Install the Azure CLI (az) on Linux

The Azure CLI (az) is Microsoft's official command-line tool for managing Azure resources. On Linux you have two clean installation paths: add Microsoft's signed package repository (recommended for staying current) or use a one-shot install script. This guide covers the repo method on the major distro families, then walks through authentication, subscription switching, and extending the CLI with plugins.

Install the Azure CLI

Debian and Ubuntu

Microsoft maintains a dedicated APT repository. Add it, then install the package.

# Install prerequisites
sudo apt update && sudo apt install -y curl gnupg lsb-release

# Import Microsoft's signing key
curl -sLS https://packages.microsoft.com/keys/microsoft.asc \
  | gpg --dearmor \
  | sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null
sudo chmod go+r /etc/apt/keyrings/microsoft.gpg

# Add the Azure CLI repository
AZ_DIST=$(lsb_release -cs)
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/microsoft.gpg] \
https://packages.microsoft.com/repos/azure-cli/ ${AZ_DIST} main" \
  | sudo tee /etc/apt/sources.list.d/azure-cli.list

sudo apt update && sudo apt install -y azure-cli

Upgrades arrive automatically via apt upgrade once the repo is in place.

Fedora, RHEL, Rocky Linux, and AlmaLinux

Use the DNF/YUM repository. The rpm_dist variable handles the slight differences between Fedora and RHEL-family releases.

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

# Create the repo file
sudo tee /etc/yum.repos.d/azure-cli.repo <<'EOF'
[azure-cli]
name=Azure CLI
baseurl=https://packages.microsoft.com/yumrepos/azure-cli
enabled=1
gpgcheck=1
gpgkey=https://packages.microsoft.com/keys/microsoft.asc
EOF

sudo dnf install -y azure-cli

Arch Linux

The azure-cli package lives in the Arch User Repository (AUR). Use your preferred AUR helper:

yay -S azure-cli

Alternatively, install the official azure-cli package available in the Arch extra repository:

sudo pacman -S azure-cli

Verify the Installation

az version

Output will look similar to {"azure-cli": "2.61.0", ...} and will vary with the installed version.

Authenticate with az login

The most common authentication method is the interactive device-code or browser flow. On a desktop with a browser, the browser opens automatically. On a headless server, use the device-code flow.

Desktop / Workstation (Wayland or X11)

az login

A browser window opens. Sign in with your Microsoft account or Entra ID (formerly Azure AD) credentials. After success, the terminal prints the subscriptions attached to your account.

Headless Server (Device Code Flow)

az login --use-device-code

The CLI prints a URL (https://microsoft.com/devicelogin) and a short code. Open that URL on any device, enter the code, and authenticate. The terminal confirms login once complete.

Service Principal (Automation / CI)

For non-interactive use — pipelines, cron jobs, systemd services — authenticate with a service principal rather than a personal account.

az login \
  --service-principal \
  --username "" \
  --password "" \
  --tenant ""

Store credentials in environment variables or a secrets manager; never hard-code them in scripts.

Working with Subscriptions

An Azure account can have multiple subscriptions (billing containers). After login, list them:

az account list --output table

Output is a table of subscription names, IDs, and states. Set your active subscription by ID or name:

az account set --subscription ""

Confirm the active subscription:

az account show --output table

Every subsequent command runs against this subscription unless you override it with --subscription on individual commands. If you regularly switch between subscriptions, consider setting the AZURE_SUBSCRIPTION_ID environment variable in your shell profile instead of relying on the global default.

Configure Default Behavior

Reduce repetitive flags by setting persistent defaults for location and resource group:

az configure --defaults location=eastus group=my-resource-group

Change the default output format (options: json, table, tsv, yaml, jsonc, none):

az configure --defaults output=table

Settings are written to ~/.azure/config. You can edit that file directly if needed.

Install and Manage Extensions

The Azure CLI ships with a core set of commands. Many newer or specialized services are distributed as optional extensions — for example, AKS (aks-preview), Azure DevOps (azure-devops), or the RDBMS tools.

List Available Extensions

az extension list-available --output table

Install an Extension

az extension add --name azure-devops

List Installed Extensions

az extension list --output table

Update Extensions

# Update a specific extension
az extension update --name azure-devops

# Update all installed extensions
az extension update --all

Remove an Extension

az extension remove --name azure-devops

Keeping the CLI Updated

Because you added a system package repository, updates arrive with your normal system update routine:

# Debian/Ubuntu
sudo apt update && sudo apt upgrade azure-cli

# Fedora/RHEL family
sudo dnf upgrade azure-cli

# Arch
sudo pacman -Syu azure-cli

Troubleshooting

• Login errors on Wayland: If the browser-based login hangs, try az login --use-device-code instead. Some Wayland compositors do not yet support the xdg-open redirect used by the default flow.
• GPG key errors on Debian/Ubuntu: If apt update reports a signing key error, re-run the key import step. Check that /etc/apt/keyrings/microsoft.gpg exists and is non-empty (ls -lh /etc/apt/keyrings/microsoft.gpg).
• Command not found after install: Open a new terminal session or run hash -r to refresh the shell's command cache.
• Certificate or proxy errors: In environments with TLS inspection, set REQUESTS_CA_BUNDLE to the path of your corporate CA bundle: export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt.
• Stale token after password change: Run az account clear followed by az login to force a fresh authentication.
• Extension conflicts: If a command behaves unexpectedly after adding a preview extension, remove it with az extension remove and fall back to the stable core command.