Latest Terraform Azure Authentication: Azure CLI

The recommended approach in the HashiCorp AzureRM provider’s Azure CLI authentication guide is to authenticate through Azure CLI when running Terraform locally.

With this method, you do not need ARM_CLIENT_ID, ARM_CLIENT_SECRET, or a service principal secret. You sign in using Azure CLI, and Terraform uses that authenticated identity.

Step 1 — Install Azure CLI on macOS

brew update
brew install azure-cli

If Azure CLI is already installed, check it:

az version

Step 2 — Sign in to Azure

az login

A browser window will open. Sign in with your Azure account and complete any required authentication.

Step 3 — Select your subscription

List available subscriptions:

az account list --output table

Set the subscription Terraform should manage:

az account set --subscription "<SUBSCRIPTION_ID>"

Verify:

az account show --output table

Step 4 — Configure Terraform

In your Terraform project, create or update main.tf:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 5.0"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = "<SUBSCRIPTION_ID>"
}

resource "azurerm_resource_group" "example" {
  name     = "terraform-test-rg"
  location = "Japan East"
}

Replace <SUBSCRIPTION_ID> with your actual subscription ID. This example uses AzureRM provider version 5.x; the provider block also works with CLI authentication when using a compatible provider version.

Step 5 — Initialize and test Terraform

Run these commands from the directory containing main.tf:

terraform init
terraform validate
terraform plan

If the plan succeeds, Terraform has authenticated and can evaluate the proposed deployment. To create the resource group, run:

terraform apply

Review the plan and type yes when prompted.

Permissions: Your signed-in Azure identity must have sufficient permissions to create resource groups in the selected subscription.

Step 6 — Verify the current identity

az account show \
  --query "{Subscription:name, SubscriptionID:id, TenantID:tenantId, SignedInAs:user.name}" \
  --output table

This confirms which subscription and identity Azure CLI is using.

Official, updated documentation

• HashiCorp: Authenticate to Azure using Azure CLI
• Microsoft: Install Azure CLI on macOS

Important distinction: Azure CLI authentication is ideal for local Terraform development. For unattended execution in Jenkins, GitHub Actions, or another CI/CD system, use a service principal with an appropriate credential or workload identity federation instead.