Azure CLI for coding agents

When a coding agent can run shell commands in an Azure development environment, it can use Azure CLI, Microsoft’s cross-platform CLI, to inspect and manage Azure resources with the az command. Azure CLI sends commands to Azure and returns results in formats such as JSON. For example, the agent can list resource groups, Azure containers for related resources, in the selected subscription, which identifies the Azure resources its commands address.

For the agent’s first task, ask it to check which Azure account it is using, then list resource group names and locations without changing anything. Azure CLI uses the signed-in identity’s permissions, so an operator should sign in before the agent runs commands. These examples follow Microsoft’s documentation. Azure CLI was not installed or tested for this article.

Install and check Azure CLI

Install Azure CLI using the platform-specific instructions in Microsoft’s documentation. The steps depend on whether the host runs Windows, macOS, or Linux. After installing Azure CLI, check that the az command is available:

az version

This command checks the local CLI installation. It does not list or change Azure resources.

Azure CLI sends requests to Azure when a command needs resource data. It can return JSON for a coding agent to parse or a table for a person to scan. The --query option accepts JMESPath queries, a syntax for selecting and shaping fields in JSON data.

List resource groups

The following command lists resource groups in the active subscription and selects each group’s name and location:

az group list \
  --query "[].{name:name, location:location}" \
  --output table

az group list asks Azure for resource group data without changing it. The --query expression selects the two fields from the response, and --output table formats them for display. The result has Name and Location columns. The rows depend on the active subscription and the caller’s permissions.

To return machine-readable data instead, change the output option:

az group list \
  --query "[].{name:name, location:location}" \
  --output json

Before relying on the results, check the current account and subscription:

az account show --output table

If the displayed subscription is not the intended one, stop and ask the operator to select the right subscription. The coding agent should not guess which subscription to use from resource names.

Set up authentication before the agent runs

When a person signs in interactively, az login starts Microsoft’s documented sign-in flow. It uses a browser on Linux and macOS, and Web Account Manager by default on Windows. After sign-in, the agent’s shell commands use the Azure CLI sign-in context available in that environment. See Microsoft’s instructions for interactive Azure CLI sign-in.

For automation that runs without a person present, Microsoft documents service principals and managed identities as identities for software workloads. A service principal identifies software rather than an individual user. An operator can sign in with a client secret or certificate, as described in Microsoft’s service principal sign-in instructions. Keep credentials out of the agent prompt. Configure the identity outside the conversation and give it only the Azure permissions the task needs.

Microsoft’s interactive sign-in documentation states that multifactor authentication applies to Microsoft Entra user identities beginning in September 2025. It does not apply to workload identities such as service principals or managed identities. Scripts that rely on a user name and password therefore need a workload identity for unattended use.

Give the agent a bounded task

A prompt for the example above could be:

Use Azure CLI to inspect the active Azure account, then list resource group names and locations in the active subscription as JSON. Do not create, update, or delete resources. Report the command results and stop if the active subscription is unclear.

This gives the agent a specific read-only request and names the subscription context. The agent’s commands still send requests to Azure, where Azure checks the signed-in identity’s permissions. The example does not change Azure resources.

Azure CLI also provides az rest for calling Azure’s REST APIs directly. Microsoft recommends using it when Azure CLI has no command for the task. When a command for a specific resource exists, such as az group list, use that command instead. See the Azure CLI REST command documentation.