AZ-ADMIN-100: Azure CLI Essentials for IaaS Administrators

Learn how the Azure CLI actually talks to Azure Resource Manager and how experienced administrators drive it — install channels and upgrade paths, sign-in with az login including managed-identity mode, subscription and default-group configuration, and the query pipeline (--query with JMESPath plus --output) that turns raw JSON into pipeline-ready text. Also covers config profiles, --only-show-errors for CI, and the difference between --verbose and --debug. By the end of this lesson you will be able to explain how the CLI transports your commands, choose the right output format for every situation, and use JMESPath filters to reduce raw ARM JSON to exactly the fields your downstream tooling needs.

Understand the mental model of az vm create end-to-end — how the CLI composes a public IP, network interface, NSG, subnet, image, and managed disk into a running virtual machine in a single command, and where each of those pieces can be swapped for one you built earlier. Covers image selection with az vm image list, image aliases like Ubuntu2404 and Win2022Datacenter, size discovery with az vm list-sizes, the four managed-disk SKUs (Standard_LRS, Premium_LRS, Premium_ZRS, UltraSSD), snapshot lifecycle, and az vm run-command invoke for post-provision customization. By the end of this lesson you will be able to reason about VM provisioning as a composition of independent resources, choose the right disk SKU for a workload, and drive OS-level actions on a running VM without ever opening SSH or RDP.

Learn the CLI shape of Azure networking — how az network vnet and az network vnet subnet compose an address space, how NSG rules evaluate in priority order with allow/deny/direction/source/destination semantics, how service tags express Azure-owned CIDRs so you never have to hard-code them, the Basic vs Standard public-IP SKU difference including zone redundancy, and how Azure Private DNS zones plus vnet-links replace legacy DNS forwarders for private-endpoint scenarios. By the end of this lesson you will be able to describe an NSG rule evaluation in your head, pick the right public-IP SKU for a workload, and reason about hub-spoke networking as a small number of composable CLI verbs.

Learn the CLI shape of Azure Storage plus the identity primitives that make storage safely usable — SKU choices (LRS, GRS, RA-GRS, ZRS), access tiers (Hot, Cool, Cold, Archive), the storage-account firewall model (VNet rules plus IP rules plus service endpoints plus private endpoints), the role-assignment syntax on az role assignment create --assignee with users, service principals, and managed identities, the distinction between system-assigned and user-assigned managed identities, and the difference between SAS-key blob access and --auth-mode login. By the end of this lesson you will be able to explain when to use a managed identity over a service principal, why --auth-mode login is the safer default for admin blob operations, and how storage RBAC roles map to actual data-plane permissions.

Move from ad-hoc CLI commands to scripts that survive real production conditions — partial failures, existing resources, changing subscription context, and running unattended in continuous integration. Covers set -euo pipefail plus --only-show-errors, the difference between a non-zero exit and an empty stdout, the idempotent create-or-update patterns admins actually use, the cross-subscription script structure (per-command --subscription vs process-wide az account set), and the modern GitHub Actions plus azure/login@v2 OIDC federated-credential flow that removes long-lived client secrets from your automation. By the end of this lesson you will be able to write a bash script that will run twice against the same subscription and make changes only on the first run.