Authenticate to Azure using Azure CLI

The Azure CLI supports several authentication methods. Per proteggere le risorse di Azure, limitare le autorizzazioni di accesso per il caso d'uso.

Sign into Azure with Azure CLI

Quando si usa l'interfaccia della riga di comando di Azure sono disponibili quattro opzioni di autenticazione:

Multi-factor authentication (MFA)

A partire dal 2025, Microsoft applichererà l'autenticazione a più fattori obbligatoria per l'interfaccia della riga di comando di Azure e altri strumenti da riga di comando. MFA will only impact Microsoft Entra ID user identities. It will not impact workload identities, such as service principals and managed identities.

If you are using az login with an Entra ID and password to authenticate a script or automated process, plan now to migrate to a workload identity. Per altre informazioni, vedere L'impatto dell'autenticazione a più fattori nell'interfaccia della riga di comando di Azure negli scenari di automazione.

Find or change your current subscription

Dopo l'accesso, i comandi CLI vengono eseguiti sull'abbonamento predefinito. If you have multiple subscriptions, change your default subscription using az account set --subscription.

az account set --subscription "<subscription ID or name>"

To learn more about managing Azure subscriptions, see How to manage Azure subscriptions with the Azure CLI.

Refresh tokens

When you sign in with a user account, Azure CLI generates and stores an authentication refresh token. Because access tokens are valid for only a short period of time, a refresh token is issued at the same time the access token is issued. The client application can then exchange this refresh token for a new access token when needed. For more information on token lifetime and expiration, see Refresh tokens in the Microsoft identity platform.

Use the az account get-access-token command to retrieve the access token:

# get access token for the active subscription
az account get-access-token

# get access token for a specific subscription
az account get-access-token --subscription "<subscription ID or name>"

Here is some additional information about access token expiration dates:

• Expiration dates are updated in a format that is supported by MSAL-based Azure CLI.
• Starting from Azure CLI 2.54.0, az account get-access-token returns the expires_on property alongside the expiresOn property for the token expiration time.
• The expires_on property represents a Portable Operating System Interface (POSIX) timestamp while the expiresOn property represents a local datetime.
• The expiresOn property doesn't express "fold" when Daylight Saving Time ends. This can cause problems in countries or regions where Daylight Saving Time is adopted. For more information on "fold", see PEP 495 – Local Time Disambiguation.
• We recommend for downstream applications to use the expires_on property, because it uses the Universal Time Code (UTC).

Example output:

{
  "accessToken": "...",
  "expiresOn": "2023-10-31 21:59:10.000000",
  "expires_on": 1698760750,
  "subscription": "...",
  "tenant": "...",
  "tokenType": "Bearer"
}

See also

• Azure CLI onboarding cheat sheet
• Manage Azure subscriptions with the Azure CLI
• Find Azure CLI samples and published articles.