Professional Documents
Culture Documents
Powershell For Azure
Powershell For Azure
Azure PowerShell
Introducing the new Az module
Install
Install with PowerShell Get
Install with MSI
Uninstall
Migrate from AzureRM
Migration steps
Changes between AzureRM and Az
Get started
Cloud Shell
Sign in
Authentication methods
Create a service principal
Credential contexts
Queries
Format output
Manage subscriptions
Deploy
Deploy Resource Manager templates
Export Resource Manager templates
Deploy private Resource Manager templates
Concepts
PowerShell jobs
Tutorials
Create Virtual Machines
Sample Scripts
Linux Virtual Machines
Windows Virtual Machines
Web Apps
SQL Databases
Cosmos DB
Release notes
Release notes
Az 2.0.0 breaking changes
Introducing the new Azure PowerShell Az module
10/15/2019 • 3 minutes to read • Edit Online
Starting in December 2018, the Azure PowerShell Az module is in general release and is now the intended
PowerShell module for interacting with Azure. Az offers shorter commands, improved stability, and cross-platform
support. Az also has feature parity with AzureRM, giving you an easy migration path.
With the Az module, Azure PowerShell is now compatible with PowerShell 5.1 on Windows and PowerShell Core
6.x and later on all supported platforms - including Windows, macOS, and Linux.
Az is a new module, so the version has been reset to 1.0.0.
Upgrade to Az
To keep up with the latest Azure features in PowerShell, you should migrate to the Az module as soon as possible.
If you're not ready to install the Az module as a replacement for AzureRM, you have a couple of options available
to experiment with Az:
Use a PowerShell environment with Azure Cloud Shell. Azure Cloud Shell is a browser-based shell
environment which comes with the Az module installed and Enable-AzureRM compatibility aliases enabled.
Keep the AzureRM module installed with PowerShell 5.1 for Windows, but install the Az module for PowerShell
Core 6.x or later. PowerShell 5.1 for Windows and PowerShell Core use separate collections of modules. Follow
the instructions to install PowerShell Core and then install the Az module from a PowerShell Core terminal.
To upgrade from an existing AzureRM install:
1. Uninstall the Azure PowerShell AzureRM module
2. Install the Azure PowerShell Az module
3. OPTIONAL: Enable compatibility mode to add aliases for AzureRM cmdlets with Enable-AzureRMAlias while
you become familiar with the new command set. See the next section or Start migration from AzureRM to Az
for more details.
IMPORTANT
Even though the cmdlet names are aliased, there may still be new (or renamed) parameters or changed return values for the
Az cmdlets. Don't expect enabling aliases to take care of the migration for you! See the full breaking changes list to find
where your scripts may require updates.
This article tells you how to install the Azure PowerShell modules using PowerShellGet. These instructions work
on Windows, macOS, and Linux platforms. For the Az module, currently no other installation methods are
supported.
Requirements
Azure PowerShell works with PowerShell 5.1 or higher on Windows, or PowerShell Core 6.x and later on all
platforms. If you aren't sure if you have PowerShell, or are on macOS or Linux, install the latest version of
PowerShell Core.
To check your PowerShell version, run the command:
$PSVersionTable.PSVersion
The recommended install method is to only install for the active user:
If you want to install for all users on a system, this requires administrator privileges. From an elevated PowerShell
session either run as administrator or with the sudo command on macOS or Linux:
By default, the PowerShell gallery isn't configured as a trusted repository for PowerShellGet. The first time you
use the PSGallery you see the following prompt:
Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change
its InstallationPolicy value by running the Set-PSRepository cmdlet.
Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"):
Install offline
In some environments it's not possible to connect to the PowerShell Gallery. In those situations, you can still
install offline using one of these methods:
Download the modules to another location and use that as an installation source on your network. This can
be a complicated process, but will let you cache PowerShell modules on a single server or file share to be
deployed with PowerShellGet to any disconnected systems. Learn how to set up a local repository and
install on disconnected systems with Working with local PowerShellGet repositories.
Download the Azure PowerShell MSI to a machine connected to the network, and then copy the installer to
systems without access to PowerShell Gallery. Keep in mind that the MSI installer only works for
PowerShell 5.1 on Windows.
Save the module with Save-Module to a file share, or save it to another source and manually copy it to
other machines:
Troubleshooting
Here are some common problems seen when installing the Azure PowerShell module. If you experience a
problem not listed here, please file an issue on GitHub.
Proxy blocks connection
If you get errors from Install-Module that indicate the PowerShell Gallery is unreachable, you may be behind a
proxy. Different operating systems will have different requirements for configuring a system-wide proxy, which
are not covered in detail here. Contact your system administrator for your proxy settings and how to configure
them for your OS.
PowerShell itself may not be configured to use this proxy automatically. With PowerShell 5.1 and later, configure
the proxy to use for a PowerShell session with the following command:
(New-Object System.Net.WebClient).Proxy.Credentials = `
[System.Net.CredentialCache]::DefaultNetworkCredentials
If your operating system credentials are configured correctly, this will route PowerShell requests through the
proxy. In order to have this setting persist between sessions, add the command to a PowerShell profile.
In order to install the package, your proxy needs to allow HTTPS connections to the following address:
https://www.powershellgallery.com
Sign in
To start working with Azure PowerShell, sign in with your Azure credentials.
NOTE
If you've disabled module autoloading, manually import the module with Import-Module Az . Because of the way the
module is structured, this can take a few seconds.
You'll need to repeat these steps for every new PowerShell session you start. To learn how to persist your Azure
sign-in across PowerShell sessions, see Persist user credentials across PowerShell sessions.
Although this can overwrite installed modules, you may still have older versions left on your system. To learn how
to remove old versions of Azure PowerShell from your system, see Uninstall the Azure PowerShell module.
To remove a version of Azure PowerShell, see Uninstall the Azure PowerShell module.
You can install or load a specific version of the Az module by using the -RequiredVersion argument:
If you have more than one version of the module installed, module autoload and Import-Module load the latest
version by default.
Provide feedback
If you find a bug in Azure Powershell, file an issue on GitHub. To provide feedback from the command line, use
the Send-Feedback cmdlet.
Next Steps
To learn more about the Azure PowerShell modules and their features, see Get Started with Azure PowerShell. If
you're familiar with Azure PowerShell and need to migrate from AzureRM, see Migrate from AzureRM to Az.
Install Azure PowerShell on Windows with MSI
10/23/2019 • 2 minutes to read • Edit Online
This article explains how to install Azure PowerShell on Windows using an MSI installer. The MSI installer is
provided for environments where the PowerShell Gallery may be blocked by a firewall, or an offline installer is
needed. The recommended way to install Azure PowerShell is with PowerShellGet. For instructions on using
PowerShellGet to install Azure PowerShell, see Install Azure PowerShell with PowerShellGet.
Requirements
The MSI installer for Azure PowerShell works only for PowerShell 5.1 on Windows. For installation on non-
Windows platforms or later versions of powershell, Install with PowerShellGet. To check your PowerShell version,
run the command:
$PSVersionTable.PSVersion
NOTE
If you've disabled module autoloading, you need to manually import the module with Import-Module Az . Because of the
way the module is structured, this can take up to a minute.
You'll need to repeat this step for every new PowerShell session you start. To learn how to persist your Azure sign-
in across PowerShell sessions, see Persist user credentials across PowerShell sessions.
Provide feedback
If you find a bug in Azure Powershell, file an issue on GitHub. To provide feedback from the command line, use the
Send-Feedback cmdlet.
Next Steps
To learn more about the Azure PowerShell modules and their features, see Get Started with Azure PowerShell. If
you're familiar with Azure PowerShell and need to migrate from AzureRM, see Migrate from AzureRM to Az.
Uninstall the Azure PowerShell module
10/23/2019 • 4 minutes to read • Edit Online
This article tells you how to uninstall an older version of Azure PowerShell, or completely remove it from your
system. If you've decided to completely uninstall the Azure PowerShell, give us some feedback through the Send-
Feedback cmdlet. If you encountered a bug, we'd appreciate it if you file a GitHub issue so that it can be fixed.
PLATFORM INSTRUCTIONS
Windows 7 Start > Control Panel > Programs > Uninstall a program
Windows 8
Once on this screen you should see Azure PowerShell in the program listing. This is the app to uninstall. If you
don't see this program listed, then you installed through PowerShellGet, and should follow the next set of
instructions.
The following script queries the PowerShell Gallery to get a list of dependent submodules. Then, the script
uninstalls the correct version of each submodule. You will need to have administrator access to run this script in a
scope other than Process or CurrentUser .
function Uninstall-AllModules {
param(
[Parameter(Mandatory=$true)]
[string]$TargetModule,
[Parameter(Mandatory=$true)]
[string]$Version,
[switch]$Force,
[switch]$WhatIf
)
$AllModules = @()
To use this function, copy and paste the code into your PowerShell session. The following example shows how to
run the function to remove an older version of Azure PowerShell.
As the script runs, it will display the name and version of each submodule that is being uninstalled. To run the
script to only see what would be deleted, without removing it, use the -WhatIf option.
Run this command for every version of Azure PowerShell that you want to uninstall. For convenience, the
following script will uninstall all versions of Az except for the latest.
PLATFORM INSTRUCTIONS
Windows 7 Start > Control Panel > Programs > Uninstall a program
Windows 8
Once on this screen you should see Azure PowerShell in the program listing. This is the app to uninstall. If you
don't see this program listed, then you installed through PowerShellGet, and should follow the next set of
instructions.
Uninstall from PowerShell
If you installed AzureRM with PowerShellGet, then you can remove the modules with the Uninstall-AzureRM
command, available as part of the Az.Accounts module. This removes all AzureRM modules from your machine,
but requires administrator privileges.
Uninstall-AzureRm
If you can't successfully run the Uninstall-AzureRM command, use the Uninstall-AllModules script provided in this
article with the following invocation:
The Az module has feature parity with AzureRM, but uses shorter and more consistent cmdlet names. Scripts
written for the AzureRM cmdlets won't automatically work with the new module. To make the transition easier, Az
offers tools to allow you to run your existing scripts using AzureRM. No migration to a new command set is ever
convenient, but this article will help you get started on transitioning to the new module.
To see the full list of breaking changes between AzureRM and Az, see the full changes from AzureRM to Az.
The latest available release of AzureRM is 6.13.1. If you don't have this version installed, your existing scripts
may need additional modification to work with the Az module beyond what's described here and in the breaking
changes list.
If your scripts don't work with AzureRM 6.13.1, update them according to the AzureRM 5.x to 6.x migration guide.
If you use an earlier version of the AzureRM module, there are migration guides available for each major version.
Uninstall AzureRM
The Az module is not guaranteed to be compatible with any existing AzureRM installs in PowerShell 5.1 for
Windows. Before you install the Az module, uninstall AzureRM.
IMPORTANT
If you're not ready to remove the AzureRM module from your system, you can install the Az module for PowerShell Core 6.x
or later instead. PowerShell Core and PowerShell 5.1 for Windows use different module libraries, so there will be no conflicts.
You can still enable aliases in PowerShell Core.
NOTE
At this point, you might want to run the Uninstall-AzureRM cmdlet provided in the Az module, just to make sure that all
versions of AzureRM have been uninstalled and won't cause conflicts.
Enable AzureRM compatibility aliases
With AzureRM uninstalled and your scripts working with the latest AzureRM version, the next step is to enable
the compatibility mode for the Az module. Compatibility is enabled with the command:
Aliases enable the ability to use old cmdlet names with the Az module installed. These aliases are written to the
profile for the selected scope. If no profile exists, one is created. When using a -Scope broader than CurrentUser ,
the appropriate permissions are required to create or update the corresponding profile file.
IMPORTANT
Only cmdlet names are aliased - module names aren't! If you're using #Requires , Import-Module , dependency lists in a
.psd1 , or fully-qualified cmdlet names, make sure that you migrate them at this point by following the process outlined in
the breaking changes list regarding module names.
WARNING
You can use a different -Scope for this command, but it's not recommended. Aliases are written to the user profile for the
selected scope, so keep enabling them to as limited a scope as possible. Enabling aliases system-wide can cause issues for
other users who have AzureRM installed in their local scope.
Once the alias mode is enabled, run your scripts again to confirm that they still function as expected. Some
parameter names have been changed, added, or made required by the Az module. Output types of cmdlets may
have changed as well. These changes are detailed in the breaking changes list.
Disable aliases
Once you've completed your migration and are no longer relying on aliasing behavior, it's recommended that you
disable aliases. This is done with the Disable-AzureRmAlias cmdlet.
IMPORTANT
When running this cmdlet, make sure that you invoke it for each -Scope that Enable-AzureRmAlias was invoked for,
otherwise there may still be scripts on your system relying on the aliasing behavior.
Breaking changes for Az 1.0.0
12/16/2019 • 8 minutes to read • Edit Online
This document provides detailed information on the changes between AzureRM 6.x and the new Az module,
version 1.x and later. The table of contents will help guide you through a full migration path, including module-
specific changes that may affect your scripts.
For general advice on getting started with a migration from AzureRM to Az, see Start migration from AzureRM
to Az.
IMPORTANT
There have been breaking changes between Az 1.0.0 and Az 2.0.0 as well. After following this guide for updating from
AzureRM to Az, see the Az 2.0.0 breaking changes to find out if you need to make additional changes.
Table of Contents
General breaking changes
Cmdlet noun prefix changes
Module name changes
Removed modules
Windows PowerShell 5.1 and .NET 4.7.2
Temporary removal of user login using PSCredential
Default device code login instead of web browser prompt
Module breaking changes
Az.ApiManagement (previously AzureRM.ApiManagement)
Az.Billing (previously AzureRM.Billing, AzureRM.Consumption, and AzureRM.UsageAggregates)
Az.CognitiveServices (previously AzureRM.CognitiveServices)
Az.Compute (previously AzureRM.Compute)
Az.DataFactory (previously AzureRM.DataFactories and AzureRM.DataFactoryV2)
Az.DataLakeAnalytics (previously AzureRM.DataLakeAnalytics)
Az.DataLakeStore (previously AzureRM.DataLakeStore)
Az.KeyVault (previously AzureRM.KeyVault)
Az.Media (previously AzureRM.Media)
Az.Monitor (previously AzureRM.Insights)
Az.Network (previously AzureRM.Network)
Az.OperationalInsights (previously AzureRM.OperationalInsights)
Az.RecoveryServices (previously AzureRM.RecoveryServices, AzureRM.RecoveryServices.Backup, and
AzureRM.RecoveryServices.SiteRecovery)
Az.Resources (previously AzureRM.Resources)
Az.ServiceFabric (previously AzureRM.ServiceFabric)
Az.Sql (previously AzureRM.Sql)
Az.Storage (previously Azure.Storage and AzureRM.Storage)
Az.Websites (previously AzureRM.Websites)
General breaking changes
This section details the general breaking changes that are part of the redesign of the Az module.
Cmdlet Noun Prefix Changes
In the AzureRM module, cmdlets used either AzureRM or Azure as a noun prefix. Az simplifies and normalizes
cmdlet names, so that all cmdlets use 'Az' as their cmdlet noun prefix. For example:
Get-AzureRMVM
Get-AzureKeyVaultSecret
Get-AzVM
Get-AzKeyVaultSecret
To make the transition to these new cmdlet names simpler, Az introduces two new cmdlets, Enable-AzureRmAlias
and Disable-AzureRmAlias. Enable-AzureRmAlias creates aliases for the older cmdlet names in AzureRM that
map to the newer Az cmdlet names. Using the -Scope argument with Enable-AzureRmAlias allows you to choose
where aliases are enabled.
For example, the following script in AzureRM:
Running Enable-AzureRmAlias -Scope CurrentUser will enable the aliases for all PowerShell sessions you open, so
that after executing this cmdlet, a script like this would not need to be changed at all:
For complete details on the usage of the alias cmdlets, see the Enable-AzureRmAlias reference.
When you're ready to disable aliases, Disable-AzureRmAlias removes the created aliases. For complete details, see
the Disable-AzureRmAlias reference.
IMPORTANT
When disabling aliases, make sure that they are disabled for all scopes which had aliases enabled.
Azure.Storage Az.Storage
Azure.AnalysisServices Az.AnalysisServices
AzureRM.Profile Az.Accounts
AzureRM.Insights Az.Monitor
AzureRM.DataFactories Az.DataFactory
AzureRM.DataFactoryV2 Az.DataFactory
AzureRM.RecoveryServices.Backup Az.RecoveryServices
AzureRM.RecoveryServices.SiteRecovery Az.RecoveryServices
AzureRM.Tags Az.Resources
AzureRM.MachineLearningCompute Az.MachineLearning
AzureRM.UsageAggregates Az.Billing
AzureRM.Consumption Az.Billing
The changes in module names mean that any script that uses #Requires or Import-Module to load specific
modules will need to be changed to use the new module instead. For modules where the cmdlet suffix has not
changed, this means that although the module name has changed, the suffix indicating the operation space has
not.
Migrating #Requires and Import-Module Statements
Scripts that use #Requires or Import-Module to declare a dependency on AzureRM modules must be updated to
use the new module names. For example:
For Import-Module :
Az.Compute\Get-AzVM
Removed modules
The following modules have been removed:
AzureRM.Backup
AzureRM.Compute.ManagedService
AzureRM.Scheduler
The tools for these services are no longer actively supported. Customers are encouraged to move to alternative
services as soon as it is convenient.
Windows PowerShell 5.1 and .NET 4.7.2
Using Az with PowerShell 5.1 for Windows requires the installation of .NET Framework 4.7.2. Using PowerShell
Core 6.x or later does not require .NET Framework.
Temporary removal of User login using PSCredential
Due to changes in the authentication flow for .NET Standard, we are temporarily removing user login via
PSCredential. This capability will be re-introduced in the 1/15/2019 release for PowerShell 5.1 for Windows. This
is discussed in detail in this GitHub issue.
Default device code login instead of web browser prompt
Due to changes in the authentication flow for .NET Standard, we are using device login as the default login flow
during interactive login. Web browser based login will be re-introduced for PowerShell 5.1 for Windows as the
default in the 1/15/2019 release. At that time, users will be able to choose device login using a Switch parameter.
New -AzureRmDataLakeStoreItem
Add-AzureRmDataLakeStoreItemContent
Get-AzureRmDataLakeStoreItemContent
Removed deprecated Tags property alias from New-AzDataLakeStoreAccount and
Set-AzDataLakeStoreAccount cmdlets
Scripts using
New-AzureRMDataLakeStoreAccount -Tags @{TagName="TagValue"}
Should be changed to
Should be changed to
Should be changed to
Scripts should no longer make processing decisions based on the values fo these fields.
Az.OperationalInsights (previously AzureRM.OperationalInsights)
Default parameter set for Get-AzOperationalInsightsDataSource is removed, and ByWorkspaceNameByKind
has become the default parameter set
Scripts that listed data sources using
Get-AzureRmOperationalInsightsDataSource
Az:
Share Snapshot
AzureRM:
Az:
Az:
$b = Get-AzStorageBlob -Container $containerName -Blob $blobName -IncludeDeleted -Context $ctx
$task = $b.ICloudBlob.UndeleteAsync()
$task.Wait()
Az:
Azure PowerShell is designed for managing and administering Azure resources from the command line. Use
Azure PowerShell when you want to build automated tools that use the Azure Resource Manager model. Try it out
in your browser with Azure Cloud Shell, or install on your local machine.
This article helps you get started with Azure PowerShell and teaches the core concepts behind it.
Sign in to Azure
Sign in interactively with the Connect-AzAccount cmdlet. Skip this step if you use Cloud Shell: Your Azure Cloud
Shell session is already authenticated for the environment, subscription, and tenant that launched the Cloud Shell
session.
Connect-AzAccount
If you're in a non-US region, use the -Environment parameter to sign in. Get the name of the environment for your
region by using the Get-AzEnvironment cmdlet. For example, to sign in to Azure China 21Vianet:
In PowerShell 5.1 environments, you'll get a sign-in dialog to provide a username and password for your Azure
account. On every other version of PowerShell, you'll get a token to use on [https://microsoft.com/devicelogin].
Open this page in your browser and enter the token, then sign in with your Azure account credentials and
authorize Azure PowerShell.
After signing in, you'll see information indicating which of your Azure subscriptions is active. If you have multiple
Azure subscriptions in your account and want to select a different one, get your available subscriptions with Get-
AzSubscription and use the Set-AzContext cmdlet with your subscription ID. For more information about
managing your Azure subscriptions in Azure PowerShell, see Use multiple Azure subscriptions.
Once signed in, use the Azure PowerShell cmdlets to access and manage resources in your subscription. To learn
more about the sign-in process and authentication methods, see Sign in with Azure PowerShell.
Find commands
Azure PowerShell cmdlets follow a standard naming convention for PowerShell, VERB-NOUN . The verb describes
the action (examples include New , Get , Set , Remove ) and the noun describes the resource type (examples
include AzVM , AzKeyVaultCertificate , AzFirewall , AzVirtualNetworkGateway ). Nouns in Azure PowerShell always
start with the prefix Az . For the full list of standard verbs, see Approved verbs for PowerShell Commands.
Knowing the nouns, verbs, and the Azure PowerShell modules available help you find commands with the Get-
Command cmdlet. For example, to find all VM -related commands that use the Get verb:
To help you find common commands, this table lists the resource type, corresponding Azure PowerShell module,
and noun prefix to use with Get-Command :
For a full list of the modules in Azure PowerShell, see the Azure PowerShell modules list hosted on GitHub.
Next steps
Sign in with Azure PowerShell
Manage Azure subscriptions with Azure PowerShell
Create service principals with Azure PowerShell
Get help from the community:
Azure forum on MSDN
Stack Overflow
Sign in with Azure PowerShell
10/15/2019 • 4 minutes to read • Edit Online
Azure PowerShell supports several authentication methods. The easiest way to get started is with Azure Cloud
Shell, which automatically logs you in. With a local install, you can sign in interactively through your browser.
When writing scripts for automation, the recommended approach is to use a service principal with the necessary
permissions. When you restrict sign-in permissions as much as possible for your use case, you help keep your
Azure resources secure.
After signing in, commands are run against your default subscription. To change your active subscription for a
session, use the Set-AzContext cmdlet. To change the default subscription used when logging in with Azure
PowerShell, use Set-AzDefault.
IMPORTANT
Your credentials are shared among multiple PowerShell sessions as long as you remain signed in. For more information, see
the article on Persistent Credentials.
Sign in interactively
To sign in interactively, use the Connect-AzAccount cmdlet.
Connect-AzAccount
When run, this cmdlet will present a token string. To sign in, copy this string and paste it into
https://microsoft.com/devicelogin in a browser. Your PowerShell session will be authenticated to connect to Azure.
IMPORTANT
Username/password credential authorization has been removed in Azure PowerShell due to changes in Active Directory
authorization implementations and security concerns. If you use credential authorization for automation purposes, instead
create a service principal.
$pscredential = Get-Credential
Connect-AzAccount -ServicePrincipal -Credential $pscredential -Tenant $tenantId
For automation scenarios, you need to create credentials from a user name and secure string:
Make sure that you use good password storage practices when automating service principal connections.
Certificate -based authentication
Certificate-based authentication requires that Azure PowerShell can retrieve information from a local certificate
store based on a certificate thumbprint.
When using a service principal instead of a registered application, add the -ServicePrincipal argument and
provide the service principal's ID as the -ApplicationId parameter's value.
In PowerShell 5.1, the certificate store can be managed and inspected with the PKI module. For PowerShell Core
6.x and later, the process is more complicated. The following scripts show you how to import an existing certificate
into the certificate store accessible by PowerShell.
Import a certificate in PowerShell 5.1
# Import a PFX
$credentials = Get-Credential -Message "Provide PFX private key password"
Import-PfxCertificate -FilePath <path to certificate> -Password $credentials.Password -CertStoreLocation
cert:\CurrentUser\My
# Import a PFX
$storeName = [System.Security.Cryptography.X509Certificates.StoreName]::My
$storeLocation = [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
$store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, $storeLocation)
$certPath = <path to certificate>
$credentials = Get-Credential -Message "Provide PFX private key password"
$flag = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
$certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($certPath,
$credentials.Password, $flag)
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$store.Add($Certificate)
$store.Close()
Automated tools that use Azure services should always have restricted permissions. Instead of having applications
sign in as a fully privileged user, Azure offers service principals.
An Azure service principal is an identity created for use with applications, hosted services, and automated tools to
access Azure resources. This access is restricted by the roles assigned to the service principal, giving you control
over which resources can be accessed and at which level. For security reasons, it's always recommended to use
service principals with automated tools rather than allowing them to log in with a user identity.
This article shows you the steps for creating, getting information about, and resetting a service principal with
Azure PowerShell.
NOTE
If your account doesn't have permission to create a service principal, New-AzADServicePrincipal will return an error
message containing "Insufficient privileges to complete the operation." Contact your Azure Active Directory admin to create
a service principal.
There are two types of authentication available for service principals: Password-based authentication, and
certificate-based authentication.
Password-based authentication
Without any other authentication parameters, password-based authentication is used and a random password
created for you. If you want password-based authentication, this method is recommended.
The returned object contains the Secret member, which is a SecureString containing the generated password.
Make sure that you store this value somewhere secure to authenticate with the service principal. Its value won't
be displayed in the console output. If you lose the password, reset the service principal credentials.
The following code will allow you to export the secret:
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($sp.Secret)
$UnsecureSecret = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
The object returned from New-AzADServicePrincipal contains the Id and DisplayName members, either of which
can be used for sign in with the service principal.
IMPORTANT
Signing in with a service principal requires the tenant ID which the service principal was created under. To get the active
tenant when the service principal was created, run the following command immediately after service principal creation:
(Get-AzContext).Tenant.Id
You can also use the -KeyCredential parameter, which takes PSADKeyCredential objects. These objects must have
a valid StartDate , EndDate , and have the CertValue member set to a base64-encoded ASCII string of the public
certificate.
The object returned from New-AzADServicePrincipal contains the Id and DisplayName members, either of which
can be used for sign in with the service principal. Clients which sign in with the service principal also need access
to the certificate's private key.
IMPORTANT
Signing in with a service principal requires the tenant ID which the service principal was created under. To get the active
tenant when the service principal was created, run the following command immediately after service principal creation:
(Get-AzContext).Tenant.Id
IMPORTANT
Role assignment cmdlets don't take the service principal object ID. They take the associated application ID, which is
generated at creation time. To get the application ID for a service principal, use Get-AzADServicePrincipal .
NOTE
If your account doesn't have permission to assign a role, you see an error message that your account "does not have
authorization to perform action 'Microsoft.Authorization/roleAssignments/write'." Contact your Azure Active Directory
admin to manage roles.
Adding a role doesn't restrict previously assigned permissions. When restricting a service principal's permissions,
the Contributor role should be removed.
The changes can be verified by listing the assigned roles:
Certificate-based authentication requires that Azure PowerShell can retrieve information from a local certificate
store based on a certificate thumbprint.
Connect-AzAccount -ServicePrincipal -Tenant <tenant ID> -CertificateThumbprint <thumbprint>
For instructions on importing a certificate into a credential store accessible by PowerShell, see Sign in with Azure
PowerShell
Reset credentials
If you forget the credentials for a service principal, use New -AzADSpCredential to add a new credential. This
cmdlet takes the same credential arguments and types as New-AzADServicePrincipal . Without any credential
arguments, a new PasswordCredential with a random password is created.
IMPORTANT
Before assigning any new credentials, you may want to remove existing credentials to prevent sign in with them. To do so,
use the Remove-AzADSpCredential cmdlet:
Azure PowerShell uses Azure PowerShell context objects (Azure contexts) to hold subscription and authentication
information. If you have more than one subscription, Azure contexts let you select the subscription to run Azure
PowerShell cmdlets on. Azure contexts are also used to store sign-in information across multiple PowerShell
sessions and run background tasks.
This article covers managing Azure contexts, not the management of subscriptions or accounts. If you're looking
to manage users, subscriptions, tenants, or other account information, see the Azure Active Directory
documentation. To learn about using contexts for running background or parallel tasks, see Use Azure PowerShell
cmdlets in PowerShell jobs after becoming familiar with Azure contexts.
Get-AzContext -ListAvailable
Context names may be different from the name of the associated subscription.
IMPORTANT
The available Azure contexts aren't always your available subscriptions. Azure contexts only represent locally-stored
information. You can get your subscriptions with the Get-AzSubscription cmdlet.
If the argument is omitted, then the subscription's name and ID are used as the context name in the format
-Name
Subscription Name (subscription-id) .
Set-AzContext -Context $(Get-AzContext -Name "mycontext") # Set a context with an inline Azure context object
Get-AzContext -Name "mycontext" | Select-AzContext # Set a context with a piped Azure context object
Like many other account and context management commands in Azure PowerShell, Set-AzContext and
Select-AzContext support the -Scope argument so that you can control how long the context is active. -Scope
lets you change a single session's active context without changing the default:
To avoid switching contexts for a whole PowerShell session, all Azure PowerShell commands can be run against a
given context with the -AzContext argument:
The other main use of contexts with Azure PowerShell cmdlets is to run background commands. To learn more
about running PowerShell Jobs using Azure PowerShell, see Run Azure PowerShell cmdlets in PowerShell Jobs.
The Azure context returned as part of this sign in is valid for the current session only and will not be
automatically saved, regardless of the Azure PowerShell context autosave setting.
Disable AzurePowershell's context autosave with the Disable-AzContextAutosave cmdlet. Disabling context
autosave doesn't clear any stored tokens. To learn how to clear stored Azure context information, see
Remove Azure contexts and credentials.
Explicitly enable Azure context autosave can be enabled with the Enable-AzContextAutosave cmdlet. With
autosave enabled, all of a user's contexts are stored locally for later PowerShell sessions.
Manually save contexts with Save-AzContext to be used in future PowerShell sessions, where they can be
loaded with Import-AzContext:
WARNING
Disabling context autosave doesn't clear any stored context information that was saved. To remove stored information, use
the Clear-AzContext cmdlet. For more on removing saved contexts, see Remove contexts and credentials.
Each of these commands supports the -Scope parameter, which can take a value of Process to only apply to the
current running process. For example, to ensure that newly created contexts aren't saved after exiting a
PowerShell session:
Context information and tokens are stored in the $env:USERPROFILE\.Azure directory on Windows, and on
$HOME/.Azure on other platforms. Sensitive information such as subscription IDs and tenant IDs may still be
exposed in stored information, through logs or saved contexts. To learn how to clear stored information, see the
Remove contexts and credentials section.
If you remove the active context, you will be disconnected from Azure and need to reauthenticate with
Connect-AzAccount .
See also
Run Azure PowerShell cmdlets in PowerShell Jobs
Azure Active Directory Terminology
Az.Accounts reference
Query output of Azure PowerShell
10/15/2019 • 2 minutes to read • Edit Online
The results of each Azure PowerShell cmdlet are an Azure PowerShell object. Even cmdlets that aren't explicitly
Get- operations might return a value that can be inspected, to give information about a resource that was created
or modified. While most cmdlets return a single object, some return an array that should be iterated through.
In almost all cases, you query output from Azure PowerShell with the Select-Object cmdlet, often abbreviated to
select . Output can be filtered with Where-Object, or its alias where .
ResourceGroupName : TESTGROUP
Id : /subscriptions/711d8ed1-b888-4c52-8ab9-
66f07b87eb6b/resourceGroups/TESTGROUP/providers/Micro
soft.Compute/virtualMachines/TestVM
VmId : 711d8ed1-b888-4c52-8ab9-66f07b87eb6b
Name : TestVM
Type : Microsoft.Compute/virtualMachines
Location : westus2
LicenseType :
Tags : {}
AvailabilitySetReference :
DiagnosticsProfile :
Extensions : {}
HardwareProfile : Microsoft.Azure.Management.Compute.Models.HardwareProfile
InstanceView :
NetworkProfile : Microsoft.Azure.Management.Compute.Models.NetworkProfile
OSProfile : Microsoft.Azure.Management.Compute.Models.OSProfile
Plan :
ProvisioningState : Succeeded
StorageProfile : Microsoft.Azure.Management.Compute.Models.StorageProfile
DisplayHint : Compact
Identity :
Zones : {}
FullyQualifiedDomainName :
AdditionalCapabilities :
RequestId : 711d8ed1-b888-4c52-8ab9-66f07b87eb6b
StatusCode : OK
Once you know the names of the properties that you're interested in, you can use those property names with
Select-Object to get them directly:
Name OSType
---- ------
TestVM Linux
TestVM2 Linux
WinVM Windows
Each dictionary argument selects one property from the object. The property to extract must be part of an
expression.
Filter results
The Where-Object cmdlet allows you to filter the result based on any property value, including nested properties.
The next example shows how to use Where-Object to find the Linux VMs in a resource group.
You can pipe the results of Select-Object and Where-Object to each other. For performance purposes, it's always
recommended to put the Where-Object operation before Select-Object :
By default each Azure PowerShell cmdlet formats output to be easy to read. PowerShell allows you to convert or
format cmdlet output by piping to one of the following cmdlets:
FORMATTING CONVERSION
Format-Custom ConvertTo-Csv
Format-List ConvertTo-Html
Format-Table ConvertTo-Json
Format-Wide ConvertTo-Xml
Formatting is used for display in a PowerShell terminal, and conversion is used for generating data to be
consumed by other scripts or programs.
Get-AzVM
The amount of data displayed by Format-Table can be affected by the width of your PowerShell session window.
To restrict the output to specific properties and order them, property names can be provided as arguments to
Format-Table :
ResourceGroupName : QueryExample
Id :
/subscriptions/.../resourceGroups/QueryExample/providers/Microsoft.Compute/virtualMachines/ExampleLinuxVM
VmId : ...
Name : ExampleLinuxVM
Type : Microsoft.Compute/virtualMachines
Location : westus2
...
HardwareProfile : Microsoft.Azure.Management.Compute.Models.HardwareProfile
InstanceView :
NetworkProfile : Microsoft.Azure.Management.Compute.Models.NetworkProfile
OSProfile : Microsoft.Azure.Management.Compute.Models.OSProfile
...
StatusCode : OK
ResourceGroupName : QueryExample
Id :
/subscriptions/.../resourceGroups/QueryExample/providers/Microsoft.Compute/virtualMachines/RHELExample
VmId : ...
Name : RHELExample
Type : Microsoft.Compute/virtualMachines
Location : westus2
...
Like Format-Table , property names can be provided to order and restrict the output:
ResourceGroupName : QueryExample
Name : ExampleLinuxVM
Location : westus2
ResourceGroupName : QueryExample
Name : RHELExample
Location : westus2
ResourceGroupName : QueryExample
Name : WinExampleVM
Location : westus2
Get-AzVM | Format-Wide
ExampleLinuxVM RHELExample
WinExampleVM
Get-AzVM | Format-Wide ResourceGroupName
QueryExample QueryExample
QueryExample
Get-AzVM | Format-Custom
ResourceGroupName : QueryExample
Id :
/subscriptions/.../resourceGroups/QueryExample/providers/Microsoft.Compute/virtualMachines/ExampleLinuxVM
VmId : ...
Name : ExampleLinuxVM
Type : Microsoft.Compute/virtualMachines
Location : westus2
Tags : {}
HardwareProfile : {VmSize}
NetworkProfile : {NetworkInterfaces}
OSProfile : {ComputerName, AdminUsername, LinuxConfiguration, Secrets,
AllowExtensionOperations}
ProvisioningState : Succeeded
StorageProfile : {ImageReference, OsDisk, DataDisks}
...
Giving property names as arguments to Custom-Format displays the property/value pairs for custom objects set as
values:
AllowExtensionOperations = True
}
}
...
class PSVirtualMachineList
{
Name = WinExampleVM
ResourceGroupName = QueryExample
Location = westus2
OSProfile =
class OSProfile
{
ComputerName = WinExampleVM
AdminUsername = ...
AdminPassword =
CustomData =
WindowsConfiguration =
class WindowsConfiguration
{
ProvisionVMAgent = True
EnableAutomaticUpdates = True
TimeZone =
AdditionalUnattendContent =
WinRM =
}
LinuxConfiguration =
Secrets =
[
]
AllowExtensionOperations = True
}
}
Get-AzVM | ConvertTo-CSV
#TYPE Microsoft.Azure.Commands.Compute.Models.PSVirtualMachineList
"ResourceGroupName","Id","VmId","Name","Type","Location","LicenseType","Tags","AvailabilitySetReference","Diag
nosticsProfile","Extensions","HardwareProfile","InstanceView","NetworkProfile","OSProfile","Plan","Provisionin
gState","StorageProfile","DisplayHint","Identity","Zones","FullyQualifiedDomainName","AdditionalCapabilities",
"RequestId","StatusCode"
"QUERYEXAMPLE","/subscriptions/.../resourceGroups/QUERYEXAMPLE/providers/Microsoft.Compute/virtualMachines/Exa
mpleLinuxVM","...","ExampleLinuxVM","Microsoft.Compute/virtualMachines","westus2",,"System.Collections.Generic
.Dictionary`2[System.String,System.String]",,,"System.Collections.Generic.List`1[Microsoft.Azure.Management.Co
mpute.Models.VirtualMachineExtension]","Microsoft.Azure.Management.Compute.Models.HardwareProfile",,"Microsoft
.Azure.Management.Compute.Models.NetworkProfile","Microsoft.Azure.Management.Compute.Models.OSProfile",,"Succe
eded","Microsoft.Azure.Management.Compute.Models.StorageProfile","Compact",,"System.Collections.Generic.List`1
[System.String]",,,"...","OK"
"QUERYEXAMPLE","/subscriptions/.../resourceGroups/QUERYEXAMPLE/providers/Microsoft.Compute/virtualMachines/RHE
LExample","...","RHELExample","Microsoft.Compute/virtualMachines","westus2",,"System.Collections.Generic.Dicti
onary`2[System.String,System.String]",,,"System.Collections.Generic.List`1[Microsoft.Azure.Management.Compute.
Models.VirtualMachineExtension]","Microsoft.Azure.Management.Compute.Models.HardwareProfile",,"Microsoft.Azure
.Management.Compute.Models.NetworkProfile","Microsoft.Azure.Management.Compute.Models.OSProfile",,"Succeeded",
"Microsoft.Azure.Management.Compute.Models.StorageProfile","Compact",,"System.Collections.Generic.List`1[Syste
m.String]",,,"...","OK"
"QUERYEXAMPLE","/subscriptions/.../resourceGroups/QUERYEXAMPLE/providers/Microsoft.Compute/virtualMachines/Win
ExampleVM","...","WinExampleVM","Microsoft.Compute/virtualMachines","westus2",,"System.Collections.Generic.Dic
tionary`2[System.String,System.String]",,,"System.Collections.Generic.List`1[Microsoft.Azure.Management.Comput
e.Models.VirtualMachineExtension]","Microsoft.Azure.Management.Compute.Models.HardwareProfile",,"Microsoft.Azu
re.Management.Compute.Models.NetworkProfile","Microsoft.Azure.Management.Compute.Models.OSProfile",,"Succeeded
","Microsoft.Azure.Management.Compute.Models.StorageProfile","Compact",,"System.Collections.Generic.List`1[Sys
tem.String]",,,"...","OK"
Conversion to JSON
JSON output doesn't expand all properties by default. To change the depth of properties expanded, use the
-Depth argument. By default, the expansion depth is 2 .
Get-AzVM|ConvertTo-JSON
],
"FullyQualifiedDomainName": null,
"AdditionalCapabilities": null,
"RequestId": "...",
"StatusCode": 200
},
...
]
Conversion to XML
The ConvertTo-XML cmdlet converts the Azure PowerShell response object into a pure XML object, which can be
handled like any other XML object within PowerShell.
Get-AzVM | ConvertTo-XML
xml Objects
--- -------
version="1.0" encoding="utf-8" Objects
Conversion to HTML
Converting an object to HTML produces output that will be rendered as an HTML table. Rendering of the HTML
will depend on your browser behavior for rendering tables which contain no width information. No custom class
objects are expanded.
Get-AzVM | ConvertTo-HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>HTML TABLE</title>
</head><body>
<table>
<colgroup><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/>
<col/><col/><col/><col/><col/><col/><col/><col/><col/></colgroup>
<tr><th>ResourceGroupName</th><th>Id</th><th>VmId</th><th>Name</th><th>Type</th><th>Location</th>
<th>LicenseType</th><th>Tags</th><th>AvailabilitySetReference</th><th>DiagnosticsProfile</th>
<th>Extensions</th><th>HardwareProfile</th><th>InstanceView</th><th>NetworkProfile</th><th>OSProfile</th>
<th>Plan</th><th>ProvisioningState</th><th>StorageProfile</th><th>DisplayHint</th><th>Identity</th>
<th>Zones</th><th>FullyQualifiedDomainName</th><th>AdditionalCapabilities</th><th>RequestId</th>
<th>StatusCode</th></tr>
<tr><td>QUERYEXAMPLE</td>
<td>/subscriptions/.../resourceGroups/QUERYEXAMPLE/providers/Microsoft.Compute/virtualMachines/ExampleLinuxVM<
/td><td>...</td><td>ExampleLinuxVM</td><td>Microsoft.Compute/virtualMachines</td><td>westus2</td><td></td>
<td>System.Collections.Generic.Dictionary`2[System.String,System.String]</td><td></td><td></td>
<td>System.Collections.Generic.List`1[Microsoft.Azure.Management.Compute.Models.VirtualMachineExtension]</td>
<td>Microsoft.Azure.Management.Compute.Models.HardwareProfile</td><td></td>
<td>Microsoft.Azure.Management.Compute.Models.NetworkProfile</td>
<td>Microsoft.Azure.Management.Compute.Models.OSProfile</td><td></td><td>Succeeded</td>
<td>Microsoft.Azure.Management.Compute.Models.StorageProfile</td><td>Compact</td><td></td>
<td>System.Collections.Generic.List`1[System.String]</td><td></td><td></td><td>...</td><td>OK</td></tr>
<tr><td>QUERYEXAMPLE</td>
<td>/subscriptions/.../resourceGroups/QUERYEXAMPLE/providers/Microsoft.Compute/virtualMachines/RHELExample</td
><td>...</td><td>RHELExample</td><td>Microsoft.Compute/virtualMachines</td><td>westus2</td><td></td>
<td>System.Collections.Generic.Dictionary`2[System.String,System.String]</td><td></td><td></td>
<td>System.Collections.Generic.List`1[Microsoft.Azure.Management.Compute.Models.VirtualMachineExtension]</td>
<td>Microsoft.Azure.Management.Compute.Models.HardwareProfile</td><td></td>
<td>Microsoft.Azure.Management.Compute.Models.NetworkProfile</td>
<td>Microsoft.Azure.Management.Compute.Models.OSProfile</td><td></td><td>Succeeded</td>
<td>Microsoft.Azure.Management.Compute.Models.StorageProfile</td><td>Compact</td><td></td>
<td>System.Collections.Generic.List`1[System.String]</td><td></td><td></td><td>...</td><td>OK</td></tr>
<tr><td>QUERYEXAMPLE</td>
<td>/subscriptions/.../resourceGroups/QUERYEXAMPLE/providers/Microsoft.Compute/virtualMachines/WinExampleVM</t
d><td>...</td><td>WinExampleVM</td><td>Microsoft.Compute/virtualMachines</td><td>westus2</td><td></td>
<td>System.Collections.Generic.Dictionary`2[System.String,System.String]</td><td></td><td></td>
<td>System.Collections.Generic.List`1[Microsoft.Azure.Management.Compute.Models.VirtualMachineExtension]</td>
<td>Microsoft.Azure.Management.Compute.Models.HardwareProfile</td><td></td>
<td>Microsoft.Azure.Management.Compute.Models.NetworkProfile</td>
<td>Microsoft.Azure.Management.Compute.Models.OSProfile</td><td></td><td>Succeeded</td>
<td>Microsoft.Azure.Management.Compute.Models.StorageProfile</td><td>Compact</td><td></td>
<td>System.Collections.Generic.List`1[System.String]</td><td></td><td></td><td>...</td><td>OK</td></tr>
</table>
</body></html>
Use multiple Azure subscriptions
10/15/2019 • 2 minutes to read • Edit Online
Most Azure users will only ever have a single subscription. However, if you are part of more than one organization
or your organization has divided up access to certain resources across groupings, you may have multiple
subscriptions within Azure. The CLI supports selecting a subscription both globally and per command.
For detailed information on subscriptions, billing, and cost management, see the billing and cost management
documentation.
To learn more about Azure PowerShell contexts, including how to save them and quickly switch between them for
working with multiple subscriptions easily, see Persist credentials with Azure PowerShell contexts.
Run Azure PowerShell cmdlets in PowerShell Jobs
10/23/2019 • 2 minutes to read • Edit Online
Azure PowerShell depends on connecting to an Azure cloud and waiting for responses, so most of these cmdlets
block your PowerShell session until they get a response from the cloud. Powershell Jobs let you run cmdlets in the
background or do multiple tasks on Azure at once, from inside a single PowerShell session.
This article is a brief overview of how to run Azure PowerShell cmdlets as PowerShell Jobs and check for
completion. Running commands in Azure PowerShell requires the use of Azure PowerShell contexts, which are
covered in detail in Azure contexts and sign-in credentials. To learn more about PowerShell Jobs, see About
PowerShell Jobs.
Use the -AzContext parameter with any Azure PowerShell cmdlets to provide an Azure context object:
$creds = Get-Credential
$job = New-AzVM -Name MyVm -Credential $creds -AsJob
To see if a cmdlet supports -AsJob , check its reference documentation. The -AsJob switch doesn't require
context autosave to be enabled.
You can check the status of a running job with the Get-Job cmdlet. To get the output from a job so far, use the
Receive-Job cmdlet.
To check an operation's progress remotely on Azure, use the Get- cmdlets associated with the type of resource
being modified by the job:
$creds = Get-Credential
$context = Get-AzContext -Name 'mycontext'
$vmName = "MyVm"
$job = Start-Job { param($context, $vmName, $vmadmin) New-AzVM -Name $vmName -AzContext $context -Credential
$vmadmin} -ArgumentList $context,$vmName,$creds }
Get-Job $job
Get-AzVM -Name $vmName
See Also
Azure PowerShell contexts
About PowerShell Jobs
Get-Job reference
Receive-Job reference
2.8.0 - October 2019
12/16/2019 • 42 minutes to read • Edit Online
General
Az.HealthcareApis 1.0.0 release
Az.Accounts
Update telemetry and url rewriting for generated modules, fix windows unit tests.
Az.ApiManagement
Set-AzApiManagementApi - Added support for Updating Api into ApiVersionSet
Fix for issue https://github.com/Azure/azure-powershell/issues/10068
Az.Automation
Fixed New -AzureAutomationSoftwareUpdateConfiguration cmdlet for Linux reboot setting parameter.
Az.Batch
Get-AzBatchNodeAgentSku is deprecated and will be replaced by Get-AzBatchSupportImage in version
2.0.0.
Az.Compute
Add Priority, EvictionPolicy, and MaxPrice parameters to New -AzVM and New -AzVmss cmdlets
Fix warning message and help document for Add-AzVMAdditionalUnattendContent and Add-
AzVMSshPublicKey cmdlets
Fix -skipVmBackup exception for Linux VMs with managed disks for Set-AzVMDiskEncryptionExtension.
Fix bug in update encryption settings in Set-AzVMDiskEncryptionExtension, two pass scenario.
Az.DataFactory
Adding CRUD commands for ADF V2 data flow: Set-AzDataFactoryV2DataFlow, Remove-
AzDataFactoryV2DataFlow, and Get-AzDataFactoryV2DataFlow.
Adding action commands for ADF V2 data flow debug Session: Start-AzDataFactoryV2DataFlowDebugSession,
Get-AzDataFactoryV2DataFlowDebugSession, Add-AzDataFactoryV2DataFlowDebugSessionPackage, Invoke-
AzDataFactoryV2DataFlowDebugSessionCommand and Stop-AzDataFactoryV2DataFlowDebugSession.
Update ADF .Net SDK version to 4.2.0
Az.DataLakeStore
Fix account validation so that accounts with '-' can be passed without domain
Az.HealthcareApis
Updated the powershell version to 1.0.0
Updated the SDK version to 1.0.2
Update in tests to refer to new SDK version
Updated the output structure from nested to flattened.
Az.IotHub
Add new routing source: DigitalTwinChangeEvents
Minor bug fix: Get-AzIothub not returning subscriptionId
Az.Monitor
New action group receivers added for New -AzActionGroupReceiver: -ItsmReceiver -VoiceReceiver -
ArmRoleReceiver -AzureFunctionReceiver -LogicAppReceiver -AutomationRunbookReceiver -
AzureAppPushReceiver
Use common alert schema enabled for the receivers. This is not applicable for SMS, Azure App push , ITSM and
Voice recievers
Webhooks now supports Azure active directory authentication.
Az.Network
Add new cmdlet Get-AzAvailableServiceAlias which can be called to get the aliases that can be used for Service
Endpoint Policies.
Added support for the adding traffic selectors to Virtual Network Gateway Connections
New cmdlets added:
New -AzIpsecTrafficSelectorPolicy
Cmdlets updated with optional parameter -TrafficSelectorPolicies
New -AzVirtualNetworkGatewayConnection
Set-AzVirtualNetworkGatewayConnection
Add support for ESP and AH protocols in network security rule configurations
Updated cmdlets:
Add-AzNetworkSecurityRuleConfig
New -AzNetworkSecurityRuleConfig
Set-AzNetworkSecurityRuleConfig
Improve handling of exceptions in Cortex cmdlets
New Generations and SKUs for VirtualNetworkGateways
Introduce new Generations for VirtualNetworkGateways.
Introduce new high throughput SKUs for VirtualNetworkGateways.
Az.RedisCache
Updated 'Set-AzRedisCache' reference documentation to include missing values for '-Size' parameter
Az.Sql
Add support for setting Active Directory Administrator on Managed Instance
Az.Storage
Upgrade Storage Client Library to 11.1.0
List containers with Management plane API, will list with NextPageLink
Get-AzRmStorageContainer
List Storage accounts from subscription, will list with NextPageLink
Get-AzStorageAccount
Az.StorageSync
Fix Issue 9810 in Reset-AzStorageSyncServerCertificate.
Az.Websites
Set-AzWebApp updating ASP of an app was failing
Az.ServiceBus
Fix for issue #4938 - New -AzureRmServiceBusQueue returns BadRequest when setting MaxSizeInMegabytes
Az.Sql
Add Instance Failover Group cmdlets from preview release to public release
Support Azure SQL Server\Database Auditing with new cmdlets.
Set-AzSqlServerAudit
Get-AzSqlServerAudit
Remove-AzSqlServerAudit
Set-AzSqlDatabaseAudit
Get-AzSqlDatabaseAudit
Remove-AzSqlDatabaseAudit
Remove email constraints from Vulnerability Assessment settings
Az.Storage
Change 2 parameters '-IndexDocument' and '-ErrorDocument404Path' from required to optional in cmdlet:
Enable-AzStorageStaticWebsite
Update help of Get-AzStorageBlobContent by add an example
Show more error information when cmdlet failed with StorageException
Support create or update Storage account with Azure Files AAD DS Authentication
New -AzStorageAccount
Set-AzStorageAccount
Support list or close file handles of a file share, file directory or a file
Get-AzStorageFileHandle
Close-AzStorageFileHandle
Az.StorageSync
This module is now included as a part of the roll-up Az module
'Get-AzApiManagementApiRelease'
Get-AzApiManagementApiRelease -ResourceId
/subscriptions/subid/resourceGroups/rgName/providers/Microsoft.ApiManagement/service/con
toso/apis/echo-api/releases/releaseId
'Get-AzApiManagementApiVersionSet'
Get-AzApiManagementApiVersionSet -ResourceId
/subscriptions/subid/resourceGroups/rgName/providers/Microsoft.ApiManagement/service/con
stoso/apiversionsets/pathversionset
'Get-AzApiManagementAuthorizationServer'
'Get-AzApiManagementBackend'
Get-AzApiManagementBackend -ResourceId
/subscriptions/subid/resourceGroups/rgName/providers/Microsoft.ApiManagement/service/con
toso/backends/servicefabric
'Get-AzApiManagementCertificate'
'Remove-AzApiManagementApiVersionSet'
'Remove-AzApiManagementSubscription'
Az.Automation
Updated Get-AzAutomationJobOutputRecord to handle JSON and Text record values.
Fix for issue https://github.com/Azure/azure-powershell/issues/7977
Fix for issue https://github.com/Azure/azure-powershell/issues/8600
Changed behavior for Start-AzAutomationDscCompilationJob to just start the job instead of waiting for its
completion.
Fix for issue https://github.com/Azure/azure-powershell/issues/8347
Fix for Get-AzAutomationDscNode when using -Name returns all node. Now it returns matching node only.
Az.Compute
Add ProtectFromScaleIn and ProtectFromScaleSetAction parameters to Update-AzVmssVM cmdlet.
New -AzVM wimple parameter set now uses by default an available location if 'East US' is not supported
Az.DataLakeStore
Update the ADLS sdk to use httpclient, integrate dataplane testing with azure framework
Az.Monitor
Fixed incorrect parameter names in help examples
Az.Network
Add DisableBgpRoutePropagation flag to Effective Route Table output
Updated cmdlet:
Get-AzEffectiveRouteTable
Fix double dash in New -AzApplicationGatewayTrustedRootCertificate documentation
Az.Resources
Add new cmdlet Get-AzureRmDenyAssignment for retrieving deny assignments
Az.Sql
Rename Advanced Threat Protection cmdlets to Advanced Data Security and enable Vulnerability Assessment
by default
Az.HDInsight
Removed two cmdlets:
Grant-AzHDInsightHttpServicesAccess
Revoke-AzHDInsightHttpServicesAccess
Added a new cmdlet Set-AzHDInsightGatewayCredential to replace Grant-AzHDInsightHttpServicesAccess
Update cmdlet Get-AzHDInsightJobOutput to distinguish reader role and hdinsight operator role:
Users with reader role need to specify 'DefaultStorageAccountKey' parameter explicitly, otherwise error
occurs.
Users with hdinsight operator role will not be affected.
Az.Monitor
New cmdlets for SQR API (Scheduled Query Rule)
New -AzScheduledQueryRuleAlertingAction
New -AzScheduledQueryRuleAznsActionGroup
New -AzScheduledQueryRuleLogMetricTrigger
New -AzScheduledQueryRuleSchedule
New -AzScheduledQueryRuleSource
New -AzScheduledQueryRuleTriggerCondition
New -AzScheduledQueryRule
Get-AzScheduledQueryRule
Set-AzScheduledQueryRule
Update-AzScheduledQueryRule
Remove-AzScheduledQueryRule
More information about SQR API
Updated Az.Monitor.md to include cmdlets for GenV2(non classic) metric-based alert rule
Az.Network
Add support for Nat Gateway Resource
New cmdlets
New -AzNatGateway
Get-AzNatGateway
Set-AzNatGateway
Remove-AzNatGateway
Updated cmdlets - New -AzureVirtualNetworkSubnetConfigCommand - Add-
AzureVirtualNetworkSubnetConfigCommand
Updated below commands for feature: Custom routes set/remove on Brooklyn Gateway.
Updated New -AzVirtualNetworkGateway: Added optional parameter -CustomRoute to set the address
prefixes as custom routes to set on Gateway.
Updated Set-AzVirtualNetworkGateway: Added optional parameter -CustomRoute to set the address
prefixes as custom routes to set on Gateway.
Az.PolicyInsights
Support for querying policy evaluation details.
Add '-Expand' parameter to Get-AzPolicyState. Support '-Expand PolicyEvaluationDetails'.
Az.RecoveryServices
Support for Cross subscription Azure to Azure site recovery.
Marking upcoming breaking changes for Azure Site Recovery.
Fix for Azure Site Recovery recovery plan end action plan.
Fix for Azure Site Recovery Update network mapping for Azure to Azure.
Fix for Azure Site Recovery update protection direction for Azure to Azure for managed disk.
Other minor fixes.
Az.Relay
Fix typos in customer-facing messages
Az.ServiceBus
Added new cmdlets for NetworkRuleSet of Namespace
Az.Storage
Upgrade to Storage Client Library 10.0.1 (the namespace of all objects from this SDK change from
'Microsoft.WindowsAzure.Storage.' to 'Microsoft.Azure.Storage.')
Upgrade to Microsoft.Azure.Management.Storage 11.0.0, to support new API version 2019-04-01.
The default Storage account Kind in Create Storage account change from 'Storage' to 'StorageV2'
New -AzStorageAccount
Change the Storage account cmdlet output Sku.Name to be aligned with input SkuName by add '-', like
'StandardLRS' change to 'Standard_LRS'
New -AzStorageAccount
Get-AzStorageAccount
Set-AzStorageAccount
Az.Websites
'Kind' property will now be set for PSSite objects returned by Get-AzWebApp
Get-AzWebApp*Metrics and Get-AzAppServicePlanMetrics marked deprecated
This document describes the changes between the 1.0.0 and 2.0.0 versions of Az
Table of Contents
Module breaking changes
Az.Compute
Az.HDInsight
Az.Storage
Update-AzAvailabilitySet -Managed
After
For consistency, removed Image parameter from 'ByName' and 'ByResourceId' parameter sets in
Update-AzImage
Before
Note that the below code is functional, but the passed-in ImageName is not used, so removing this
parameter has no functional impact.
After
For consistency, removed Name parameter from 'ByObject' and 'ByResourceId' parameter sets in
Restart-AzVM
Before
Note that the below code is functional, but the passed-in Name is not used, so removing this parameter has
no functional impact.
Restart-AzVM -InputObject $VM -Name $Name
After
For consistency, removed Name parameter from 'ByObject' and 'ByResourceId' parameter sets in
Start-AzVM
Before
Note that the below code is functional, but the passed-in Name is not used, so removing this parameter has
no functional impact.
After
For consistency, removed Name parameter from 'ByObject' and 'ByResourceId' parameter sets in
Stop-AzVM
Before
Note that the below code is functional, but the passed-in Name is not used, so removing this parameter has
no functional impact.
After
For consistency, removed Name parameter from 'ByObject' and 'ByResourceId' parameter sets in
Remove-AzVM
Before
Note that the below code is functional, but the passed-in Name is not used, so removing this parameter has
no functional impact.
For consistency, removed Name parameter from 'ByObject' and 'ByResourceId' parameter sets in Set-AzVM
Before
Note that the below code is functional, but the passed-in Name is not used, so removing this parameter has
no functional impact.
After
For consistency, removed Name parameter from 'ByObject' and 'ByResourceId' parameter sets in
Save-AzVMImage
Before
Note that the below code is functional, but the passed-in Name is not used, so removing this parameter has
no functional impact.
After
Before
After
$vmss = Get-AzVMssVM ...
$vmss.ProtectionPolicy.ProtectFromScaleIn = $true
Before
After
Before
After
$snap = New-AzSnapshotConfig ... | Set-AzSnapshotDiskEncryptionKey ...
$snap.EncryptionSettingsCollection.EncryptionSettings
Before
After
Before
Using deprecated alias
Set-AzVMBootDiagnostics
After
Set-AzVMBootDIagnostic
Before
Using deprectaed alias
Export-AzLogAnalyticThrottledRequests
After
Export-AzLogAnalyticThrottledRequest
Az.HDInsight
Removed the Grant-AzHDInsightHttpServicesAccess and Revoke-AzHDInsightHttpServicesAccess cmdlets. These
are no longer necessary because HTTP access is always enabled on all HDInsight clusters.
Added a new Set-AzHDInsightGatewayCredential cmdlet. Use this cmdlet to change the gateway HTTP username
and password (replaces Grant-AzHDInsightHttpServicesAccess ).
Updated the Get-AzHDInsightJobOutput cmdlet to support granular role-based access to the storage key.
Users with HDInsight Cluster Operator, Contributor, or Owner roles will not be affected.
Users with only the Reader role will need to specify DefaultStorageAccountKey parameter explicitly.
For more information about these role-based access changes, see aka.ms/hdi-config-update
Before
After
After
Az.Storage
Namespaces for types returned from Blob, Queue, and File cmdlets have changed their namespace from
Microsoft.WindowsAzure.Storage to Microsoft.Azure.Storage . While this is not technically a breaking change
according to the breaking change policy, it may require some changes in code that uses the methods from
the Storage .Net SDK to interact with the objects returned from these cmdlets.
Example 1: Add a message to a Queue (change CloudQueueMessage object namespace)
Before:
After:
Example 2: Fetch Blob/File Attributes with AccessCondition (change AccessCondition object namespace)
Before:
After:
$accessCondition= New-Object Microsoft.Azure.Storage.AccessCondition
While not technically a breaking change, you will notice output differences in the Sku.Name property of
Storage Accounts returned from New/Get/Set-AzStorageAccount changes are as follows. (After the change,
output and input SkuName are aligned.)
"StandardLRS" -> "Standard_LRS";
"StandardGRS" -> "Standard_GRS";
"StandardRAGRS" -> "Standard_RAGRS";
"StandardZRS" -> "Standard_ZRS";
"PremiumLRS" -> "Premium_LRS";
The default service behavior when creating a storage account withous specifying a Kind has changed. In
previous versions, when a storage account was created with no Kind specified, the Storage account Kind of
Storage was used, in the new version StorageV2 is the default Kind value. If you need to create a V1
Storage account with Kind 'Storage', add parameter '-Kind Storage'
Example : Create a storage Account (Default Kind change)
Before:
After: