Three tools, one Resource Manager: change one resource group from the CLI, PowerShell and the portal

short · 25 min · Skills measured 3.3

Before you start — what this lab needs, and what it can cost

This lab runs in your own Azure subscription: an Azure free account or a pay-as-you-go subscription. Every command acts on something real and billed to you. Charges are possible, so finish the clean-up the same day; the Azure pricing calculator shows current rates. The lab relies on the budget alert you set in lesson 1's lab, which emails you if this subscription starts to cost money. Before you start, open Cost Management, choose Budgets and check that it is still listed.

Work with the least privilege the lab allows. The Contributor role on the subscription is enough to create the resource group, and the same identity is used by every tool here: no tool gives you more rights than the account you signed in with. Nothing here needs Global Administrator. On a brand-new account the first user is the subscription's Owner and the directory's Global Administrator, so if that is the only identity you have, use it carefully and only for the commands written here.

Work in Azure Cloud Shell, opened from the Cloud Shell icon in the Azure portal's top bar, in a Bash session. The first time it starts, choose No storage account required and your subscription, so Cloud Shell creates nothing billable; files you write there disappear when the session ends, which is fine for this lab. Cloud Shell is already signed in as you, so there are no credentials to handle. The commands use 00000000-0000-0000-0000-000000000000 as the subscription ID: put your own in its place (az account show --query id -o tsv prints it). Every lab in this course uses the region eastus. You may choose a nearer region, but then use it in every command.

This lab ends with a clean-up. Do it the same day: anything left running in your subscription is billed to you.

Task

Prove that the Azure CLI, Azure PowerShell and the Azure portal are three front ends to the same Azure Resource Manager. You create one resource group with the CLI in Cloud Shell's Bash session, add a tag to it with a cmdlet in Cloud Shell's PowerShell session, add a third tag in the portal, and then read all three back from any of them. The activity log shows every change arriving as your own identity, whichever tool sent it. Finally, look at where Azure Arc would show servers that run outside Azure, without connecting any, and say why Arc manages machines in place rather than moving them.

Steps

Open Cloud Shell from the portal's top bar and choose Bash. Notice what you did not have to do: install anything, or type a password. Confirm the CLI is there and who it is signed in as:

az version --query '"azure-cli"' -o tsv
az account set --subscription 00000000-0000-0000-0000-000000000000
az account show --query user.name -o tsv

The first command prints the installed Azure CLI version; the last prints your own sign-in name. 2. Create the lab's resource group with an az command, tagged with the tool that made it:

az group create --name az900-lab14-rg --location eastus --tags CreatedWith=cli

Switch the same Cloud Shell to PowerShell: use the Switch to PowerShell button in the Cloud Shell toolbar. Azure PowerShell's Az module is already installed and signed in. Read the group with a cmdlet, then merge a second tag onto it:

Get-AzResourceGroup -Name az900-lab14-rg | Select-Object ResourceGroupName, Location
Update-AzTag -ResourceId (Get-AzResourceGroup -Name az900-lab14-rg).ResourceId -Tag @{UpdatedWith='powershell'} -Operation Merge

The cmdlet does the same job an az command could do. The choice between the two is about which syntax you already know. 4. Now use the portal for the same kind of change. Search for Resource groups, open az900-lab14-rg, choose Tags in its menu, add the name EditedWith with the value portal, and choose Apply. Then open Activity log for the group. Each change you made, from the CLI, from PowerShell and from the portal, is recorded as an operation started by your own account. Every tool sent its request to Azure Resource Manager, which checked the same RBAC permissions each time. 5. Switch Cloud Shell back to Bash with the Switch to Bash button, and read the three tags from the CLI:

az group show --name az900-lab14-rg --query tags -o json

It shows CreatedWith, UpdatedWith and EditedWith: one resource, changed by three tools. 6. Look at Azure Arc without connecting anything. In the portal, search for Azure Arc and open Machines. A server in your own building or in another cloud would appear here, with a resource group, tags and policy, after its Connected Machine agent is installed on it. This lab installs no agent and onboards nothing. From the CLI, count the Arc-enabled servers in your subscription:

az resource list --resource-type Microsoft.HybridCompute/machines --query 'length(@)' -o tsv

On a subscription used only for this course it prints 0. An Arc-enabled server keeps running where it is; moving it into Azure would be Azure Migrate.

Verify

All three tools wrote to the same resource group. Run these in Bash:

az group show --name az900-lab14-rg --query tags.CreatedWith -o tsv

Expected output: cli.

az group show --name az900-lab14-rg --query tags.UpdatedWith -o tsv

Expected output: powershell.

az group show --name az900-lab14-rg --query tags.EditedWith -o tsv

Expected output: portal.

Cost and clean-up

A resource group and its tags are free, and an ephemeral Cloud Shell session creates nothing billable. Charges are possible only if you create something beyond these steps.

Created by this lab: the resource group az900-lab14-rg and its three tags.

Delete the resource group, which deletes its tags with it. Lesson 1's budget stays as it is:

az group delete --name az900-lab14-rg --yes

Check it is gone

az group exists --name az900-lab14-rg

Expected output: false.

Notes

The az version query uses '"azure-cli"' because the field name contains a hyphen: in JMESPath a double-quoted name is a field, which is exactly what is wanted here.

If the activity log does not show the portal's tag change straight away, refresh it after a minute: entries can take a short while to appear.

This is an independent study companion for the Microsoft Azure Fundamentals (AZ-900) exam and is not produced by or endorsed by Microsoft. Microsoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies.

This is an independent study companion for Microsoft Azure Fundamentals AZ-900 and is not produced by or endorsed by CompTIA.