Azure CLI is a cross-platform command-line tool for automating Azure resource and identity operations. It can run locally or through Azure Cloud Shell, where Bash is available without workstation installation. section 2.1.3 section 3.2.3
Use Azure CLI to perform repeatable Azure operations:
- Create Azure AD user identities in bulk with display names, unique usernames, passwords, and forced password changes. section 2.1.3
- Deploy Azure Firewall and its supporting public IP and firewall IP configuration resources. section 3.2.3
- Inspect resulting resource data, including user identifiers, firewall provisioning state, SKU, location, and IP information. section 2.1.3 section 3.2.3
Listing 2.1 Creating a user identity in Azure AD
az ad user create --display-name "Bob Miller" #1 --password dQ76bmz7rMVs9gSP #2 --user-principal-name bob@contoso.com #3 --force-change-password-next-sign-in true #4 #1 Displays the name of the user identity #2 The password used to sign in. The user can change it the next time they sign in. #3 The username of the new user, which must contain one of the verified domains for your Azure tenant #4 Requires the user to change their password the next time they sign in
A copyable Azure CLI command creates a user identity and documents each required argument. section 2.1.3
Deploying an Azure Firewall
A typical deployment creates the firewall, a static Standard public IP, and an IP configuration in an existing virtual network. Azure CLI 2.15.0 or higher may require the network firewall extension. Capture the firewall's private IP address before routing traffic to it. section 3.2.3
Listing 3.1 Creating an Azure Firewall instance
az network firewall create #1 --name Contoso-FW01 #2 --resource-group myResourceGroup #3 --location eastus #4 az network public-ip create #5 --name fw-pip #6 --resource-group myResourceGroup --location eastus --allocation-method static --sku standard az network firewall ip-config create #7 --firewall-name Contoso-FW01 #8 --name FW-config #9 --public-ip-address fw-pip #10 --resource-group myResourceGroup --vnet-name myVNet #11 az network firewall update #12 --name Contoso-FW01 #13 --resource-group myResourceGroup az network public-ip show #14 --name fw-pip --resource-group myResourceGroup fwprivaddr="$(az network firewall ip-config list -g myResourceGroup -f Contoso-FW01 --query "[?name=='FW-config'].privateIpAddress" --output tsv)" #1 Creates the Azure Firewall instance; by default, the Standard SKU is chosen #2 The name of Azure Firewall; needs to be unique in the resource group #3 The resource group that Azure Firewall and underlying resources are deployed to #4 The location in which the firewall instance is deployed #5 Creates public IP address needed for Microsoft to communicate with Azure Firewall resources #6 The name of the public IP address #7 Creates the Azure Firewall IP configuration #8 The name of the Azure Firewall; choose the Azure Firewall you created #9 The name of the Azure Firewall IP configuration #10 The name of public IP; choose the public IP you created #11 The name of the existing VNet; needs to contain a subnet called AzureFirewallSubnet #12 Updates the Azure Firewall instance #13 The name of the Azure Firewall you are updating #14 Gets details about the public IP address
A sequential command listing shows Azure Firewall creation, public IP setup, IP configuration, update, and address retrieval. section 3.2.3
