Authentication & Basic Enumeration

Log in to Azure using az cli

User

export EMAIL=''
export PASSWORD=''
az login -u "$EMAIL" -p "$PASSWORD" [--allow-no-subscriptions]

ARM (Service Principal Authentication)

export ARM_CLIENT_ID=''
export ARM_SECRET=''
export TENANT_ID='fdd066e1-ee37-49bc-b08f-d0e152119b04'
az login --service-principal -u "$ARM_CLIENT_ID" -p "$ARM_SECRET" --tenant "$TENANT_ID" [--allow-no-subscriptions]

Connection Information

Displays details of the currently authenticated user.

az ad signed-in-user show

List all subscriptions accessible by the current user

az account list --output table

Usfeul information

export SUBSCRIPTION_ID=$(az account show --query id --output tsv)
export TENANT_ID=$(az account show --query tenantId --output tsv)
export MY_OID=$(az ad sp show --id <ID> --query id -o tsv)

Enumerate ARM Resources

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resources?api-version=2021-04-01" \
  | jq -r '.value[] | "\(.name) | \(.type) | \(.id)"'

Check Effective Permissions

Check what actions you can perform at each scope (subscription → resource group → resource):

At subscription level

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.Authorization/permissions?api-version=2022-04-01"

At resource group level

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/<RG>/providers/Microsoft.Authorization/permissions?api-version=2022-04-01"

At resource level

az rest --method GET \
  --url "https://management.azure.com/$RESOURCE_PATH/providers/Microsoft.Authorization/permissions?api-version=2022-04-01"

Check RBAC Role Assignments

All role assignments for current principal

az role assignment list --assignee "$CLIENT_ID" --all --output table

Inspect a custom role definition

az role definition list --name "<role-name>" \
  --query "[].permissions[0].{actions:actions, dataActions:dataActions}"