---
schema_version: 1
route: /t/az.md
tool: "az"
---

# sincecutoff.com /t/az — Azure CLI

- name: Azure CLI
- kind: cli
- children: none
- homepage: <https://learn.microsoft.com/cli/azure>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=az`](https://sincecutoff.com/v1/changes.md?tool=az) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### az aks adds Container Insights onboarding and offboarding flags (2026-10-06)
- slug: az-aks-adds-container-insights-onboarding-and-offboarding-flags-6ad0a422f240
- score: 0.92

How to use it:

When enabling Container Insights on a new or existing managed-identity AKS cluster, use `az aks create` or `az aks update` with `--enable-azure-monitor-logs`; to turn it off, use `az aks update` with `--disable-azure-monitor-logs`. Replace deprecated `--enable-msi-auth-for-monitoring` with `--enable-azure-monitor-logs` where applicable.

Examples:

```
az aks create --resource-group <resource-group> --name <cluster-name> --enable-azure-monitor-logs
```

```
az aks update --resource-group <resource-group> --name <cluster-name> --enable-azure-monitor-logs
```

```
az aks update --resource-group <resource-group> --name <cluster-name> --disable-azure-monitor-logs
```

- why_it_matters: Enable or disable Container Insights while creating or maintaining an AKS cluster.
- before: Use `--enable-msi-auth-for-monitoring` for monitoring managed identity authentication.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#october-06-2026>, <https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest>
- gotchas: "Version: 2.91.0"; "--resource-group, -g (required): Name of the resource group. [Reference](https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest)"; "--name, -n (required): Name of the managed cluster. [Reference](https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest)"; "--enable-azure-monitor-logs: Enables Azure Monitor logs (Container Insights) using managed identity authentication; documented default is false."; "--disable-azure-monitor-logs: Disables Azure Monitor logs (Container Insights); documented default is false."; "--enable-msi-auth-for-monitoring: Deprecated; accepted values are false or true. Use `--enable-azure-monitor-logs` instead."; "Prerequisite: The cluster must use a managed identity; service-principal-authenticated clusters are unsupported."; "Prerequisite: Clusters still using legacy shared-key authentication must first migrate to managed identity authentication."; "`--enable-msi-auth-for-monitoring` is deprecated in favor of `--enable-azure-monitor-logs`."; "The onboarding flag uses the Azure Monitor profile and managed identity authentication."

### az postgres flexible-server restore can change compute during point-in-time restore (2026-10-06)
- slug: az-postgres-flexible-server-restore-can-change-compute-during-point-in-time-rest-0b80c07f0861
- score: 0.95

How to use it:

For a point-in-time restore with a selected compute tier and SKU, run `az postgres flexible-server restore` with the source server, target server details, restore time, `--tier`, and `--sku-name`.

Examples:

```
az postgres flexible-server restore --resource-group <target-resource-group> --name <target-server> --source-server <source-server> --restore-time <UTC-ISO8601-time> --tier MemoryOptimized --sku-name Standard_E2ds_v4
```

- why_it_matters: Restore a PostgreSQL flexible server to a point in time while selecting its compute SKU and tier.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#october-06-2026>, <https://learn.microsoft.com/cli/azure/postgres/flexible-server>
- gotchas: "Version: 2.91.0"; "--source-server (required): Name or resource ID of the source server to restore from."; "--restore-time: Point-in-time restore timestamp in UTC, in ISO 8601 format; defaults to the current time."; "--name: Name of the target server; the example uses it to name the restored server."; "--resource-group: Resource group for the target server; the example supplies it explicitly."; "--sku-name: Compute SKU name, following the `Standard_{VM name}` convention."; "--tier: Compute tier; accepted values are Burstable, GeneralPurpose, and MemoryOptimized. The documentation does not state that `--tier` and `--sku-name` are mutually exclusive."

### ARM adds deployment stacks what-if commands (2026-08-04)
- slug: arm-adds-deployment-stacks-what-if-commands-59c747bc1afb
- score: 0.94

How to use it:

When previewing a deployment stack change, run `az stack-whatif <scope> create` at its resource group, subscription, or management group scope, supplying the stack ID and required scope settings. The command creates a deployment stack what-if result.

Examples:

```
az stack-whatif group create --name <result-name> --resource-group <resource-group> --template-file <template-file> --deny-settings-mode none --action-on-unmanage deleteResources --ri P5D --stack-id <stack-resource-id>
```

```
az stack-whatif sub create --name <result-name> --template-file <template-file> --location <location> --deny-settings-mode none --action-on-unmanage deleteResources --ri P5D --stack-id <stack-resource-id>
```

```
az stack-whatif mg create --name <result-name> --template-file <template-file> --location <location> --management-group-id <management-group-id> --deny-settings-mode none --action-on-unmanage deleteResources --ri P5D --stack-id <stack-resource-id>
```

- why_it_matters: Preview a deployment stack change before applying it.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#august-04-2026>, <https://learn.microsoft.com/en-us/cli/azure/stack-whatif/group?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/stack-whatif/sub?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/stack-whatif/mg?view=azure-cli-latest>, <https://github.com/Azure/arm-template-whatif>
- gotchas: "Version: 2.89.0"; "--name (required): Name for the what-if result."; "--resource-group (required): Resource group scope for the result."; "--management-group-id (required): Management group scope for the result."; "--location (required): Location for the subscription- or management-group-scope result."; "--stack-id (required): Resource ID of the deployment stack being previewed."; "--action-on-unmanage / --aou (required): Action for resources removed from the stack: deleteAll, deleteResources, or detachAll."; "--deny-settings-mode / --dm (required): Deny settings mode: denyDelete, denyWriteAndDelete, or none."; "--retention-interval / --ri (required): Retention interval for the what-if result."; "--template-file: Path to the template file; create also accepts --template-spec or --template-uri."; "--parameters: Template parameters, including parameter files and key/value pairs."; "Prerequisite: Azure CLI 2.89.0 or later is required for `az stack-whatif`."

### az mysql flexible-server mirroring adds Fabric Mirroring controls (2026-08-04)
- slug: az-mysql-flexible-server-mirroring-adds-fabric-mirroring-controls-4cf0788830c4
- score: 0.96

How to use it:

To enable Fabric Mirroring, run the `enable` command with the server, resource group, and a UAMI resource ID with appropriate permissions. To disable it, run the `disable` command with the server and resource group.

Examples:

```
az mysql flexible-server mirroring enable -g <resource-group> -n <server-name> --identity-resource-id <UAMI-resource-ID>
```

```
az mysql flexible-server mirroring disable -g <resource-group> -n <server-name>
```

- why_it_matters: Enable or disable Fabric Mirroring for a MySQL flexible server.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#august-04-2026>, <https://github.com/Azure/azure-cli/blob/azure-cli-2.89.0/src/azure-cli/azure/cli/command_modules/mysql/_help.py>
- gotchas: "Version: 2.89.0"; "-g / --resource-group (required): Resource group containing the server."; "-n / --name (required): MySQL Flexible Server name."; "--identity-resource-id (required): Resource ID of the User Assigned Managed Identity used to enable mirroring."; "Prerequisite: Enabling requires a User Assigned Managed Identity resource ID with appropriate permissions."

### az bicep snapshot and run subcommands (2026-07-07)
- slug: az-bicep-snapshot-and-run-subcommands-de08a40b9f9d
- score: 0.90

How to use it:

When working with Bicep snapshots or forwarding a command to the Bicep CLI, use `az bicep snapshot` or `az bicep run` with the documented arguments.

Examples:

```
az bicep snapshot --file <bicepparam-file>
```

```
az bicep snapshot --file <bicepparam-file> --mode Validate
```

```
az bicep run --command "<bicep-cli-command-and-arguments>"
```

- why_it_matters: Use the Azure CLI Bicep surface when working with Bicep snapshots or runs.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#july-07-2026>, <https://learn.microsoft.com/en-us/cli/azure/bicep?view=azure-cli-latest>
- gotchas: "Version: 2.88.0"; "snapshot --file (-f) (required): Path to the .bicepparam file to snapshot."; "snapshot --mode: Snapshot mode: `Overwrite` (default) writes the snapshot; `Validate` compares the existing snapshot and fails if differences are detected. Allowed values are mutually exclusive."; "snapshot --deployment-name: Deployment context used to resolve `existing` references during snapshot capture."; "snapshot --location (-l): Location in the deployment context used to resolve `existing` references during snapshot capture."; "snapshot --management-group-id: Management group ID in the deployment context used to resolve `existing` references during snapshot capture."; "snapshot --resource-group (-g): Resource group name in the deployment context used to resolve `existing` references during snapshot capture."; "snapshot --subscription-id: Subscription ID in the deployment context used to resolve `existing` references; does not change Azure CLI authentication context."; "snapshot --tenant-id: Tenant ID in the deployment context used to resolve `existing` references; does not change Azure CLI authentication context."; "run --command (-c) (required): Bicep CLI command and arguments as one quoted string. For a forwarded command starting with `--`, use `--command=<value>`."; "Prerequisite: `az bicep snapshot` requires Bicep CLI v0.41.2 or later."; "Docs conflict: The Azure CLI reference documents `az bicep snapshot`; the Bicep CLI commands page says `az bicep snapshot` does not exist and instructs running `bicep snapshot` directly. The Azure CLI reference matches the card's interface: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-cli"

### az appconfig kv creates and lists snapshot reference key-values (2026-06-02)
- slug: az-appconfig-kv-creates-and-lists-snapshot-reference-key-values-53845daa5ec1
- score: 0.94

How to use it:

When creating a key-value that points to an App Configuration snapshot, run `az appconfig kv set-snapshot-reference` with the key and snapshot name. To inspect the snapshot’s key-values through that reference, run `az appconfig kv list` with the reference key and `--resolve-snapshot-references`.

Examples:

```
az appconfig kv set-snapshot-reference -n <store-name> --key <reference-key> --snapshot-name <snapshot-name>
```

```
az appconfig kv list -n <store-name> --key <reference-key> --resolve-snapshot-references
```

- why_it_matters: Create and inspect key-values that reference an App Configuration snapshot.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#june-02-2026>, <https://learn.microsoft.com/en-us/cli/azure/appconfig/kv?view=azure-cli-latest>
- gotchas: "Version: 2.87.0"; "set-snapshot-reference --key (required): Key to set; it cannot be `.` or `..`, or contain `%`."; "set-snapshot-reference --snapshot-name (required): Name of the snapshot to reference."; "set-snapshot-reference -n, --name: Name of the App Configuration store; docs also allow store-name defaults to be configured."; "list --key: Key filter; with snapshot reference resolution, use the reference key."; "list --resolve-snapshot-references: Resolve snapshot references when listing. Docs show it together with `--key` to list keys in a referenced snapshot."; "Prerequisite: The commands require access to an App Configuration store. For login auth, provide `--endpoint` or `--name` and use `az login`; for key auth, provide a connection string or store name. The docs list `key` as the default auth mode."

### az storage account blob-service-properties update adds static website options (2026-06-02)
- slug: az-storage-account-blob-service-properties-update-adds-static-website-options-6678183e651b
- score: 0.95

How to use it:

When configuring static website behavior for a storage account, run `az storage account blob-service-properties update` with the needed website options. Enable static website support and set the index and/or custom 404 page as required.

Examples:

```
az storage account blob-service-properties update --account-name <storage-account> --resource-group <resource-group> --enable-static-website true --index-document <index-file> --error-document-404-path <absolute-404-page>
```

- why_it_matters: Update a storage account's blob service properties to configure static website behavior.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#june-02-2026>, <https://learn.microsoft.com/en-us/cli/azure/storage/account/blob-service-properties?view=azure-cli-latest>
- gotchas: "Version: 2.87.0"; "--account-name (-n) (required): Storage account name."; "--resource-group (-g): Resource group name; may be needed depending on context."; "--enable-static-website: Whether static website support is enabled; accepts `false` or `true`."; "--index-document: Webpage served for requests to the website root or a subfolder, such as `index.html`."; "--default-index-document-path (--default-index): Absolute path to the default index file; case-sensitive and mutually exclusive with `--index-document`."; "--error-document-404-path (--404-document): Absolute path to the custom webpage served for requests that do not match an existing file; only one custom 404 page is supported per static website."

### az webapp list-runtimes changes output and filters (2026-06-02)
- slug: az-webapp-list-runtimes-changes-output-and-filters-57617b968077
- score: 0.97

How to use it:

When scripts query available App Service runtimes, update them to parse `az webapp list-runtimes` as structured output and use its filters. Remove the deprecated `--linux` and `--show-runtime-details` options.

Examples:

```
az webapp list-runtimes [--os --os-type {linux, windows}] [--runtime {dotnet, java, node, php, python}] [--support {active, all, eol, near, supported}]
```

- why_it_matters: Update scripts that query available App Service runtimes.
- before: Parse a flat string list from `az webapp list-runtimes` and use `--linux` or `--show-runtime-details` where applicable.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#june-02-2026>, <https://learn.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest>
- gotchas: "Version: 2.87.0"; "--os / --os-type: Limit output to Windows or Linux runtimes; accepted values are `linux` and `windows`."; "--runtime: Limit output to one runtime family: `dotnet`, `java`, `node`, `php`, or `python`."; "--support: Filter by support lifecycle status; accepted values are `active`, `all`, `eol`, `near`, and `supported`. Default: `supported`."; "output fields: `os`, `runtime`, `version`, `config`, `support`, `end_of_life`: The release note identifies these keys for the structured dictionaries; the reference page does not document the fields."; "Docs conflict: The current Microsoft Learn reference documents `--os` / `--os-type` (accepted values `linux`, `windows`) but does not list `--linux` or `--show-runtime-details`. It is a latest-version page and does not establish their status specifically in Azure CLI 2.87.0."

### az network private-endpoint create/update adds IPv6 support (2026-04-07)
- slug: az-network-private-endpoint-create-update-adds-ipv6-support-a5d0181a9e7c
- score: 0.91

How to use it:

When creating or updating a private endpoint with IPv6, set `--ip-version-type IPv6`.

Examples:

```
az network private-endpoint create --connection-name <connection-name> --name <endpoint-name> --private-connection-resource-id <resource-id> --resource-group <resource-group> --subnet <subnet> --ip-version-type IPv6
```

```
az network private-endpoint update --name <endpoint-name> --resource-group <resource-group> --ip-version-type IPv6
```

- why_it_matters: Create or update a private endpoint with IPv6.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#april-07-2026>, <https://learn.microsoft.com/en-us/cli/azure/network/private-endpoint>
- gotchas: "Version: 2.85.0"; "--connection-name (required): Name of the private link service connection."; "--name (required): Name of the private endpoint. For update, use this with `--resource-group`, or use `--ids`."; "--private-connection-resource-id (required): Resource ID of the private endpoint to connect to."; "--resource-group (required): Resource group name. For update, use with `--name`, or use `--ids`."; "--subnet (required): Subnet for the private endpoint."; "--ids: For update, one or more complete resource IDs; use this or the other resource ID arguments."; "--ip-version-type: Private IP version type; accepted values are `DualStack`, `IPv4`, and `IPv6`. Defaults to `IPv4`."; "The parameter supports IPv6."

### az vmss create supports automatic availability-zone placement controls (2026-04-07)
- slug: az-vmss-create-supports-automatic-availability-zone-placement-controls-b825223d1bb4
- score: 0.94

How to use it:

When creating a VM scale set with automatic zone placement, set `--zone-placement-policy Auto`; optionally constrain eligible zones or their maximum count. `--include-zones` and `--exclude-zones` cannot be used together.

Examples:

```
az vmss create --resource-group <resource-group> --name <scale-set-name> --image Ubuntu2204 --admin-username azureuser --generate-ssh-keys --instance-count 3 --zone-placement-policy Auto
```

```
az vmss create --resource-group <resource-group> --name <scale-set-name> --image Ubuntu2204 --admin-username azureuser --generate-ssh-keys --instance-count 3 --zone-placement-policy Auto --include-zones 1 2
```

- why_it_matters: Create a VM scale set with automatic zone placement constrained by selected zones and a zone count.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#april-07-2026>, <https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-zone-placement>, <https://learn.microsoft.com/en-us/cli/azure/vmss>
- gotchas: "Version: 2.85.0"; "--resource-group (required): Name of an existing resource group."; "--name (required): Scale set name."; "--image (required): OS image name, URN, custom image name or ID, or VHD blob URI; required unless using `--attach-os-disk`."; "--zone-placement-policy: Set to `Auto` to enable automatic availability-zone placement."; "--include-zones: Availability zones to consider; if omitted, all regional zones are considered. Mutually exclusive with `--exclude-zones`."; "--exclude-zones: Availability zones to exclude; if omitted, no zones are excluded. Mutually exclusive with `--include-zones`."; "--max-zone-count: Maximum number of availability zones to use with automatic placement; if omitted, all available regional zones may be used."; "--admin-username (required): Administrator username for the example Linux VM."; "--generate-ssh-keys: Generate SSH key files if missing; stores them in `~/.ssh`."; "--instance-count: Number of VMs in the scale set; default is 2."; "Prerequisite: Register the `Microsoft.Compute/VmssAutomaticZonePlacement` feature for the subscription. The feature is marked Preview in the official documentation."; "Prerequisite: The resource group must already exist."; "`--include-zones`, `--exclude-zones`, and `--max-zone-count` apply when `--zone-placement-policy` is set to `Auto`."; "Docs conflict: `--include-zones` and `--exclude-zones` cannot both be configured on the same scale set; the card's optional-flag wording could be read as allowing both together."

### az webapp update sets the platform release channel (2026-04-07)
- slug: az-webapp-update-sets-the-platform-release-channel-aefbe934e822
- score: 0.92

How to use it:

When setting a web app’s platform release channel, run `az webapp update` with `--platform-release-channel` and the app’s name and resource group.

Examples:

```
az webapp update --platform-release-channel <Latest|Standard|Extended> --name <app-name> --resource-group <resource-group>
```

- why_it_matters: Set the platform release channel for a web app.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#april-07-2026>, <https://learn.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/azure/app-service/overview-patch-os-runtime>
- gotchas: "Version: 2.85.0"; "--platform-release-channel (required): Release channel to set. Allowed values: `Latest`, `Standard`, `Extended`."; "--name: Web app name; may be omitted if a default is configured."; "--resource-group: Resource group name; may be omitted if a default is configured."; "Prerequisite: Platform Release Channel is available for Linux App Service only."

### az aks create/update container network logs (2026-03-03)
- slug: az-aks-create-update-container-network-logs-de97a3882d1f
- score: 0.92

How to use it:

For an AKS cluster, use `az aks create` or `az aks update` with `--enable-container-network-logs` to enable container network log collection. Use `az aks update` with `--disable-container-network-logs` to disable it.

Examples:

```
az aks create --resource-group <resource-group> --name <cluster-name> --location <location> --enable-container-network-logs
```

```
az aks update --resource-group <resource-group> --name <cluster-name> --enable-container-network-logs
```

```
az aks update --resource-group <resource-group> --name <cluster-name> --disable-container-network-logs
```

- why_it_matters: Enable container network logs when creating or updating an AKS cluster.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#march-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/azure/aks/how-to-configure-container-network-logs>
- gotchas: "Version: 2.84.0"; "--resource-group (required): Resource group containing the cluster."; "--name (required): AKS cluster name."; "--location (required): Azure location for the cluster being created."; "--enable-container-network-logs: Enables container network log collection; automatically enables `--enable-high-log-scale-mode`."; "--disable-container-network-logs: Disables container network log collection. The enable and disable options are opposing choices."; "Prerequisite: Azure CLI installed and signed in; an Azure account with an active subscription. The container-network-logs guide says ACNS must be enabled on the cluster and a `ContainerNetworkLog` custom resource must be applied to start collection."

### az stack create/validate/delete behavior for resources without delete support (2026-03-03)
- slug: az-stack-create-validate-delete-behavior-for-resources-without-delete-support-876ff16471f8
- score: 0.93

How to use it:

When creating, validating, or deleting a deployment stack, set `--resources-without-delete-support` to choose how to handle resources that lack delete support when they are no longer managed by the stack. The documented values are `detach` and `fail`.

Examples:

```
az stack group create --name <stack-name> --resource-group <resource-group> --template-file <template-file> --action-on-unmanage <deleteAll|deleteResources|detachAll> --deny-settings-mode <denyDelete|denyWriteAndDelete|none> --resources-without-delete-support <detach|fail>
```

```
az stack sub validate --name <stack-name> --template-file <template-file> --location <location> --action-on-unmanage <deleteAll|deleteResources|detachAll> --deny-settings-mode <denyDelete|denyWriteAndDelete|none> --resources-without-delete-support <detach|fail>
```

```
az stack mg delete --name <stack-name> --management-group-id <management-group-id> --action-on-unmanage <deleteAll|deleteResources|detachAll> --resources-without-delete-support <detach|fail>
```

- why_it_matters: Create, validate, or delete a deployment stack that manages resources without delete support.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#march-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/stack/group?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/stack/sub?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/stack/mg?view=azure-cli-latest>
- gotchas: "Version: 2.84.0"; "--resources-without-delete-support, --rwd: Selects what happens to resources without delete support when no longer managed by the stack. Allowed values: `detach`, `fail`."; "--action-on-unmanage, --aou (required): Sets what happens to resources no longer managed after the stack is updated or deleted. Values: `deleteAll`, `deleteResources`, `detachAll`."; "--deny-settings-mode, --dm (required): Sets denied operations on managed resources. Values: `denyDelete`, `denyWriteAndDelete`, `none`."; "--name, -n (required): Deployment stack name."; "--resource-group, -g (required): Resource group containing the stack; required for group-scope create/validate."; "--template-file, -f: Path to a template or Bicep file."; "--location, -l (required): Location to store the deployment stack; required for subscription-scope validate."; "--management-group-id, -m (required): Management group ID; required for management-group-scope delete."

### az webapp create minimum TLS version (2026-03-03)
- slug: az-webapp-create-minimum-tls-version-8785b225dfce
- score: 0.95

How to use it:

When creating a web app, set its minimum TLS version with `--min-tls-version` (for example, `1.2`).

Examples:

```
az webapp create -g <resource-group> -p <app-service-plan> -n <app-name> --min-tls-version 1.2
```

- why_it_matters: Set the minimum TLS version when creating a web app.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#march-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest>
- gotchas: "Version: 2.84.0"; "--name (-n) (required): Name of the new web app; alphanumeric characters and hyphens only, cannot start or end with a hyphen, and under 64 characters."; "--plan (-p) (required): App Service plan name or resource ID."; "--resource-group (-g) (required): Resource group name."; "--min-tls-version: Minimum TLS version required for SSL requests; documented examples: 1.0, 1.1, 1.2."

### az network vnet-gateway adds identity parameters and subgroup (2026-02-03)
- slug: az-network-vnet-gateway-adds-identity-parameters-and-subgroup-55116605c902
- score: 0.94

How to use it:

When a deployment workflow needs identity settings on an existing virtual network gateway, assign them with `az network vnet-gateway identity assign`.

Examples:

```
az network vnet-gateway identity assign --resource-group <resource-group> --name <gateway-name> --mi-system-assigned
```

```
az network vnet-gateway identity assign --resource-group <resource-group> --name <gateway-name> --mi-user-assigned <identity-resource-id>
```

- why_it_matters: Configure a virtual network gateway in a repository deployment workflow that uses identity settings.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#february-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/network/vnet-gateway/identity?view=azure-cli-latest>
- gotchas: "Version: 2.83.0"; "--name / -n (required): Name of the VNet gateway."; "--resource-group / -g (required): Name of the resource group."; "--mi-system-assigned / --system-assigned: Set the system managed identity."; "--mi-user-assigned / --user-assigned: Set user managed identities; supports shorthand, JSON-file, and YAML-file syntax."

### AKS node pool add and update support Ubuntu2404 OS SKU (2026-01-13)
- slug: aks-node-pool-add-and-update-support-ubuntu2404-os-sku-29cb95f7f790
- score: 0.91

How to use it:

When adding or updating an AKS node pool, set `--os-sku Ubuntu2404` to choose Ubuntu 24.04. Supply the resource group, cluster name, and node pool name for the selected command.

Examples:

```
az aks nodepool add --resource-group <resource-group> --cluster-name <cluster-name> --name <node-pool-name> --os-sku Ubuntu2404
```

```
az aks nodepool update --resource-group <resource-group> --cluster-name <cluster-name> --name <node-pool-name> --os-sku Ubuntu2404
```

- why_it_matters: Choose the OS SKU when adding or updating an AKS node pool.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026>, <https://learn.microsoft.com/en-us/cli/azure/aks/nodepool?view=azure-cli-latest>
- gotchas: "Version: 2.82.0"; "--resource-group (required): Resource group containing the AKS cluster."; "--cluster-name (required): Name of the managed Kubernetes cluster."; "--name (required): Node pool name; the command syntax also accepts `--nodepool-name`."; "--os-sku (required): OS SKU for the agent node pool. `Ubuntu2404` is an accepted value."; "Docs conflict: The current Azure CLI reference lists additional OS SKU values beyond those in the January 2026 release note, including Ubuntu2604. It still documents Ubuntu2404 as accepted."

### az vmss adds instance resiliency status views (2026-01-13)
- slug: az-vmss-adds-instance-resiliency-status-views-c8edb8ef4a15
- score: 0.90

How to use it:

To inspect resiliency status for every VM in a scale set, run `az vmss list-instances` with `--resiliency-view`. To inspect one VM, run `az vmss get-resiliency-view` with the scale set name, resource group, and instance.

Examples:

```
az vmss list-instances --resiliency-view --resource-group <resource-group> --subscription <subscription-id> --virtual-machine-scale-set-name <scale-set-name>
```

```
az vmss get-resiliency-view --resource-group <resource-group> --name <scale-set-name> --instance <instance-name-or-id>
```

- why_it_matters: Inspect resiliency status for instances in a virtual machine scale set.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026>, <https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/resilient-vm-create-delete>, <https://learn.microsoft.com/en-us/cli/azure/vmss?view=azure-cli-latest>
- gotchas: "Version: 2.82.0"; "--resiliency-view: Show resiliency status of each instance; defaults to false."; "--resource-group (required): Name of the resource group."; "--subscription: Subscription name or ID."; "--virtual-machine-scale-set-name (required): Name of the VM scale set."; "--name (required): Name of the VM scale set for `get-resiliency-view`."; "--instance (required): Instance name in Flexible orchestration mode; instance ID in Uniform orchestration mode."

### Storage SAS generation adds user delegation OID support across blob, container, file system, directory, share, file, and queue commands (2026-01-13)
- slug: storage-sas-generation-adds-user-delegation-oid-support-across-blob-container-fi-83d5bfa4d5a0
- score: 0.92

How to use it:

When generating a SAS for a supported Azure Storage resource, add `--user-delegation-oid <user-object-id>` to that resource’s `generate-sas` command. For share, file, and queue SAS commands, use `--as-user` as well; the documented `--as-user` option requires `--expiry` and `--auth-mode login`.

Examples:

```
az storage blob generate-sas --account-name <storage-account> --container-name <container> --name <blob> --permissions <permissions> --expiry <date-time> --auth-mode login --as-user --user-delegation-oid <user-object-id>
```

```
az storage fs file generate-sas --file-system <file-system> --path <file-path> --https-only --permissions <permissions> --expiry <date-time> --user-delegation-oid <user-object-id>
```

```
az storage share generate-sas --name <share> --account-name <storage-account> --https-only --permissions <permissions> --expiry <date-time> --auth-mode login --as-user --user-delegation-oid <user-object-id>
```

- why_it_matters: Generate a user delegation SAS for a supported Azure Storage resource.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026>, <https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-cli>, <https://learn.microsoft.com/en-us/cli/azure/storage/fs/file?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/storage/share?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest>
- gotchas: "Version: 2.82.0"; "--user-delegation-oid <user-object-id>: Entra ID of the user authorized to use the resulting SAS URL; that URL must be used with an Entra ID token issued to that user."; "--as-user: Return a SAS signed with the user delegation key. Requires `--expiry` and `--auth-mode login`."; "--auth-mode {key, login}: Select authentication mode; `login` uses login credentials. Required with `--as-user`."; "--expiry <date-time>: SAS expiration time; required with `--as-user`."; "--name <blob> (required): Blob name for `az storage blob generate-sas`."; "--container-name <container>: Container containing the blob; required unless another documented resource locator is used."; "--file-system <file-system> (required): ADLS Gen2 file system name."; "--path <file-path> (required): File path in the file system."; "--name <share> (required): File share name."; "--permissions <permissions>: Permissions granted by the SAS; accepted permission values depend on the resource."; "--https-only: Allow requests only over HTTPS."; "Prerequisite: Sign in to Azure CLI with Microsoft Entra credentials; the CLI user needs an Azure RBAC role containing `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`."; "Prerequisite: The cited Azure CLI guide specifies Azure CLI version 2.0.78 or later for creating a user delegation SAS."; "`az storage fs file generate-sas` is added as a command."; "`--as-user` is stated for the share, file, and queue SAS commands."