Get-Command *route*                         # find a commandGet-Help Test-NetConnection -Examples       # examplesGet-History ; Invoke-History <nr>           # history(Get-PSReadLineOption).HistorySavePath      # file with the full history (old sessions too)Select-String -Path (Get-PSReadLineOption).HistorySavePath -Pattern "<text>"     # search the history<command> | Set-Clipboard                   # output to the clipboard<command> | Out-GridView                    # table with filter (Windows)<command> | Export-Csv .\out.csv -NoTypeInformation -Encoding UTF8<command> | ConvertTo-Json -Depth 5 | Set-Content .\out.json<command> | Select-Object -First 5<command> | Where-Object Name -like "*<part>*"<command> | Format-Table -AutoSizeMeasure-Command { <command> }               # measure runtimeStart-Transcript .\session.log ; Stop-Transcript     # record the whole sessioncode .                                      # open the current folder in VS Codeexplorer .                                  # open in Explorerwinget upgrade --all                        # update all tools (az, terraform, git …)

# Recent changes in the affected environmentaz monitor activity-log list -g <rg> --offset 4h `  --query "[?status.value=='Succeeded'].{time:eventTimestamp, who:caller, what:operationName.localizedValue}" -o table # State of the most important resourcesaz vm list -d -g <rg> --query "[].{name:name, state:powerState}" -o tableaz network application-gateway show-backend-health -g <rg> -n <agw> `  --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{server:address, health:health}" -o table

# 1. DNSResolve-DnsName <name>                                            # right IP? private or public? # 2. Port from the clientTest-NetConnection <target> -Port <port> # 3. Route from Azure's point of viewaz network watcher show-next-hop -g <rg> --vm <source-vm> --source-ip <source-ip> --dest-ip <target-ip> -o tableaz network nic show-effective-route-table -g <rg> -n <nic> -o table # 4. NSGaz network watcher test-ip-flow -g <rg> --vm <vm> --direction Inbound --protocol TCP --local <vm-ip>:<port> --remote <source>:12345

get system status                                   # running, license ok?get system ha status                                # did a failover happen?diagnose sniffer packet any 'host <target-ip>' 4 20 # does traffic arrive and leave?# if it doesn't leave -> debug flow (why dropped):diagnose debug flow filter addr <target-ip>diagnose debug flow trace start 10diagnose debug enablediagnose debug disable ; diagnose debug reset

ss -tlnp | grep <port>                   # is the service listening?sudo systemctl status <service>sudo journalctl -u <service> -n 50

az loginaz login --tenant <tenant-id>                       # with several tenantsConnect-AzAccountConnect-AzAccount -Tenant <tenant-id>

az login --use-device-codeaz login --use-device-code --tenant <tenant-id>az login --use-device-code --allow-no-subscriptions  # tenant without subscription (e.g. Entra ID only)Connect-AzAccount -UseDeviceAuthenticationConnect-AzAccount -UseDeviceAuthentication -Tenant <tenant-id>

az login --service-principal `  --username <app-id> `  --password <client-secret> `  --tenant <tenant-id> # better: keep the secret out of the history – prompt instead of typing it$secret = Read-Host "Client secret" -AsSecureString$plain  = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($secret))az login --service-principal --username <app-id> --password $plain --tenant <tenant-id>Remove-Variable plain # PowerShell (Az module)$cred = Get-Credential -UserName <app-id> -Message "Client secret as password"Connect-AzAccount -ServicePrincipal -Credential $cred -Tenant <tenant-id>

az login --service-principal --username <app-id> --password .\sp-cert.pem --tenant <tenant-id>   # PEM incl. private key (newer CLI: --certificate)Connect-AzAccount -ServicePrincipal -ApplicationId <app-id> -CertificateThumbprint <thumbprint> -Tenant <tenant-id>

az login --identityaz login --identity --username <client-id>          # user-assigned identity (newer CLI: --client-id)Connect-AzAccount -IdentityConnect-AzAccount -Identity -AccountId <client-id>

az account show -o tableGet-AzContextaz logout ; az account clearDisconnect-AzAccount ; Clear-AzContext -Force

$sub = "<subscription-name-or-id>"az account set --subscription $subSet-AzContext -Subscription $subaz account show --query "{name:name, id:id}" -o table(Get-AzContext).Subscription.Name

az extension add -n resource-graph$part = "<name-part>"az graph query -q "Resources | where name contains '$part' | project name, type, resourceGroup, subscriptionId" -o table# then switch to the right subscriptionaz account set --subscription <subscription-id-from-result>az resource show --ids <resource-id>

$rg = "<rg>"az monitor activity-log list -g $rg --offset 24h `  --query "[?status.value=='Succeeded'].{time:eventTimestamp, who:caller, what:operationName.localizedValue, resource:resourceId}" -o table# deletions onlyaz monitor activity-log list -g $rg --offset 7d `  --query "[?contains(operationName.value,'delete')].{time:eventTimestamp, who:caller, resource:resourceId}" -o table

$rg = "<rg>" ; $loc = "<region>"az group create -n $rg -l $loc --tags Owner=<name> environment=<dev|test|prod> costcenter=<cost-center>az lock create -n lock-$rg -g $rg --lock-type CanNotDelete --notes "Protection against accidental deletion"az group show -n $rg --query tagsaz lock list -g $rg -o table

$AppGW    = Get-AzApplicationGateway -Name <agw-name> -ResourceGroupName <rg-agw>$cert     = Get-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <certificate-name>$listener = Get-AzApplicationGatewayHttpListener   -ApplicationGateway $AppGW -Name <listener-name>$listener.SslCertificate = $certSet-AzApplicationGateway -ApplicationGateway $AppGW

# Which certificates exist and where do they come from?$AppGW = Get-AzApplicationGateway -Name <agw-name> -ResourceGroupName <rg-agw>$AppGW.SslCertificates | Select Name, KeyVaultSecretId, ProvisioningState # Switch to a new Key Vault source$AppGW = Set-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <certificate-name> -KeyVaultSecretId <new-secret-id>Set-AzApplicationGateway -ApplicationGateway $AppGW # Remove a certificate that is no longer used (detach from all listeners first)$AppGW = Remove-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <old-name>Set-AzApplicationGateway -ApplicationGateway $AppGW

az keyvault certificate import --vault-name <keyvault-name> -n <certificate-name> -f .\cert.pfx --password <pfx-password>az keyvault certificate show --vault-name <keyvault-name> -n <certificate-name> --query "{expires:attributes.expires, sid:sid}"# PowerShell$pw = Read-Host "PFX password" -AsSecureStringImport-AzKeyVaultCertificate -VaultName <keyvault-name> -Name <certificate-name> -FilePath .\cert.pfx -Password $pw

$rg = "<rg-agw>" ; $agw = "<agw>"az network application-gateway show-backend-health -g $rg -n $agw `  --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{server:address, health:health, log:healthProbeLog}" -o tableaz network application-gateway http-settings list -g $rg --gateway-name $agw `  --query "[].{name:name, port:port, proto:protocol, host:hostName, pickHost:pickHostNameFromBackendAddress, probe:probe.id}" -o tableaz network application-gateway probe list -g $rg --gateway-name $agw `  --query "[].{name:name, proto:protocol, host:host, path:path, pickHost:pickHostNameFromBackendHttpSettings}" -o table# Does the backend resolve privately? (from a VM in the gateway VNet)nslookup <backend-fqdn>

$rg = "<rg>" ; $policy = "<waf-policy>"az network application-gateway waf-policy policy-setting update -g $rg --policy-name $policy --mode Detection --state Enabled

AzureDiagnostics| where Category == "ApplicationGatewayFirewallLog" and TimeGenerated > ago(1h)| where requestUri_s contains "<path>"| project TimeGenerated, ruleId_s, Message, details_message_s, details_data_s, requestUri_s

az network application-gateway waf-policy managed-rule exclusion add -g $rg --policy-name $policy `  --match-variable RequestArgNames --selector-match-operator Equals --selector commentaz network application-gateway waf-policy managed-rule exclusion list -g $rg --policy-name $policy

az network application-gateway waf-policy policy-setting update -g $rg --policy-name $policy --mode Prevention --state Enabled

$resId = az network application-gateway show -g <rg> -n <agw> --query id -o tsv      # any resource$lawId = az monitor log-analytics workspace show -g <rg-law> -n <law> --query id -o tsvaz monitor diagnostic-settings create -n diag-to-law --resource $resId --workspace $lawId `  --logs '[{"categoryGroup":"allLogs","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]' `  --export-to-resource-specific trueaz monitor diagnostic-settings list --resource $resId -o table

$SPName = "<sp-display-name>"$id = az ad sp list --display-name $SPName --query "[].{id:id}" --output tsv$id                                          # exactly ONE ID? With several SPs of the same name stop and look up by app ID:# $id = az ad sp show --id <app-id> --query id -o tsv # Choose the scope – as small as possible:$scope = "/subscriptions/<subscription-id>"                                       # one subscription# $scope = "/subscriptions/<subscription-id>/resourceGroups/<rg>"                 # one resource group# $scope = "/providers/Microsoft.Management/managementGroups/<mg-id>"             # management group# $scope = "/"                                                                    # tenant root (everything!) az role assignment create --assignee-principal-type ServicePrincipal --assignee-object-id $id --scope $scope --role "Owner"az role assignment list --assignee $id --all --query "[].{role:roleDefinitionName, scope:scope}" -o table

# run as the deployment SP itself or as an admin; root "/" last$roles  = @("Owner", "User Access Administrator")$scopes = @(az account management-group list --query "[].id" -o tsv) + "/"foreach ($s in $scopes) {  az role assignment list --scope $s --assignee $id -o json --only-show-errors | ConvertFrom-Json |    Where-Object { $_.scope -eq $s -and $roles -contains $_.roleDefinitionName } |    ForEach-Object { az role assignment delete --ids $_.id --only-show-errors ; "removed: $($_.roleDefinitionName) on $s" }}

$rg = "<rg>" ; $name = "<identity>"$principalId = az identity create -g $rg -n $name --query principalId -o tsv$scope = az keyvault show -n <keyvault-name> --query id -o tsv          # or RG/subscription/resourceaz role assignment create --assignee-object-id $principalId --assignee-principal-type ServicePrincipal `  --role "Key Vault Secrets User" --scope $scopeaz role assignment list --assignee $principalId --all -o table

$who = az ad signed-in-user show --query id -o tsv          # or: <upn> / <object-id>az role assignment list --assignee $who --all --include-inherited `  --query "[].{role:roleDefinitionName, scope:scope}" -o tableaz ad user get-member-groups --id $who --query "[].displayName" -o tsv     # permissions via groups

# 1. Copy policyAssignmentId / policyDefinitionId from the error message$assignmentId = "<policyAssignmentId>"az policy assignment list --disable-scope-strict-match --scope /subscriptions/<sub>/resourceGroups/<rg> `  --query "[?id=='$assignmentId'].{name:displayName, scope:scope, def:policyDefinitionId}" -o tableaz policy definition show --name <definition-name> --query "{name:displayName, rule:policyRule}"# 2. Make it compliant (preferred) – or a time-limited exemption for the scopeaz policy exemption create -n <name> --policy-assignment $assignmentId `  --scope /subscriptions/<sub>/resourceGroups/<rg> --exemption-category Waiver `  --expires-on 2026-12-31T00:00:00Z --description "<reason, ticket>"

# In Key Vaultaz keyvault certificate list --vault-name <keyvault-name> `  --query "sort_by([].{name:name, expires:attributes.expires}, &expires)" -o table# What a server actually serves (Git Bash / Linux)openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -enddate -subject

# Without openssl, in PowerShell$tcp = New-Object Net.Sockets.TcpClient("<host>", 443)$ssl = New-Object Net.Security.SslStream($tcp.GetStream(), $false, { $true })$ssl.AuthenticateAsClient("<host>")$ssl.RemoteCertificate | Select Subject, @{n='Expires';e={$_.GetExpirationDateString()}}$tcp.Close()

az version                                         # installed versionaz upgrade                                         # update the CLIaz login                                           # browser sign-inaz login --tenant <tenant-id>                      # specific tenantaz login --use-device-code                         # sign in with a code (other device)az login --use-device-code --tenant <tenant-id>az login --allow-no-subscriptions                  # tenant without subscriptionaz login --identity                                # managed identity (Azure VM/pipeline)az login --service-principal --username <app-id> --password <secret> --tenant <tenant-id>   # workflow: 00-workflows.mdaz account show -o table                           # current subscriptionaz account list -o table                           # all subscriptionsaz account list --all -o table                     # incl. disabled onesaz account set --subscription <name-or-id>         # switch subscriptionaz account list --query "[?name=='<name>'].id" -o tsvaz account tenant list -o tableaz logout ; az account clear                       # sign out, clear cacheaz config set core.output=table                    # default outputaz extension list -o tableaz extension add -n <name>                         # e.g. serial-console, resource-graphaz extension update -n <name>az provider register -n Microsoft.Network          # register a resource provideraz provider show -n Microsoft.Network --query registrationState

-o table | tsv | json | jsonc | yaml | none--query "[].{name:name, rg:resourceGroup}"         # choose columns--query "[?location=='austriaeast'].name"          # filter--query "[?contains(name,'<part>')].name"          # contains--query "[?tags.environment=='prod']"              # filter by tag--query "length(@)"                                # count--query "[0].id"                                   # first element$id = az <...> --query id -o tsv                   # value into a variable (PowerShell)id=$(az <...> --query id -o tsv)                   # value into a variable (Bash)--debug                                            # show REST calls (troubleshooting)

az group list -o tableaz group create -n <rg> -l <region> --tags Owner=<x> environment=<y>az group delete -n <rg> --yes --no-waitaz resource list -g <rg> -o tableaz resource list --tag environment=<y> -o tableaz resource show --ids <resource-id>az resource tag --ids <resource-id> --tags key=value -i       # -i = keep existing tagsaz resource delete --ids <resource-id>az resource move --destination-group <rg-new> --ids <id1> <id2>az lock list -g <rg> -o tableaz lock create -n <name> -g <rg> --lock-type CanNotDeleteaz lock delete -n <name> -g <rg> # Availability / regionaz account list-locations --query "[].{name:name, display:displayName}" -o tableaz vm list-skus -l <region> --size <sku> -o table

az extension add -n resource-graphaz graph query -q "Resources | where name contains '<part>' | project name, type, resourceGroup, subscriptionId"az graph query -q "Resources | where type =~ 'microsoft.network/virtualnetworks' | project name, resourceGroup, properties.addressSpace.addressPrefixes"az graph query -q "Resources | where type =~ 'microsoft.network/publicipaddresses' | project name, ip=properties.ipAddress, resourceGroup"az graph query -q "Resources | summarize Count=count() by type | order by Count desc"az graph query -q "ResourceContainers | where type =~ 'microsoft.resources/subscriptions' | project name, subscriptionId"

az vm list -d -o tableaz vm list -d -g <rg> --query "[].{name:name, state:powerState, zone:zones[0], ip:privateIps, pip:publicIps}" -o tableaz vm show -g <rg> -n <vm> --query "{size:hardwareProfile.vmSize, zones:zones, image:storageProfile.imageReference}"az vm get-instance-view -g <rg> -n <vm> --query "instanceView.statuses[].displayStatus"az vm start      -g <rg> -n <vm>az vm stop       -g <rg> -n <vm>                 # stopped, compute still billedaz vm deallocate -g <rg> -n <vm> --no-wait       # deallocated, no compute costsaz vm restart    -g <rg> -n <vm>az vm resize     -g <rg> -n <vm> --size <sku>az vm list-sizes -l <region> -o tableaz vm list-skus  -l <region> --size <sku> --query "[].locationInfo[].zones" -o tsv     # zonesaz vm list-usage -l <region> -o table                                                   # quotaaz vm run-command invoke -g <rg> -n <vm> --command-id RunShellScript --scripts "hostname; ip a"az vm run-command invoke -g <rg> -n <vm> --command-id RunPowerShellScript --scripts "ipconfig /all"az vm boot-diagnostics enable -g <rg> -n <vm>az vm boot-diagnostics get-boot-log -g <rg> -n <vm>az serial-console connect -g <rg> -n <vm>        # extension serial-consoleaz vm user update -g <rg> -n <vm> -u <user> -p <new-password>        # reset passwordaz vm user update -g <rg> -n <vm> -u <user> --ssh-key-value "<public-key>"az vm disk attach -g <rg> --vm-name <vm> --name <disk> --new --size-gb 32az vm extension list -g <rg> --vm-name <vm> -o tableaz vm identity assign -g <rg> -n <vm>            # system-assigned identity # NICaz network nic list -g <rg> -o tableaz network nic show -g <rg> -n <nic> --query "{ip:ipConfigurations[].privateIPAddress, fwd:enableIPForwarding, accel:enableAcceleratedNetworking}"az network nic update -g <rg> -n <nic> --ip-forwarding true          # required for NVAs

az vm image list-publishers -l <region> --query "[?contains(name,'<part>')].name" -o tsvaz vm image list-offers -l <region> -p <publisher> -o tableaz vm image list-skus   -l <region> -p <publisher> -f <offer> -o tableaz vm image list -p <publisher> -f <offer> -s <sku> -l <region> --all -o tableaz vm image terms show   --urn <publisher>:<offer>:<sku>:<version>az vm image terms accept --urn <publisher>:<offer>:<sku>:<version>

az webapp list --query "[].{name:name, rg:resourceGroup, state:state, host:defaultHostName}" -o tableaz webapp show -g <rg> -n <app> --query "{state:state, https:httpsOnly, pna:publicNetworkAccess, vnet:virtualNetworkSubnetId}"az webapp restart -g <rg> -n <app>az webapp log tail -g <rg> -n <app>                                  # live logaz webapp config appsettings list -g <rg> -n <app> -o tableaz webapp config appsettings set  -g <rg> -n <app> --settings KEY=valueaz webapp config access-restriction show -g <rg> -n <app>az webapp vnet-integration list -g <rg> -n <app>az webapp update -g <rg> -n <app> --set publicNetworkAccess=Disabledaz functionapp list -o table

az storage account list --query "[].{name:name, rg:resourceGroup, sku:sku.name, pna:publicNetworkAccess}" -o tableaz storage account show -g <rg> -n <sa> --query "{tls:minimumTlsVersion, public:allowBlobPublicAccess, key:allowSharedKeyAccess}"az storage account network-rule list -g <rg> --account-name <sa>az storage account update -g <rg> -n <sa> --default-action Denyaz storage container list --account-name <sa> --auth-mode login -o tableaz storage blob list   --account-name <sa> -c <container> --auth-mode login -o tableaz storage blob upload --account-name <sa> -c <container> -f <file> -n <name> --auth-mode loginaz storage blob download --account-name <sa> -c <container> -n <name> -f <target> --auth-mode login

az aks list -o tableaz aks get-credentials -g <rg> -n <aks>              # get kubeconfigaz aks show -g <rg> -n <aks> --query "{k8s:kubernetesVersion, net:networkProfile.networkPlugin, outbound:networkProfile.outboundType}"kubectl get nodes -o wide ; kubectl get pods -A

az monitor activity-log list -g <rg> --offset 2h `  --query "[].{time:eventTimestamp, op:operationName.localizedValue, status:status.value, by:caller}" -o tableaz monitor activity-log list --correlation-id <id>az monitor diagnostic-settings list --resource <resource-id> -o tableaz monitor diagnostic-settings categories list --resource <resource-id> -o tableaz monitor diagnostic-settings create -n <name> --resource <resource-id> --workspace <law-id> `  --logs '[{"categoryGroup":"allLogs","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]'az monitor log-analytics workspace list -o tableaz monitor log-analytics workspace show -g <rg> -n <law> --query customerId -o tsv     # workspace GUIDaz monitor log-analytics query -w <workspace-guid> --analytics-query "<KQL>" -o tableaz monitor metrics list-definitions --resource <resource-id> -o tableaz monitor metrics list --resource <resource-id> --metric <name> --interval PT5M -o tableaz monitor metrics alert list -g <rg> -o table

az account get-access-token --query accessToken -o tsvaz rest --method get --url "https://management.azure.com/subscriptions/<sub>/resourceGroups?api-version=2021-04-01"az rest --method get --url "<resource-id>?api-version=<version>"     # raw resource as JSON

... cannot be loaded because its operation is blocked by software restriction policies ...

Get-Module <module>* -ListAvailable |    Where-Object { $_.ModuleBase -like "$HOME*" } |    ForEach-Object { if ($_.ModuleBase -match '\\\d+(\.\d+)+$') { Split-Path $_.ModuleBase } else { $_.ModuleBase } } |    Select-Object -Unique |    Where-Object { (Split-Path $_ -Leaf) -notlike '*_old' } |    ForEach-Object { Rename-Item $_ -NewName ((Split-Path $_ -Leaf) + '_old') }

Get-Module <module> -ListAvailable | Select-Object Version, PathImport-Module <module>

Update-Module <module> -Scope AllUsers

Get-AzResourceGroup | Format-Table ResourceGroupName, LocationGet-AzResource -ResourceGroupName <rg> | Format-Table Name, ResourceTypeGet-AzResource -Name "*<part>*" | Format-Table Name, ResourceGroupName, ResourceTypeSearch-AzGraph -Query "Resources | where name contains '<part>' | project name, type, resourceGroup"   # module Az.ResourceGraph

Get-AzVM -Status | Select Name, ResourceGroupName, PowerStateStart-AzVM -ResourceGroupName <rg> -Name <vm>Stop-AzVM  -ResourceGroupName <rg> -Name <vm> -Force          # deallocatedInvoke-AzVMRunCommand -ResourceGroupName <rg> -VMName <vm> -CommandId RunPowerShellScript -ScriptString "ipconfig /all"

Get-AzVirtualNetwork | Select Name, @{n='Space';e={$_.AddressSpace.AddressPrefixes}}Get-AzVirtualNetworkPeering -ResourceGroupName <rg> -VirtualNetworkName <vnet> | Select Name, PeeringState, AllowForwardedTrafficGet-AzEffectiveRouteTable -ResourceGroupName <rg> -NetworkInterfaceName <nic> | Format-TableGet-AzEffectiveNetworkSecurityGroup -ResourceGroupName <rg> -NetworkInterfaceName <nic>Get-AzNetworkSecurityGroup -Name <nsg> -ResourceGroupName <rg> | Get-AzNetworkSecurityRuleConfig | Format-TableGet-AzPublicIpAddress | Select Name, IpAddressGet-AzApplicationGatewayBackendHealth -ResourceGroupName <rg> -Name <agw>

$AppGW = Get-AzApplicationGateway -Name <agw> -ResourceGroupName <rg>$AppGW.SslCertificates | Select Name, KeyVaultSecretId$AppGW.HttpListeners   | Select Name, Protocol, HostNames$secret   = Get-AzKeyVaultSecret -VaultName <kv> -Name <name>$secretId = $secret.Id.Replace($secret.Version, "")          # versionless secret ID$AppGW = Add-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <name> -KeyVaultSecretId $secretId$AppGW = Set-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <name> -KeyVaultSecretId <new-id>$AppGW = Remove-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <name>Set-AzApplicationGateway -ApplicationGateway $AppGW         # changes only take effect hereStop-AzApplicationGateway -ApplicationGateway $AppGW ; Start-AzApplicationGateway -ApplicationGateway $AppGW

Get-AzRoleAssignment -SignInName <upn>Get-AzRoleAssignment -Scope <resource-id>New-AzRoleAssignment -ObjectId <id> -RoleDefinitionName "<role>" -Scope <resource-id>Get-AzKeyVaultSecret -VaultName <kv> -Name <name> -AsPlainText

$vnet = Get-AzVirtualNetwork -ResourceGroupName <rg> -Name <vnet>Add-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name <snet> -AddressPrefix 10.0.5.0/24 | Out-Null$vnet | Set-AzVirtualNetwork                         # only now is it changed in Azure

az webapp deploy -g <rg> -n <app> --src-path .\publish.zip --type zip          # zip deploy (recommended)az webapp deploy -g <rg> -n <app> --src-path .\app.jar --type jaraz webapp deploy -g <rg> -n <app> --src-path .\publish.zip --type zip --slot stagingaz webapp config container set -g <rg> -n <app> --container-image-name <acr>.azurecr.io/<image>:<tag> `  --container-registry-url https://<acr>.azurecr.io                          # container (managed identity needs AcrPull)az webapp deployment list-publishing-profiles -g <rg> -n <app> --xml           # only if a tool needs it – contains secrets

az webapp deployment slot create -g <rg> -n <app> --slot staging --configuration-source <app>az webapp deployment slot list -g <rg> -n <app> -o tableaz webapp deployment slot swap -g <rg> -n <app> --slot staging --target-slot productionaz webapp deployment slot swap -g <rg> -n <app> --slot staging --action preview      # swap with preview (apply settings first)az webapp deployment slot swap -g <rg> -n <app> --slot staging --action swapaz webapp traffic-routing set -g <rg> -n <app> --distribution staging=10             # 10 % canary to stagingaz webapp traffic-routing clear -g <rg> -n <app>

az webapp config appsettings list -g <rg> -n <app> -o tableaz webapp config appsettings set -g <rg> -n <app> --settings ASPNETCORE_ENVIRONMENT=Production FeatureX=trueaz webapp config appsettings set -g <rg> -n <app> --slot staging --slot-settings ASPNETCORE_ENVIRONMENT=Stagingaz webapp config appsettings delete -g <rg> -n <app> --setting-names FeatureXaz webapp config connection-string set -g <rg> -n <app> -t SQLAzure --settings Db="<connection-string>"# Key Vault reference instead of the secret value (identity of the app needs "Key Vault Secrets User")az webapp config appsettings set -g <rg> -n <app> --settings "DbPassword=@Microsoft.KeyVault(SecretUri=https://<keyvault-name>.vault.azure.net/secrets/<secret-name>/)"$mi = az webapp identity show -g <rg> -n <app> --query principalId -o tsvaz role assignment create --assignee-object-id $mi --assignee-principal-type ServicePrincipal `  --role "Key Vault Secrets User" --scope (az keyvault show -n <keyvault-name> --query id -o tsv)

# Outbound: VNet integration – all traffic through the VNet (UDR / firewall apply)az webapp vnet-integration add -g <rg> -n <app> --vnet <vnet> --subnet <snet-appsvc-integration>az webapp config set -g <rg> -n <app> --vnet-route-all-enabled true# Inbound: only Front Door may reach the app$fdid = az afd profile show -g <rg-afd> --profile-name <afd-profile> --query frontDoorId -o tsvaz webapp config access-restriction add -g <rg> -n <app> --rule-name allow-afd --priority 100 --action Allow `  --service-tag AzureFrontDoor.Backend --http-header x-azure-fdid=$fdidaz webapp config access-restriction show -g <rg> -n <app>az webapp config access-restriction set -g <rg> -n <app> --use-same-restrictions-for-scm-site false# Inbound private: disable public access after the private endpoint worksaz webapp update -g <rg> -n <app> --set publicNetworkAccess=Disabled

# DNS: CNAME www -> <app>.azurewebsites.net and TXT asuid.www -> verification IDaz webapp show -g <rg> -n <app> --query customDomainVerificationId -o tsvaz webapp config hostname add -g <rg> --webapp-name <app> --hostname www.<domain># Free managed certificate (CNAME domains; renews automatically)az webapp config ssl create -g <rg> -n <app> --hostname www.<domain>$thumb = az webapp config ssl list -g <rg> --query "[?subjectName=='www.<domain>'].thumbprint | [0]" -o tsvaz webapp config ssl bind -g <rg> -n <app> --certificate-thumbprint $thumb --ssl-type SNI# Certificate from Key Vault (App Service resource provider needs access to the vault)az webapp config ssl import -g <rg> -n <app> --key-vault <keyvault-name> --key-vault-certificate-name <certificate-name>

az webapp log config -g <rg> -n <app> --application-logging filesystem --level information --docker-container-logging filesystem --web-server-logging filesystemaz webapp log tail -g <rg> -n <app>                           # live log streamaz webapp log download -g <rg> -n <app> --log-file logs.zipaz webapp restart -g <rg> -n <app>az webapp stop -g <rg> -n <app> ; az webapp start -g <rg> -n <app>az appservice plan update -g <rg> -n <plan> --sku P1v3          # scale upaz appservice plan update -g <rg> -n <plan> --number-of-workers 3   # scale outaz webapp show -g <rg> -n <app> --query "{state:state, host:defaultHostName, plan:appServicePlanId, outboundIps:outboundIpAddresses}"

az aks install-cli                                         # kubectl + kubeloginaz aks get-credentials -g <rg> -n <aks> --overwrite-existingkubelogin convert-kubeconfig -l azurecli                   # use your az login for Entra IDkubectl config get-contexts ; kubectl config use-context <aks>kubectl get nodes -o wide# Access with Azure RBAC: give a group a cluster roleaz role assignment create --assignee <group-object-id> --role "Azure Kubernetes Service RBAC Cluster Admin" `  --scope (az aks show -g <rg> -n <aks> --query id -o tsv)

kubectl get pods -A                                         # all namespaceskubectl get pods -n <ns> -o wide                            # with node and pod IPkubectl get deploy,svc,ingress -n <ns>kubectl describe pod <pod> -n <ns>                          # events at the bottom: why it does not startkubectl logs <pod> -n <ns> --tail 100 -f                    # follow logskubectl logs <pod> -n <ns> --previous                       # logs of the crashed containerkubectl exec -it <pod> -n <ns> -- sh                        # shell in the containerkubectl get events -n <ns> --sort-by .lastTimestampkubectl top nodes ; kubectl top pods -n <ns>                # CPU/memory (metrics server)kubectl apply -f deployment.yamlkubectl rollout status deploy/<deployment> -n <ns>kubectl rollout restart deploy/<deployment> -n <ns>         # restart all podskubectl rollout undo deploy/<deployment> -n <ns>            # back to the previous versionkubectl scale deploy/<deployment> -n <ns> --replicas 3kubectl port-forward svc/<service> -n <ns> 8080:80          # test locally on http://localhost:8080kubectl delete pod <pod> -n <ns>                            # pod is recreated by its deployment

az aks nodepool list -g <rg> --cluster-name <aks> -o tableaz aks nodepool add -g <rg> --cluster-name <aks> -n user01 --mode User --node-count 2 `  --node-vm-size Standard_D8ds_v5 --zones 1 2 3 --labels workload=appsaz aks nodepool scale -g <rg> --cluster-name <aks> -n user01 --node-count 4az aks nodepool update -g <rg> --cluster-name <aks> -n user01 --enable-cluster-autoscaler --min-count 2 --max-count 6az aks nodepool update -g <rg> --cluster-name <aks> -n user01 --update-cluster-autoscaler --min-count 2 --max-count 10az aks nodepool delete -g <rg> --cluster-name <aks> -n user01

az aks get-upgrades -g <rg> -n <aks> -o tableaz aks upgrade -g <rg> -n <aks> --kubernetes-version <version> --control-plane-only    # first the control planeaz aks nodepool upgrade -g <rg> --cluster-name <aks> -n user01 --kubernetes-version <version>az aks nodepool upgrade -g <rg> --cluster-name <aks> -n user01 --node-image-only      # only OS image (security patches)az aks nodepool update -g <rg> --cluster-name <aks> -n user01 --max-surge 33%         # faster, needs subnet IPsaz aks update -g <rg> -n <aks> --auto-upgrade-channel patch --node-os-upgrade-channel NodeImageaz aks maintenanceconfiguration list -g <rg> --cluster-name <aks> -o table

az aks update -g <rg> -n <aks> --attach-acr <acr>              # AcrPull for the kubelet identityaz aks check-acr -g <rg> -n <aks> --acr <acr>.azurecr.io        # test pull from the nodesaz acr login -n <acr>az acr build -r <acr> -t <image>:<tag> .                        # build in Azure, no local Docker neededaz acr repository list -n <acr> -o tableaz acr repository show-tags -n <acr> --repository <image> --orderby time_desc -o table

az aks command invoke -g <rg> -n <aks> --command "kubectl get pods -A"az aks command invoke -g <rg> -n <aks> --command "kubectl apply -f deployment.yaml" --file deployment.yaml

az aks stop -g <rg> -n <aks>                                   # dev/test: control plane + nodes stopped, no VM costsaz aks start -g <rg> -n <aks>az aks show -g <rg> -n <aks> --query powerState.code -o tsvaz aks nodepool scale -g <rg> --cluster-name <aks> -n user01 --node-count 0    # user pools can go to 0

// Container Insights: errors in container logs of the last hourContainerLogV2| where TimeGenerated > ago(1h) and LogMessage has_any ("error", "exception", "fail")| project TimeGenerated, PodNamespace, PodName, ContainerName, LogMessage| order by TimeGenerated desc

# Session hosts: status, sessions, drain modeGet-AzWvdSessionHost -ResourceGroupName <rg> -HostPoolName vdpool-<name> |  Select-Object @{n='Host';e={($_.Name -split '/')[-1]}}, Status, Session, AllowNewSession, UpdateStateUpdate-AzWvdSessionHost -ResourceGroupName <rg> -HostPoolName vdpool-<name> -Name <host-fqdn> -AllowNewSession:$false   # drain for maintenance # User sessions: list, send message, log offGet-AzWvdUserSession -ResourceGroupName <rg> -HostPoolName vdpool-<name> |  Select-Object ActiveDirectoryUserName, SessionState, @{n='Host';e={($_.Name -split '/')[1]}}, @{n='Id';e={($_.Name -split '/')[-1]}}Send-AzWvdUserSessionMessage -ResourceGroupName <rg> -HostPoolName vdpool-<name> -SessionHostName <host-fqdn> -UserSessionId <id> `  -MessageTitle "Maintenance" -MessageBody "Please save your work – logoff in 10 minutes."Remove-AzWvdUserSession -ResourceGroupName <rg> -HostPoolName vdpool-<name> -SessionHostName <host-fqdn> -Id <id>

// Connections per user / host, last 24 hWVDConnections| where TimeGenerated > ago(24h) and State == "Connected"| summarize Connections = count() by UserName, SessionHostName| order by Connections desc // ErrorsWVDErrors| where TimeGenerated > ago(24h)| summarize Count = count() by CodeSymbolic, Message| order by Count desc // Session host health check failuresWVDAgentHealthStatus| where TimeGenerated > ago(1h) and Status != "Available"| project TimeGenerated, SessionHostName, Status, SessionHostHealthCheckResult

foreach ($p in "Microsoft.HybridCompute","Microsoft.GuestConfiguration","Microsoft.HybridConnectivity","Microsoft.AzureArcData") { az provider register -n $p }az ad sp create-for-rbac -n sp-arc-onboarding --role "Azure Connected Machine Onboarding" --scopes /subscriptions/<sub-id>/resourceGroups/<rg-arc>

azcmagent show                         # status, resource ID, last heartbeatazcmagent check                        # tests connectivity to all required endpointsazcmagent config listazcmagent logs                         # collects logs into a zip for supportazcmagent disconnect                   # remove from Azure (deletes the resource too)

$v = "rsv-<name>-weu"; $rg = "<rg>"az backup item list -g $rg --vault-name $v --query "[].{vm:properties.friendlyName, state:properties.protectionState, last:properties.lastBackupTime, status:properties.lastBackupStatus}" -o tableaz backup protection backup-now -g $rg --vault-name $v --container-name <vm> --item-name <vm> `  --backup-management-type AzureIaasVM --retain-until (Get-Date).AddDays(30).ToString("dd-MM-yyyy")   # macOS: $(date -v+30d +%d-%m-%Y) · Linux: $(date -d '+30 days' +%d-%m-%Y)az backup job list -g $rg --vault-name $v --query "[].{op:properties.operation, item:properties.entityFriendlyName, status:properties.status, start:properties.startTime}" -o tableaz backup recoverypoint list -g $rg --vault-name $v --container-name <vm> --item-name <vm> --backup-management-type AzureIaasVM --query "[].{name:name, time:properties.recoveryPointTime, type:properties.recoveryPointType}" -o table

az storage account create -g $rg -n <sa-staging> -l westeurope --sku Standard_LRS     # staging for restoreaz backup restore restore-disks -g $rg --vault-name $v --container-name <vm> --item-name <vm> `  --rp-name <recovery-point-name> --storage-account <sa-staging> --target-resource-group <rg-restore>az backup job list -g $rg --vault-name $v --operation Restore -o table

az backup vault backup-properties set -g $rg -n $v --soft-delete-feature-state AlwaysOn      # cannot be turned off againaz backup vault update -g $rg -n $v --immutability-state Unlocked                            # Locked = irreversibleaz lock create -n lock-$v -g $rg --resource-type Microsoft.RecoveryServices/vaults --resource $v --lock-type CanNotDelete

az resource list -g <rg-asr> --resource-type Microsoft.RecoveryServices/vaults -o table# Replication status (PowerShell)$v = Get-AzRecoveryServicesVault -Name <rsv-dr> -ResourceGroupName <rg-asr>; Set-AzRecoveryServicesAsrVaultContext -Vault $vGet-AzRecoveryServicesAsrFabric | ForEach-Object { Get-AzRecoveryServicesAsrProtectionContainer -Fabric $_ } |  ForEach-Object { Get-AzRecoveryServicesAsrReplicationProtectedItem -ProtectionContainer $_ } |  Select-Object FriendlyName, ProtectionState, ReplicationHealth, TestFailoverState

// Failed backup jobs, last 7 daysAddonAzureBackupJobs| where TimeGenerated > ago(7d) and JobOperation == "Backup" and JobStatus == "Failed"| project TimeGenerated, BackupItemUniqueId, JobFailureCode, JobDurationInSecs| order by TimeGenerated desc

az vm assess-patches -g <rg> -n <vm> --query "{status:status, critical:criticalAndSecurityPatchCount, other:otherPatchCount, reboot:rebootPending}"az vm install-patches -g <rg> -n <vm> --maximum-duration PT2H --reboot-setting IfRequired `  --classifications-to-include-win Critical Security --query "{status:status, installed:installedPatchCount, failed:failedPatchCount}"# Linux:az vm install-patches -g <rg> -n <vm> --maximum-duration PT2H --reboot-setting IfRequired --classifications-to-include-linux Critical Security

// Machines with missing critical/security updatespatchassessmentresources| where type has "softwarepatches"| extend machine = tostring(split(id, '/')[8]), cls = tostring(properties.classifications[0])| where cls in ('Critical', 'Security')| summarize Missing = count() by machine, cls| order by Missing desc // Results of the last installation runspatchinstallationresources| where type has "patchinstallationresults"| project machine = tostring(split(id, '/')[8]), status = tostring(properties.status), start = todatetime(properties.startDateTime),          installed = toint(properties.installedPatchCount), failed = toint(properties.failedPatchCount)| order by start desc

azcopy login --tenant-id <tenant-id>                                   # sign in with Entra IDazcopy copy ".\folder" "https://<sa>.blob.core.windows.net/<container>/" --recursiveazcopy copy "https://<sa>.blob.core.windows.net/<container>/path/*" ".\target" --recursiveazcopy sync ".\folder" "https://<sa>.blob.core.windows.net/<container>/folder" --delete-destination=false   # changes onlyazcopy copy "https://<sa-a>.blob.core.windows.net/<c>/?<sas>" "https://<sa-b>.blob.core.windows.net/<c>/?<sas>" --recursive   # account to accountazcopy list "https://<sa>.blob.core.windows.net/<container>"azcopy jobs list ; azcopy jobs resume <job-id>                         # resume an aborted transfer

# User delegation SAS (with Entra sign-in, without account key – preferred)$expiry = (Get-Date).ToUniversalTime().AddHours(8).ToString("yyyy-MM-ddTHH:mmZ")$sas = az storage container generate-sas --account-name <sa> -n <container> `  --permissions rl --expiry $expiry --auth-mode login --as-user -o tsv"https://<sa>.blob.core.windows.net/<container>?$sas" # For a single blobaz storage blob generate-sas --account-name <sa> -c <container> -n <file> `  --permissions r --expiry $expiry --auth-mode login --as-user --full-uri -o tsv

# Show and restore deleted blobs (soft delete must be on)az storage blob list --account-name <sa> -c <container> --include d --auth-mode login `  --query "[?deleted].{name:name, deleted:properties.deletedTime}" -o tableaz storage blob undelete --account-name <sa> -c <container> -n <file> --auth-mode login # Versions of a blob (versioning must be on)az storage blob list --account-name <sa> -c <container> --prefix <file> --include v --auth-mode login `  --query "[].{name:name, version:versionId, current:isCurrentVersion}" -o table# Make an old version the current one againaz storage blob copy start --account-name <sa> --destination-container <container> --destination-blob <file> `  --source-uri "https://<sa>.blob.core.windows.net/<container>/<file>?versionid=<version-id>" --auth-mode login # Restore a deleted containeraz storage container list --account-name <sa> --include-deleted --auth-mode login --query "[?deleted]" -o tableaz storage container restore --account-name <sa> -n <container> --deleted-version <version> --auth-mode login

az storage account blob-service-properties update -g <rg> --account-name <sa> `  --enable-delete-retention true --delete-retention-days 14 `  --enable-container-delete-retention true --container-delete-retention-days 14 `  --enable-versioning trueaz storage account update -g <rg> -n <sa> --allow-blob-public-access false --min-tls-version TLS1_2az storage account update -g <rg> -n <sa> --allow-shared-key-access false     # Entra sign-in only (check first who uses keys!)az lock create -n lock-<sa> -g <rg> --resource-type Microsoft.Storage/storageAccounts --resource <sa> --lock-type CanNotDelete

az storage share-rm list -g <rg> --storage-account <sa> -o tableaz storage share-rm create -g <rg> --storage-account <sa> -n <share> --quota 100

{  "rules": [{    "name": "cleanup-logs",    "enabled": true,    "type": "Lifecycle",    "definition": {      "filters": { "blobTypes": [ "blockBlob" ], "prefixMatch": [ "logs/" ] },      "actions": {        "baseBlob": {          "tierToCool": { "daysAfterModificationGreaterThan": 30 },          "delete":     { "daysAfterModificationGreaterThan": 365 }        }      }    }  }]}

az storage account management-policy create -g <rg> --account-name <sa> --policy "@policy.json"az storage account management-policy show   -g <rg> --account-name <sa>

az keyvault list -o tableaz keyvault show -n <kv> --query "{rbac:properties.enableRbacAuthorization, pna:properties.publicNetworkAccess, softDelete:properties.enableSoftDelete}"az keyvault secret list --vault-name <kv> -o tableaz keyvault secret show --vault-name <kv> -n <name> --query value -o tsvaz keyvault secret set  --vault-name <kv> -n <name> --value <value>az keyvault secret set  --vault-name <kv> -n <name> --file <file>           # value from a fileaz keyvault secret delete --vault-name <kv> -n <name>az keyvault secret list-deleted --vault-name <kv> -o tableaz keyvault secret recover --vault-name <kv> -n <name>                      # undo soft deleteaz keyvault certificate list --vault-name <kv> -o tableaz keyvault certificate import --vault-name <kv> -n <name> -f .\cert.pfx --password <pfx-password>az keyvault certificate show --vault-name <kv> -n <name> --query "{sid:sid, expires:attributes.expires}"# versionless secret ID: https://<kv>.vault.azure.net/secrets/<name>az keyvault certificate download --vault-name <kv> -n <name> -f cert.pem   # public part onlyaz keyvault list-deleted -o tableaz keyvault purge -n <kv>                                                   # delete permanently (careful!)az keyvault update -n <kv> --bypass AzureServices                           # allow trusted servicesaz keyvault network-rule add -n <kv> --ip-address <ip>/32az keyvault network-rule list -n <kv>

az keyvault create -n <keyvault-name> -g <rg> -l <region> --sku standard `  --enable-rbac-authorization true --enable-purge-protection true --retention-days 90 --public-network-access Enabled$kvId = az keyvault show -n <keyvault-name> --query id -o tsv$me   = az ad signed-in-user show --query id -o tsvaz role assignment create --assignee-object-id $me --assignee-principal-type User --role "Key Vault Administrator" --scope $kvId

# Self-signed (test) – PowerShell$policy = New-AzKeyVaultCertificatePolicy -SubjectName "CN=<fqdn>" -DnsName "<fqdn>" -IssuerName Self `  -ValidityInMonths 12 -SecretContentType "application/x-pkcs12" -KeyType RSA -KeySize 2048Add-AzKeyVaultCertificate -VaultName <keyvault-name> -Name <certificate-name> -CertificatePolicy $policyGet-AzKeyVaultCertificateOperation -VaultName <keyvault-name> -Name <certificate-name>      # status # For your own CA: IssuerName Unknown -> get CSR -> have it signed -> mergeaz keyvault certificate pending show  --vault-name <keyvault-name> -n <certificate-name> --query csr -o tsvaz keyvault certificate pending merge --vault-name <keyvault-name> -n <certificate-name> --file .\signed.cer

az identity list -g <rg> -o tableaz identity create -g <rg> -n <identity>az identity show -g <rg> -n <identity> --query "{principal:principalId, client:clientId, id:id}"az vm identity show -g <rg> -n <vm>az webapp identity assign -g <rg> -n <app> --identities <identity-id>

az role assignment list --assignee <principal-id-or-upn> --all -o tableaz role assignment list --scope <resource-id> --include-inherited -o tableaz role assignment create --assignee-object-id <principal-id> --assignee-principal-type ServicePrincipal `  --role "<role>" --scope <resource-id>az role assignment delete --assignee <principal-id> --role "<role>" --scope <resource-id>az role definition list --name "<role>" -o jsonaz role definition list --custom-role-only true -o tableaz ad signed-in-user show --query id -o tsv           # your own object ID # Service principal by display name -> object ID -> role$id = az ad sp list --display-name "<sp-name>" --query "[].{id:id}" --output tsvaz role assignment create --assignee-principal-type ServicePrincipal --assignee-object-id $id --scope "/subscriptions/<sub>" --role "Owner" # Scopes#   /subscriptions/<sub>/resourceGroups/<rg>                      resource group#   /subscriptions/<sub>                                          subscription#   /providers/Microsoft.Management/managementGroups/<mg-id>      management group#   /                                                             tenant root (everything – only with elevated access)az rest --method post --url "/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"   # Global Admin: get UAA on "/"az account management-group list -o table                    # management groups

az ad user show --id <upn> --query "{id:id, name:displayName}"az ad group list --display-name <part> -o tableaz ad group member list -g <group> --query "[].userPrincipalName" -o tsvaz ad group member check -g <group> --member-id <object-id>az ad sp list --display-name <name> -o tableaz ad sp show --id <app-id> --query "{objectId:id, appId:appId}"az ad app list --display-name <name> -o tableaz ad app credential list --id <app-id> --query "[].{end:endDateTime, name:displayName}" -o table   # secret expiryaz ad sp create-for-rbac -n <name> --role Contributor --scopes /subscriptions/<sub>

az policy assignment list --scope /subscriptions/<sub> -o tableaz policy assignment list --disable-scope-strict-match --scope /subscriptions/<sub>/resourceGroups/<rg> -o tableaz policy assignment show -n <assignment> --scope <scope>az policy definition show -n <definition-name> --query "{name:displayName, effect:policyRule.then.effect}"az policy state list --resource <resource-id> --query "[].{policy:policyDefinitionName, compliant:complianceState}" -o tableaz policy state summarize -g <rg>az policy state trigger-scan -g <rg> --no-wait                    # re-evaluate complianceaz policy exemption list --scope <scope> -o tableaz policy exemption create -n <name> --policy-assignment <assignment-id> --scope <scope> --exemption-category Waiver

az ad app list --display-name <name> --query "[].{name:displayName, appId:appId, objectId:id}" -o tableaz ad sp  list --display-name <name> --query "[].{name:displayName, appId:appId, spObjectId:id}" -o tableaz ad sp show --id <app-id> --query id -o tsv                # SP object ID from the app IDaz ad app owner list --id <app-id> --query "[].userPrincipalName" -o tsvaz ad app owner add  --id <app-id> --owner-object-id <user-object-id> # New app with SP and role (secret is shown ONCE – store it in Key Vault right away)az ad sp create-for-rbac -n <name> --role Contributor --scopes /subscriptions/<sub-id>

# One appaz ad app credential list --id <app-id> --query "[].{name:displayName, end:endDateTime, keyId:keyId}" -o tableaz ad app credential list --id <app-id> --cert --query "[].{name:displayName, end:endDateTime}" -o table # All apps whose secret expires within the next 30 days$limit = (Get-Date).AddDays(30)az ad app list --all --query "[].{name:displayName, appId:appId, secrets:passwordCredentials[].endDateTime}" -o json |  ConvertFrom-Json | ForEach-Object {    $app = $_    $app.secrets | Where-Object { $_ -and [datetime]$_ -lt $limit } |      ForEach-Object { [pscustomobject]@{ App = $app.name; AppId = $app.appId; Expires = ([datetime]$_).ToString('yyyy-MM-dd') } }  } | Sort-Object Expires | Format-Table

# Create the new secret IN ADDITION (--append), the old one stays valid for nowaz ad app credential reset --id <app-id> --append --display-name "secret-$(Get-Date -Format yyyyMM)" --years 1 --query password -o tsv   # Bash: "secret-$(date +%Y%m)"# -> enter it right away in Key Vault / the service connection / pipeline variableaz keyvault secret set --vault-name <kv> -n <secret-name> --value "<new-secret>" # Once everything is switched over: delete the old secretaz ad app credential list   --id <app-id> -o tableaz ad app credential delete --id <app-id> --key-id <old-key-id>

az ad group list --display-name <part> --query "[].{name:displayName, id:id}" -o tableaz ad group create --display-name <name> --mail-nickname <name>az ad group member list  -g <group> --query "[].{name:displayName, upn:userPrincipalName}" -o tableaz ad group member add   -g <group> --member-id <object-id>az ad group member remove -g <group> --member-id <object-id>az ad group member check -g <group> --member-id <object-id> --query valueaz ad user get-member-groups --id <upn> --query "[].displayName" -o tsv     # a user's groups

# Azure Cloud Shell (PowerShell) or locally after Connect-AzAccount$groups = @(    @{ Name = "az-<customer>-owner";                    Desc = "<Customer> - Owner" }    @{ Name = "az-<customer>-contributor";              Desc = "<Customer> - Contributor" }    @{ Name = "az-<customer>-reader";                   Desc = "<Customer> - Reader" }    @{ Name = "az-<customer>-costmanagementreader";     Desc = "<Customer> - Cost Management Reader" }    @{ Name = "az-<customer>-landingzones-owner";       Desc = "<Customer> - Landing Zones Owner" }    @{ Name = "az-<customer>-landingzones-contributor"; Desc = "<Customer> - Landing Zones Contributor" }    @{ Name = "az-<customer>-landingzones-reader";      Desc = "<Customer> - Landing Zones Reader" }) foreach ($g in $groups) {    $existing = Get-AzADGroup -DisplayName $g.Name -ErrorAction SilentlyContinue    if ($existing) {        Write-Host "Already exists: $($g.Name) (Id: $($existing.Id))" -ForegroundColor Yellow        continue    }    try {        $new = New-AzADGroup -DisplayName $g.Name -MailNickname $g.Name -Description $g.Desc -SecurityEnabled -ErrorAction Stop        Write-Host "Created: $($g.Name) (Id: $($new.Id))" -ForegroundColor Green    }    catch {        Write-Host "Error for $($g.Name): $($_.Exception.Message)" -ForegroundColor Red    }} # OverviewGet-AzADGroup -Filter "startswith(displayName,'az-<customer>')" |    Select-Object DisplayName, Id, SecurityEnabled | Format-Table -AutoSize

az ad user show --id <upn> --query "{name:displayName, id:id, enabled:accountEnabled}"az ad user list --filter "startswith(displayName,'<part>')" --query "[].{name:displayName, upn:userPrincipalName}" -o tableaz ad user list --filter "userType eq 'Guest'" --query "[].{name:displayName, mail:mail}" -o table     # guests

$scope = "/subscriptions/<sub-id>"$me    = (Get-AzADUser -SignedIn).IdGet-AzRoleEligibilitySchedule -Scope $scope -Filter "asTarget()" |  Select-Object RoleDefinitionDisplayName, Scope, RoleDefinitionId          # what may I activate? $roleId = "<RoleDefinitionId from the list>"New-AzRoleAssignmentScheduleRequest -Name (New-Guid).Guid -Scope $scope `  -PrincipalId $me -RoleDefinitionId $roleId -RequestType SelfActivate `  -ScheduleInfoStartDateTime (Get-Date).ToUniversalTime().ToString("o") `  -ExpirationType AfterDuration -ExpirationDuration PT8H `  -Justification "<reason / ticket>"

az security secure-scores list --query "[].{name:displayName, current:score.current, max:score.max, percent:score.percentage}" -o tableaz security secure-score-controls list --query "[].{name:displayName, current:score.current, max:score.max, open:unhealthyResourceCount}" -o tableaz security assessment list --query "[?status.code=='Unhealthy'].{recommendation:displayName, resource:resourceDetails.Id}" -o table

az security pricing list --query "value[].{plan:name, tier:pricingTier}" -o tableaz security pricing show -n VirtualMachinesaz security pricing create -n KeyVaults --tier Standard          # enable a plan (costs money)

az security alert list --query "[].{time:timeGeneratedUtc, severity:severity, title:alertDisplayName, resource:compromisedEntity, status:status}" -o tableaz security alert update --location <region> -n <alert-name> -g <rg> --status Dismiss       # close after review

$vmId = (Get-AzVM -ResourceGroupName <rg> -Name <vm>).Id$myIp = Invoke-RestMethod https://api.ipify.org$req = @{ id = $vmId; ports = @(@{ number = 22; endTimeUtc = (Get-Date).ToUniversalTime().AddHours(3).ToString("o"); allowedSourceAddressPrefix = @($myIp) }) }Start-AzJitNetworkAccessPolicy -ResourceGroupName <rg> -Location <region> -Name default -VirtualMachine @($req)

$sub = "<sub-id>"az account set --subscription $subaz security secure-scores list --query "[0].score.percentage" -o tsv                   # secure score in %az security pricing list --query "value[?pricingTier=='Free'].name" -o tsv              # plans that are offaz graph query --subscriptions $sub -q "Resources | where type =~ 'microsoft.network/networksecuritygroups' | mv-expand r = properties.securityRules | where r.properties.access == 'Allow' and r.properties.direction == 'Inbound' and tostring(r.properties.sourceAddressPrefix) in ('*','Internet') | project name, rule = tostring(r.name), port = tostring(r.properties.destinationPortRange)" -o tableaz graph query --subscriptions $sub -q "Resources | where type =~ 'microsoft.storage/storageaccounts' and properties.allowBlobPublicAccess == true | project name" -o tableaz keyvault list -o json | ConvertFrom-Json | Where-Object { -not $_.properties.enablePurgeProtection } | ForEach-Object name   # vaults without purge protection

Tenant Root Group  (/)└── <Company>    ├── Platform    │   ├── Identity        – domain controllers, Entra helper services    │   ├── Management      – Log Analytics, Automation, monitoring    │   └── Connectivity    – hub VNet, firewall/FortiGate, VPN, DNS    ├── Landing Zones    │   ├── Corp            – applications connected to the corporate network    │   └── Online          – applications directly from the internet    ├── Sandbox             – playground, no connectivity    └── Decommissioned      – retired subscriptions

az account management-group list -o tableaz account management-group show -n <mg-id> --expand --recurse `  --query "{name:displayName, children:children[].{name:displayName, type:type}}" -o jsonaz account management-group entities list --query "[].{name:displayName, type:type, parent:parent.id}" -o table   # everything flat

az graph query -q "ResourceContainers | where type =~ 'microsoft.resources/subscriptions' | project name, subscriptionId, mgChain = properties.managementGroupAncestorsChain" -o json

az account management-group subscription show-sub-under-mg -n <mg-id> -o table      # subscriptions under an MGaz account management-group subscription add --name <target-mg-id> --subscription <sub-id>

$mg = "/providers/Microsoft.Management/managementGroups/<mg-id>"az policy assignment list --scope $mg --query "[].{name:displayName, effect:parameters.effect.value, def:policyDefinitionId}" -o tableaz role assignment list --scope $mg --query "[].{who:principalName, role:roleDefinitionName}" -o table # Everything that affects a subscription (incl. inheritance from above)az policy assignment list --disable-scope-strict-match --scope /subscriptions/<sub-id> -o tableaz role assignment list --scope /subscriptions/<sub-id> --include-inherited -o table

az deployment mg what-if -m <mg-id> -l <region> -f main.bicep -p params/mg.bicepparamaz deployment mg create  -m <mg-id> -l <region> -f main.bicep -p params/mg.bicepparamaz deployment mg list -m <mg-id> -o tableaz deployment tenant create -l <region> -f tenant.bicep           # at the very top (needs permissions on "/")

{  "properties": {    "displayName": "Deny public IP addresses (unless RG tag AllowPublicIp=true)",    "policyType": "Custom",    "mode": "All",    "metadata": { "category": "Network", "version": "1.0.0" },    "parameters": {      "effect": { "type": "String", "allowedValues": [ "Audit", "Deny", "Disabled" ], "defaultValue": "Audit" }    },    "policyRule": {      "if": {        "allOf": [          { "field": "type", "equals": "Microsoft.Network/publicIPAddresses" },          { "value": "[resourceGroup().tags['AllowPublicIp']]", "notEquals": "true" }        ]      },      "then": { "effect": "[parameters('effect')]" }    }  }}