az

OVERVIEW

The Azure CLI (github.com/Azure/azure-cli, binary `az`) is Microsoft's official command-line tool for Azure, and it covers the same enumeration ground in Azure that the AWS CLI covers in AWS: `az role assignment list`, `az storage account list`, `az vm list`, and similar commands turn a subscription's RBAC, storage, and compute configuration into scriptable JSON.

Its `az ad` and `az role` subcommands are particularly relevant for privilege-escalation research, since misconfigured custom role definitions or overly broad role assignments at the subscription or resource-group level are a common finding in Azure cloud assessments.

USE CASES

Practical use cases

• 01

  Enumerating RBAC role assignments and custom role definitions to find over-privileged principals.

• 02

  Listing storage accounts and checking public blob access or shared-key auth settings.

• 03

  Inventorying VMs, network security groups, and public IPs across resource groups.

• 04

  Querying Azure AD (Entra ID) app registrations and service principal credentials via `az ad`.

QUICK START

For scripted enumeration of an Azure subscription's RBAC assignments, storage, and compute once assessment credentials are provisioned.

1. Install the Azure CLI and run `az login` with the client-provided assessment account or service principal.
2. Run `az account show` to confirm which subscription and tenant you're actually working in.
3. Set the active subscription explicitly with `az account set --subscription <id>` if the account has more than one.
4. Start broad — `az role assignment list --all`, `az storage account list`, `az vm list` — then narrow into flagged resources.

az account show && az role assignment list --all --output table

BEFORE YOU RUN IT

What to check before running it