---
name: azure
description: Sign in to Azure as a service principal and use the az CLI for Azure services (Speech, Azure OpenAI, storage, static sites, VMs). Use when the user wants anything on Azure. Needs AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID and AZURE_SUBSCRIPTION_ID.
---

# Azure

Four values, all read by the Azure SDKs as-is:

- `AZURE_CLIENT_ID`: the app (service principal) id
- `AZURE_CLIENT_SECRET`: its password
- `AZURE_TENANT_ID`: the directory id
- `AZURE_SUBSCRIPTION_ID`: which subscription to bill

## Sign in

```bash
az login --service-principal --username "$AZURE_CLIENT_ID" --password "$AZURE_CLIENT_SECRET" --tenant "$AZURE_TENANT_ID"
az account set --subscription "$AZURE_SUBSCRIPTION_ID"
```

Then use `az` for the job, for example `az cognitiveservices account list` or `az storage account list`. Code that uses the Azure SDK (`DefaultAzureCredential`) picks up the same variables with no login.

## Making the four values (once)

```bash
az login
az account show --query id -o tsv          # AZURE_SUBSCRIPTION_ID
az ad sp create-for-rbac --name my-agent --role contributor --scopes /subscriptions/<subscription-id>
# appId -> AZURE_CLIENT_ID, password -> AZURE_CLIENT_SECRET, tenant -> AZURE_TENANT_ID
```

The password is shown once. `az ad sp credential reset --id <appId>` makes a new one.

## Notes

- Give the principal the smallest role that does the job, scoped to one resource group when you can.
- "Interactive authentication is needed" means the tenant demands MFA for this principal. Use a certificate instead of a secret.
- No `az`? Install it from https://learn.microsoft.com/cli/azure/install-azure-cli