis.
3. Keep validation read-oriented unless stronger actions are explicitly approved.
4. Tie material exposure to real business services.
5. Preserve the exact account and subscription scope for retest.

## Command Syntax

Replace sample subscription values with approved in-scope values.

```bash
# Authenticate with device code flow
az login --use-device-code

# Show current identity and subscription
az account show

# List all subscriptions
az account list --output table

# List resource groups
az group list --output table

# List virtual machines
az vm list --output table

# List storage accounts
az storage account list --subscription '<subscription-id>' -o table

# List containers in a storage account
az storage container list --account-name contosoprod --output table

# List Key Vault secrets
az keyvault secret list --vault-name contoso-prod-kv --output table

# Get IAM role assignments
az role assignment list --output table
```

## Evidence to Capture

- Effective Azure identity and subscription scope
- Material resource exposure or role boundary issues
- Exact account and subscription context used

## Safety Boundaries

- Default to read-only validation.
- Do not mutate resources or roles without explicit written approval.