Azure / Guide 1

Getting started

Az PowerShell, signing in, working across subscriptions, and Azure Resource Graph.

Everything in these Azure notes can be done in the portal, but repeatable work belongs in scripts. This guide sets up the tools, explains how sign-in and subscriptions work in PowerShell, and introduces Azure Resource Graph, which most of the scripts use to report across every subscription in seconds.

About the example names

All examples use one test environment. Replace the names with your own.

Item	Example
Microsoft Entra tenant	`ravindran.onmicrosoft.com`
Subscription	`sub-notes-test`
Resource group	`rg-notes-test`
Region	East US (`eastus`)
Virtual machine	`vm-notes-test-01`
Recovery Services vault	`rsv-notes-test`
Log Analytics workspace	`log-notes-test`

Tip 1 – Pick your tool

Tool	Best for
Az PowerShell	Windows admins, reports to CSV, anything that loops over resources. All scripts on this site use it.
Azure CLI (`az`)	Quick one-liners, Linux and macOS shells, many Microsoft docs examples.
Azure Cloud Shell	Both of the above in the browser, already signed in. Nothing to install.
Bicep / Terraform	Creating infrastructure repeatably. Scripts report and fix; templates build.

Tip 2 – Install Az PowerShell for your user

Install-Module Az -Scope CurrentUser -Repository PSGallery
Install-Module Az.ResourceGraph -Scope CurrentUser   # if Search-AzGraph isn't available after installing Az
Update-Module Az                                     # keep it current; Azure changes monthly

PowerShell 7 is recommended. Az also runs in Windows PowerShell 5.1.

Connect-AzAccount -Tenant ravindran.onmicrosoft.com
Get-AzSubscription | Select-Object Name, Id, State
Set-AzContext -Subscription 'sub-notes-test'
Get-AzContext

Every Az command runs against the current context (one subscription at a time) unless the command says otherwise. Forgetting which subscription you're in is the most common way to change the wrong environment, so check Get-AzContext before anything that makes changes.

Microsoft now requires multi-factor authentication for people signing in to Azure, including through PowerShell and the CLI. Scheduled jobs should use a managed identity or a service principal instead of a user account.

Tip 4 – Loop over every subscription

Many reports need all subscriptions. The pattern:

foreach ($sub in Get-AzSubscription | Where-Object State -eq 'Enabled') {
    Set-AzContext -Subscription $sub.Id | Out-Null
    # ... work in this subscription ...
}

It works, but it's slow with many subscriptions. For read-only reporting, Resource Graph is much faster.

Tip 5 – Use Azure Resource Graph for reports

Resource Graph indexes every resource you can see, across all subscriptions, and answers queries in seconds. Queries use KQL (Kusto Query Language):

Search-AzGraph -Query @"
Resources
| where type =~ 'microsoft.compute/virtualmachines'
| summarize VMs = count() by location
| order by VMs desc
"@

Things to know:

Results come back 1,000 rows at a time at most. The scripts on this site page through results automatically.
Resource Graph shows what exists and how it's configured. It doesn't show metrics or costs.
You can try queries interactively in the portal under Resource Graph Explorer.

Tip 6 – Use managed identities for automation

A script running in Azure Automation, an Azure Function or on an Azure VM can sign in as that resource's managed identity, with no passwords or secrets to rotate:

Connect-AzAccount -Identity

Grant the identity only the roles it needs (for example Reader for reports, Virtual Machine Contributor for start/stop), at the narrowest scope that works.

Tip 7 – Always keep a transcript, and use -WhatIf

The same habits as on-premises:

Start-Transcript -Path ".\azure_$(Get-Date -Format yyyyMMdd_HHmm).log"

Most Az commands that change things support -WhatIf, and the scripts on this site that make changes do too.