{"id":1220,"date":"2026-10-12T10:51:16","date_gmt":"2026-10-12T10:51:16","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1220"},"modified":"2026-10-12T10:51:45","modified_gmt":"2026-10-12T10:51:45","slug":"azure-terraform-azure-authentication-azure-cli","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/azure-terraform-azure-authentication-azure-cli\/","title":{"rendered":"Azure: Terraform Azure Authentication: Azure CLI"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">Latest Terraform Azure Authentication: Azure CLI<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The recommended approach in the HashiCorp AzureRM provider&#8217;s <a href=\"https:\/\/registry.terraform.io\/providers\/hashicorp\/azurerm\/latest\/docs\/guides\/azure_cli\">Azure CLI authentication guide<\/a> is to authenticate through Azure CLI when running Terraform locally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With this method, you do not need <code>ARM_CLIENT_ID<\/code>, <code>ARM_CLIENT_SECRET<\/code>, or a service principal secret. You sign in using Azure CLI, and Terraform uses that authenticated identity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1 \u2014 Install Azure CLI on macOS<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>brew update\nbrew install azure-cli<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If Azure CLI is already installed, check it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>az version<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2 \u2014 Sign in to Azure<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>az login<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A browser window will open. Sign in with your Azure account and complete any required authentication.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3 \u2014 Select your subscription<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">List available subscriptions:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>az account list --output table<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Set the subscription Terraform should manage:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>az account set --subscription \"&lt;SUBSCRIPTION_ID&gt;\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>az account show --output table<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4 \u2014 Configure Terraform<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In your Terraform project, create or update <code>main.tf<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~&gt; 5.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = \"&lt;SUBSCRIPTION_ID&gt;\"\n}\n\nresource \"azurerm_resource_group\" \"example\" {\n  name     = \"terraform-test-rg\"\n  location = \"Japan East\"\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace <code>&lt;SUBSCRIPTION_ID&gt;<\/code> with your actual subscription ID. This example uses AzureRM provider version 5.x; the provider block also works with CLI authentication when using a compatible provider version.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5 \u2014 Initialize and test Terraform<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run these commands from the directory containing <code>main.tf<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>terraform init\nterraform validate\nterraform plan<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the plan succeeds, Terraform has authenticated and can evaluate the proposed deployment. To create the resource group, run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>terraform apply<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Review the plan and type <code>yes<\/code> when prompted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Permissions: Your signed-in Azure identity must have sufficient permissions to create resource groups in the selected subscription.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6 \u2014 Verify the current identity<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>az account show \\\n  --query \"{Subscription:name, SubscriptionID:id, TenantID:tenantId, SignedInAs:user.name}\" \\\n  --output table<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This confirms which subscription and identity Azure CLI is using.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Official, updated documentation<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/registry.terraform.io\/providers\/hashicorp\/azurerm\/latest\/docs\/guides\/azure_cli\">HashiCorp: Authenticate to Azure using Azure CLI<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/cli\/azure\/install-azure-cli-macos\">Microsoft: Install Azure CLI on macOS<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Important distinction: Azure CLI authentication is ideal for local Terraform development. For unattended execution in Jenkins, GitHub Actions, or another CI\/CD system, use a service principal with an appropriate credential or workload identity federation instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Latest Terraform Azure Authentication: Azure CLI The recommended approach in the HashiCorp AzureRM provider&#8217;s Azure CLI authentication guide is to authenticate through Azure CLI when running Terraform&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1220","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1220"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1220\/revisions"}],"predecessor-version":[{"id":1222,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1220\/revisions\/1222"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}