> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/cloud/microsoft-azure/azure-cli.md).

# Azure CLI

The Azure Command-Line Interface (CLI) is a cross-platform command-line tool to connect to Azure and execute administrative commands on Azure resources. It allows the execution of commands through a terminal using interactive command-line prompts or a script.

For interactive use, you first launch a shell such as cmd.exe on Windows, or Bash on Linux or macOS, and then issue a command at the shell prompt. To automate repetitive tasks, you assemble the CLI commands into a shell script using the script syntax of your chosen shell, and then you execute the script.

You can [install the Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest) locally on Linux, macOS, or Windows computers. It can also be used from a browser through the [Azure Cloud Shell](https://ms.portal.azure.com/#cloudshell/) or run from inside a Docker container.

## Installation

### Linux Installation

Install with

```bash
sudo apt install azure-cli
```

## Connect / Login

Login with username and password

```bash
az login -u phisher@4rhdc6.onmicrosoft.com -p PhishingAllTheTime19273!! --allow-no-subscriptions
```

## AD Enumeration

### List AD groups

List groups with JSON output

```bash
az ad group list
```

List groups with table output

```bash
az ad group list -o table
```

### List Service Principles

List all service principles

```bash
az ad sp list --all
```

List all service principles with `flag{` in their notes

```bash
az ad sp list --all --query "[?contains(to_string(notes),'flag{')].[displayName,notes]"
```

Note sure if the above syntax is correct!

## Usage Information

<details>

<summary>az -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ az -h

Group
    az

Subgroups:
    account                 : Manage Azure subscription information.
    acr                     : Manage private registries with Azure Container Registries.
    ad                      : Manage Microsoft Entra ID (formerly known as Azure Active Directory,
                              Azure AD, AAD) entities needed for Azure role-based access control
                              (Azure RBAC) through Microsoft Graph API.
    advisor                 : Manage Azure Advisor.
    afd                     : Manage Azure Front Door Standard/Premium.
    aks                     : Azure Kubernetes Service.
    ams                     : Manage Azure Media Services resources.
    apim                    : Manage Azure API Management services.
    appconfig               : Manage App Configurations.
    appservice              : Manage App Service plans.
    aro                     : Manage Azure Red Hat OpenShift clusters.
    artifacts               : Manage Azure Artifacts.
    backup                  : Manage Azure Backups.
    batch                   : Manage Azure Batch.
    bicep                   : Bicep CLI command group.
    billing                 : Manage Azure Billing.
    boards                  : Manage Azure Boards.
    bot                     : Manage Microsoft Azure Bot Service.
    cache                   : Commands to manage CLI objects cached using the `--defer` argument.
    capacity                : Manage capacity.
    cdn                     : Manage Azure Content Delivery Networks (CDNs).
    cloud                   : Manage registered Azure clouds.
    cognitiveservices       : Manage Azure Cognitive Services accounts.
    compute-fleet [Preview] : Manage for Azure Compute Fleet.
    compute-recommender     : Manage sku/zone/region recommender info for compute resources.
    config   [Experimental] : Manage Azure CLI configuration.
    connection              : Commands to manage Service Connector local connections which allow
                              local environment to connect Azure Resource. If you want to manage
                              connection for compute service, please run 'az
                              webapp/containerapp/spring connection'.
    consumption   [Preview] : Manage consumption of Azure resources.
    container               : Manage Azure Container Instances.
    containerapp            : Manage Azure Container Apps.
    cosmosdb                : Manage Azure Cosmos DB database accounts.
    data-boundary           : Data boundary operations.
    databoxedge             : Manage device with databoxedge.
    deployment              : Manage Azure Resource Manager template deployment at subscription
                              scope.
    deployment-scripts      : Manage deployment scripts at subscription or resource group scope.
    devops                  : Manage Azure DevOps organization level operations.
    disk                    : Manage Azure Managed Disks.
    disk-access             : Manage disk access resources.
    disk-encryption-set     : Disk Encryption Set resource.
    dls           [Preview] : Manage Data Lake Store accounts and filesystems.
    dms                     : Manage Azure Data Migration Service (classic) instances.
    eventgrid               : Manage Azure Event Grid topics, domains, domain topics, system topics
                              partner topics, event subscriptions, system topic event subscriptions
                              and partner topic event subscriptions.
    eventhubs               : Eventhubs.
    extension               : Manage and update CLI extensions.
    feature                 : Manage resource provider features.
    functionapp             : Manage function apps. To install the Azure Functions Core tools see
                              https://github.com/Azure/azure-functions-core-tools.
    group                   : Manage resource groups and template deployments.
    hdinsight               : Manage HDInsight resources.
    identity                : Manage Managed Identity.
    image                   : Manage custom virtual machine images.
    keyvault                : Manage KeyVault keys, secrets, and certificates.
    lab           [Preview] : Manage azure devtest labs.
    lock                    : Manage Azure locks.
    logicapp                : Manage logic apps.
    managed-cassandra       : Azure Managed Cassandra.
    managedapp              : Manage template solutions provided and maintained by Independent
                              Software Vendors (ISVs).
    managedservices         : Manage the registration assignments and definitions in Azure.
    maps                    : Manage Azure Maps.
    mysql
    netappfiles             : Manage Azure NetApp Files (ANF) Resources.
    network                 : Manage Azure Network resources.
    pipelines               : Manage Azure Pipelines.
    policy                  : Manage resources defined and used by the Azure Policy service.
    ppg                     : Manage Proximity Placement Groups.
    private-link            : Private-link association CLI command group.
    provider                : Manage resource providers.
    redis                   : Manage dedicated Redis caches for your Azure applications.
    relay                   : Manage Azure Relay Service namespaces, WCF relays, hybrid connections,
                              and rules.
    repos                   : Manage Azure Repos.
    resource                : Manage Azure resources.
    resourcemanagement      : Resourcemanagement CLI command group.
    restore-point           : Manage restore point with res.
    role                    : Manage Azure role-based access control (Azure RBAC).
    search                  : Manage Search.
    security                : Manage your security posture with Microsoft Defender for Cloud.
    servicebus              : Servicebus.
    sf                      : Manage and administer Azure Service Fabric clusters.
    sig                     : Manage shared image gallery.
    signalr                 : Manage Azure SignalR Service.
    snapshot                : Manage point-in-time copies of managed disks, native blobs, or other
                              snapshots.
    sql                     : Manage Azure SQL Databases and Data Warehouses.
    sshkey                  : Manage ssh public key with vm.
    stack                   : A deployment stack is a native Azure resource type that enables you to
                              perform operations on a resource collection as an atomic unit.
    staticwebapp            : Manage static apps.
    storage                 : Manage Azure Cloud Storage resources.
    synapse                 : Manage and operate Synapse Workspace, Spark Pool, SQL Pool.
    tag                     : Tag Management on a resource.
    term     [Experimental] : Manage marketplace agreement with marketplaceordering.
    ts                      : Manage template specs at subscription or resource group scope.
    vm                      : Manage Linux or Windows virtual machines.
    vmss                    : Manage groupings of virtual machines in an Azure Virtual Machine Scale
                              Set (VMSS).
    webapp                  : Manage web apps.

Commands:
    configure               : Manage Azure CLI configuration. This command is interactive.
    feedback                : Send feedback to the Azure CLI Team.
    find                    : I'm an AI robot, my advice is based on our Azure documentation as well
                              as the usage patterns of Azure CLI and Azure ARM users. Using me
                              improves Azure products and documentation.
    interactive   [Preview] : Start interactive mode. Installs the Interactive extension if
                              not installed already.
    login                   : Log in to Azure.
    logout                  : Log out to remove access to Azure subscriptions.
    rest                    : Invoke a custom request.
    survey                  : Take Azure CLI survey.
    upgrade       [Preview] : Upgrade Azure CLI and extensions.
    version                 : Show the versions of Azure CLI modules and extensions in JSON format
                              by default or format configured by --output.

To search AI knowledge base for examples, use: az find "az "


```

</details>

## Resources

Azure-CLI - GitHub: <https://github.com/Azure/azure-cli>

Azure Command-Line Interface (CLI) documentation - Microsoft Learn: [https://learn.microsoft.com/en-us/cli/azure/](https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest)

Microsoft Entra ID - Wikipedia: <https://en.wikipedia.org/wiki/Entra_ID>