Rediger

Del via

Authenticate to Azure using Azure CLI

  • Artikel

The Azure CLI supports several authentication methods. Restrict sign-in permissions for your use case to keep your Azure resources secure.

Sign into Azure with Azure CLI

There are five authentication options when working with the Azure CLI:

Authentication method Advantage
Azure Cloud Shell Azure Cloud Shell automatically logs you in and is the easiest way to get started.
Sign in interactively This is a good option when learning Azure CLI commands and running the Azure CLI locally. Login through your browser with the az login command. Interactive login also gives you a subscription selector to automatically set your default subscription.
Sign in with a managed identity Managed identities provide an Azure-managed identity for applications to use when connecting to resources that support Microsoft Entra authentication. Using a managed identity eliminates the need for you to manage secrets, credentials, certificates, and keys.
Sign in using an service principal When you write scripts, using a service principal is the recommended authentication approach. You grant just the appropriate permissions needed to a service principal keeping your automation secure.

Multi-factor authentication (MFA)

Microsoft announced in May, 2024, that it will require MFA for all Azure users. For information on how to plan for this change, see Planning for mandatory multifactor authentication for Azure and other admin portals.

MFA will only impact Microsoft Entra ID users. It will not impact service principals or managed identities.

Find or change your current subscription

After you sign in, CLI commands are run against your default subscription. If you have multiple subscriptions, change your default subscription using az account set --subscription.

az account set --subscription "<subscription ID or name>"

To learn more about managing Azure subscriptions, see How to manage Azure subscriptions with the Azure CLI.

Refresh tokens

When you sign in with a user account, Azure CLI generates and stores an authentication refresh token. Because access tokens are valid for only a short period of time, a refresh token is issued at the same time the access token is issued. The client application can then exchange this refresh token for a new access token when needed. For more information on token lifetime and expiration, see Refresh tokens in the Microsoft identity platform.

Use the az account get-access-token command to retrieve the access token:

# get access token for the active subscription
az account get-access-token

# get access token for a specific subscription
az account get-access-token --subscription "<subscription ID or name>"

Here is some additional information about access token expiration dates:

  • Expiration dates are updated in a format that is supported by MSAL-based Azure CLI.
  • Starting from Azure CLI 2.54.0, az account get-access-token returns the expires_on property alongside the expiresOn property for the token expiration time.
  • The expires_on property represents a Portable Operating System Interface (POSIX) timestamp while the expiresOn property represents a local datetime.
  • The expiresOn property doesn't express "fold" when Daylight Saving Time ends. This can cause problems in countries or regions where Daylight Saving Time is adopted. For more information on "fold", see PEP 495 – Local Time Disambiguation.
  • We recommend for downstream applications to use the expires_on property, because it uses the Universal Time Code (UTC).

Example output:

{
  "accessToken": "...",
  "expiresOn": "2023-10-31 21:59:10.000000",
  "expires_on": 1698760750,
  "subscription": "...",
  "tenant": "...",
  "tokenType": "Bearer"
}

Note

Depending on your sign in method, your tenant may have Conditional Access policies that restrict your access to certain resources.

See also