Skip to content

WSL-Azure-CLI-Tutorial.md

Latest commit

 

History

History
142 lines (100 loc) · 4.57 KB

WSL-Azure-CLI-Tutorial.md

File metadata and controls

142 lines (100 loc) · 4.57 KB
Raw

Azure CLI on WSL (Ubuntu)

Overview

Goal: Install and configure Azure CLI in WSL Ubuntu, understand profiles, login methods, and where tokens/profile data are stored.

Prerequisites

  • WSL Ubuntu distribution, up to date.
  • sudo access to install packages.
  • Optional: jq for inspecting JSON files.

Install Azure CLI (inside WSL Ubuntu)

# update and prerequisites
sudo apt update
sudo apt install -y ca-certificates curl apt-transport-https lsb-release gnupg

# add Microsoft signing key and repo, then install
curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
sudo install -o root -g root -m 644 microsoft.gpg /etc/apt/trusted.gpg.d/
CODENAME=$(lsb_release -cs)
echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $CODENAME main" | sudo tee /etc/apt/sources.list.d/azure-cli.list

sudo apt update
sudo apt install -y azure-cli

Notes:

  • Install the CLI inside WSL so az runs in the Linux environment. Installing only on Windows will not make az available inside WSL.

Login Methods

  • Interactive browser (default):
az login
  • Device code (no browser / remote):
az login --use-device-code
  • Service Principal (automation):
az login --service-principal -u <APP_ID> -p <CLIENT_SECRET> --tenant <TENANT_ID>
# create SP example
az ad sp create-for-rbac --name myApp --role Contributor --scopes /subscriptions/<SUB_ID>
  • Managed Identity (on Azure VM / App Service):
az login --identity
  • Useful account commands:
az account show
az account list --output table
az account set --subscription "<subscription-id-or-name>"

Profiles & Configuration files

Azure CLI stores user data under ~/.azure/.

Common files (may vary by CLI version):

  • ~/.azure/azureProfile.json — profile and subscription metadata (subscriptions, tenants, default subscription mapping).
  • ~/.azure/accessTokens.json — legacy token cache used by older auth stacks (JSON with cached access tokens) when present.
  • MSAL cache (newer auth): may appear as a binary or cache file such as ~/.azure/msal_token_cache.bin or similar; name/format can vary with CLI version and platform.
  • ~/.azure/config — CLI configuration (defaults like output format).
  • ~/.azure/clouds.config.json — configured cloud endpoints (if using non-public clouds).

Note: Exact cache filenames and formats can change across CLI releases; expect token and profile data under ~/.azure/.

Where tokens and secrets are stored

  • When you run az login, tokens and refresh tokens are persisted to files under ~/.azure/. These caches allow the CLI to refresh tokens without reauthentication.

Inspect (be careful — sensitive data):

ls -la ~/.azure
jq . ~/.azure/azureProfile.json
jq . ~/.azure/accessTokens.json  # if present
az account get-access-token --resource https://management.azure.com/

Security:

  • Treat everything under ~/.azure/ as sensitive. Do not commit these files to source control.

Token lifecycle & revocation

  • Access tokens are short-lived; refresh tokens (if present) request new access tokens.
  • az automatically uses cached refresh tokens to get new access tokens.
  • Revoke / clear local login state:
az logout
az account clear

Hardening & Best Practices

  • Restrict filesystem permissions:
chmod 700 ~/.azure
chmod 600 ~/.azure/*
  • Automation best practice: use service principals with least privilege or Managed Identities for workloads running in Azure; avoid storing personal account credentials in automation.
  • Rotate secrets and avoid long-lived credentials on developer machines.

Troubleshooting

  • No browser in WSL: use az login --use-device-code or open the URL on the Windows host browser and paste the code.
  • Certificate/HTTPS errors: ensure ca-certificates is installed and updated.
  • az not found in WSL: ensure you installed the CLI inside WSL, not only in Windows.
  • Token not refreshing: try az logout && az login or recreate service principal credentials if expired.

Quick Commands

  • Install: follow the Install section.
  • Login interactive: az login
  • Login device code: az login --use-device-code
  • Login SP: az login --service-principal -u <appId> -p <secret> --tenant <tenant>
  • Get token: az account get-access-token
  • Show account: az account show
  • Logout: az logout
  • Clear cached accounts: az account clear

Next steps

  • For automation, consider storing SPs in a secrets manager or use Managed Identities.
  • If you want, I can add a small install + secure-permissions script and save it alongside this tutorial.