Azure

Disables anonymous pull access for the Azure Container Registry (ACR), requiring clients to authenticate before pulling images. Deprecated. Use Disable Anonymous Pull for ACR instead. Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Disables the legacy 'authentication as ARM' feature for the Azure Container Registry (ACR). Deprecated. Use Disable ACR ARM Authentication instead. Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Disables public network access and content exports for the Azure Container Registry (ACR) to enhance security. Deprecated. Use Disable Public Access & Exports on ACR instead. Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Updates a container registry. Deprecated. Use the azure-cr-registry-update command instead. Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Updates the authentication and authorization settings of an existing Azure Web App. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Enables App Service Authentication for the web app. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Disables remote debugging for the web app to reduce the risk of unauthorized code access. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Updates the configuration settings of an existing Azure Web App. Required permissions: Microsoft.Web/sites/config/write, Microsoft.Web/sites/config/read.

Enables HTTP 2.0 for the web app. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Sets the web app's minimum accepted TLS version to 1.2 to enhance security. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Updates an Azure Web App. The required permissions are: Microsoft.Web/sites/read, Microsoft.Web/sites/write.

Assigns a system-assigned managed identity to the web app, enabling secure access to other Azure services without managing credentials. Required permissions: Microsoft.Web/sites/read, Microsoft.Web/sites/write.

Lists configured budgets at the subscription or resource group level. Required permission: Microsoft.Consumption/budgets/read.

Returns cost forecast for a subscription over a given time range. Required permission: Microsoft.CostManagement/forecast/read.

Returns actual usage and cost details for a given time period, optionally filtered by service name. Required permission: Microsoft.Consumption/usageDetails/read.

Updates a disk. Required permissions: Microsoft.Compute/disks/read, Microsoft.Compute/disks/write.

Sets the data access authentication mode for the managed disk to Azure Active Directory. Required permissions: Microsoft.Compute/disks/read, Microsoft.Compute/disks/write.

Gets the properties of a given virtual machine. Required Permissions: Microsoft.Compute/virtualMachines/read.

Lists all the virtual machines in the specified subscription. Use the next_token argument to view the next page of results. Required Permissions: Microsoft.Compute/virtualMachines/read.

Powers off a given virtual machine. Required Permissions: Microsoft.Compute/virtualMachines/poweroff/action.

Powers on a given virtual machine. Required Permissions: Microsoft.Compute/virtualMachines/start/action.

Disables key-based write access for Cosmos DB metadata to enhance security.

Updates the properties of an existing Azure Cosmos DB database account. Deprecated. Use the azure-cosmosdb-db-account-update command instead. Required permissions: Microsoft.DocumentDB/databaseAccounts/read, Microsoft.DocumentDB/databaseAccounts/write.

Updates the properties of an existing Azure Cosmos DB database account. The required permissions are: Microsoft.DocumentDB/databaseAccounts/read, Microsoft.DocumentDB/databaseAccounts/write.

Disables anonymous pull access for the Azure Container Registry (ACR), requiring clients to authenticate before pulling images. Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Disables the legacy 'authentication as ARM' feature for the Azure Container Registry (ACR). Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Disables public network access and content exports for the Azure Container Registry (ACR) to enhance security.

Updates a container registry. Required permissions: Microsoft.ContainerRegistry/registries/read, Microsoft.ContainerRegistry/registries/write.

Disables all public and private network access for the managed disk. Required permissions: Microsoft.Compute/disks/read, Microsoft.Compute/disks/write.

Disables all public and private network access for a managed disk. Deprecated. Use Disable Public and Private Access to VM Disk instead. Required permissions: Microsoft.Compute/disks/read, Microsoft.Compute/disks/write.

Sets the data access authentication mode for the managed disk to Azure Active Directory. Deprecated. Use Set Disk Data Access to Azure AD instead. Required permissions: Microsoft.Compute/disks/read, Microsoft.Compute/disks/write.

Updates a disk. Deprecated. Use the azure-compute-disk-update command instead. Required permissions: Microsoft.Compute/disks/read, Microsoft.Compute/disks/write.

Sets the Function App's minimum accepted TLS version to 1.2 to enhance security. Deprecated. Use Set Web App Minimum TLS Version instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Enables soft delete and purge protection for the Key Vault to prevent the permanent loss of keys and secrets. Note: Once purge-protection and soft-delete is enabled for a key vault, the action is irreversible.

Updates a key vault in a specific subscription. Deprecated. Use the azure-keyvault-vault-update command instead. Required permissions: Microsoft.KeyVault/vaults/read, Microsoft.KeyVault/vaults/write.

Updates a key vault in the specified subscription. The required permissions are: Microsoft.KeyVault/vaults/read, Microsoft.KeyVault/vaults/write.

Updates a log profile in Azure Monitoring REST API. Required permissions: Microsoft.Insights/logprofiles/read, Microsoft.Insights/logprofiles/write.

Sets the log profile’s retention policy to 365 days and enables it across all supported locations. Required permissions: Microsoft.Insights/logprofiles/read, Microsoft.Insights/logprofiles/write.

Updates a server configuration. Required permissions: Microsoft.DBforMySQL/flexibleServers/configurations/read, Microsoft.DBforMySQL/flexibleServers/configurations/write.

Enforces secure transport (SSL/TLS) for connections to the MySQL Flexible Server. Required permissions: Microsoft.DBforMySQL/flexibleServers/configurations/read, Microsoft.DBforMySQL/flexibleServers/configurations/write.

Sets the storage account’s default network action to Deny. Only explicitly allowed IPs, subnets, or trusted Azure services will have access. Required permissions: Microsoft.Storage/storageAccounts/read, Microsoft.Storage/storageAccounts/write.

Gets network interfaces in a resource group. The command is deprecated, please use azure-vn-network-interfaces-list.

Gets public IP addresses in a resource group. The command is deprecated, please use azure-vn-public-ip-addresses-list.

Gets all resource groups for a subscription. The command is deprecated, please use azure-rm-resource-groups-list.

Lists all network security groups. Deprecated. Use the azure-vn-security-groups-list command instead. Required permission: Microsoft.Network/networkSecurityGroups/read.

Creates a security rule. Deprecated. Use the azure-vn-security-rule-create command instead. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/read, Microsoft.Network/networkSecurityGroups/securityRules/write.

Delete a security rule. The command is deprecated, please use azure-vn-security-rule-delete.

Deletes a network security group (NSG) rule. Required permission: Microsoft.Network/networkSecurityGroups/securityRules/delete.

Retrieves a specific rule. Deprecated. Use the azure-vn-security-rule-get command instead. Required permission: Microsoft.Network/networkSecurityGroups/securityRules/read.

Updates a security rule or creates one if it does not exist. Deprecated. Use the azure-vn-security-rule-update command instead. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/read, Microsoft.Network/networkSecurityGroups/securityRules/write.

Retrieves all security rules in a network security group. Deprecated. Use the azure-vn-security-rules-list command instead. Required permission: Microsoft.Network/networkSecurityGroups/securityRules/read.

Creates a policy assignment. Required permission: Microsoft.Authorization/policyAssignments/read, Microsoft.Authorization/policyAssignments/write.

Applies Microsoft Defender for Cloud built-in recommendations by creating a policy assignment for the SecurityCenterBuiltIn initiative. This sets the following policies to 'AuditIfNotExists': disk encryption monitoring (Windows and Linux), system updates monitoring, and JIT network access monitoring. Rules for adaptive application controls, endpoint protection, and security configuration are excluded. Required permissions: Microsoft.Authorization/policyAssignments/read, Microsoft.Authorization/policyAssignments/write.

Updates a server configuration. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Enables checkpoint logging on the PostgreSQL server. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Enables connection throttling on the PostgreSQL server to manage log verbosity for concurrent connection queries and errors. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Enables logging client disconnections on the PostgreSQL server. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Sets the log retention period for the PostgreSQL server to 4 days. NOTE: The recommended log retention period can be from 4 to 7 days. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Enables logging client connections on the PostgreSQL. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Enables logging statement execution duration on the PostgreSQL server to help with performance analysis. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/configurations/read, Microsoft.DBforPostgreSQL/servers/configurations/write.

Updates an existing server. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/read, Microsoft.DBforPostgreSQL/servers/write.

Enforces SSL/TLS connections for the PostgreSQL server to reject unencrypted traffic. Deprecated due to the retirement of Azure PostgreSQL Single Server. Required permissions: Microsoft.DBforPostgreSQL/servers/read, Microsoft.DBforPostgreSQL/servers/write.

Gets all resource groups for a subscription. Required Permissions: Microsoft.Resources/subscriptions/resourceGroups/read.

Enables HTTP 2.0 for the Function App. Deprecated. Use Set Web App HTTP Version to 2.0 instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Enforces HTTPS-only traffic for the storage account, rejecting any requests made over HTTP. Required permissions: Microsoft.Storage/storageAccounts/read, Microsoft.Storage/storageAccounts/write.

Updates the database's threat detection policy. Deprecated. Use the azure-sqldb-security-alert-policy-update command instead. Required permissions: Microsoft.Sql/servers/databases/securityAlertPolicies/read, Microsoft.Sql/servers/databases/securityAlertPolicies/write.

Enables email notifications to account administrators for SQL database threat detection alerts.

Enables Transparent Data Encryption (TDE) for the SQL database to encrypt data at rest.

Updates a logical database's transparent data encryption configuration. Required permissions: Microsoft.Sql/servers/databases/transparentDataEncryption/read, Microsoft.Sql/servers/databases/transparentDataEncryption/write.

Updates a database's security alert policy. The required permissions are: Microsoft.Sql/servers/databases/securityAlertPolicies/read, Microsoft.Sql/servers/databases/securityAlertPolicies/write.

Updates a specific account storage. Required permissions: Microsoft.Storage/storageAccounts/read, Microsoft.Storage/storageAccounts/write.

Configures the storage account's network rules to allow traffic from trusted Azure services. Required permissions: Microsoft.Storage/storageAccounts/read, Microsoft.Storage/storageAccounts/write.

Updates container properties as specified in request body. Properties not mentioned in the request will be unchanged. Update fails if the specified container doesn't already exist. Required permissions: Microsoft.Storage/storageAccounts/blobServices/containers/write.

Run this command to update a specific blob container. The command is deprecated, please use azure-storage-blob-container-update.

Create a new Blob under the specified Container. Required permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write.

Enables blob soft delete for the storage account to retain deleted blobs for 30 days. The quick action is now deprecated, please use Enable Blob Soft Deletion. Required permissions: Microsoft.Storage/storageAccounts/blobServices/read, Microsoft.Storage/storageAccounts/blobServices/write.

Retrieve a Blob from a Container. Required permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read.

Retrieve Blob properties. Required Permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read.

Set Blob properties. Required permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write.

Run this command to get the blob service properties of a specific account storage. The command is deprecated, please use azure-storage-blob-service-property-get.

Sets properties for the blob service in a specific account storage. The command is deprecated, please use azure-storage-blob-service-property-set.Required permissions: Microsoft.Storage/storageAccounts/blobServices/read, Microsoft.Storage/storageAccounts/blobServices/write.

Run this command to get the blob service properties of a specific account storage. Required permissions: Microsoft.Storage/storageAccounts/blobServices/read.

Sets properties for the blob service in a specific account storage. Required permissions: Microsoft.Storage/storageAccounts/blobServices/read, Microsoft.Storage/storageAccounts/blobServices/write.

Enables blob soft delete for the storage account to retain deleted blobs for 30 days. Required permissions: Microsoft.Storage/storageAccounts/blobServices/read, Microsoft.Storage/storageAccounts/blobServices/write.

Retrieve the tags of the specified Blob. Required Permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read.

Updates the tags for the specified Blob. The command can replace the entire tags of the Blob and can be used to remove tags. Required permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write.

Creates a new Blob under the specified Container. Deprecated. Use the azure-storage-blob-create command instead. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write.

Retrieves a Blob from a Container. Deprecated. Use the azure-storage-blob-get command instead. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read.

Retrieves Blob properties. Deprecated. Use the azure-storage-blob-property-get command instead. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read.

Sets Blob properties. Deprecated. Use the azure-storage-blob-property-set command instead. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write.

Retrieves the tags of a specific Blob. Deprecated. Use the azure-storage-blob-tag-get command instead. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read.

Updates the tags for a specific Blob. Replaces all existing tags or removes them if none are provided. Deprecated. Use the azure-storage-blob-tag-set command instead. Required permissions: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read, Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write.

Creates a new Container under the specified account. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/write.

Marks a specific Container for deletion. The Container and any Blobs contained within it will be deleted during garbage collection. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/delete.

Retrieves properties for a specific Container. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/read.

Blocks public access to a container. Required permission: Microsoft.Storage/storageAccounts/blobServices/containers/setAcl/action.

Disables cross-tenant object replication for the storage account, preventing data from being copied to other Azure AD tenants. Required permissions: Microsoft.Storage/storageAccounts/read, Microsoft.Storage/storageAccounts/write.

Disables public access to blobs for the storage account, blocking anonymous/public read access to containers and blobs. Required permissions: Microsoft.Storage/storageAccounts/read, Microsoft.Storage/storageAccounts/write.

Retrieves the properties of a specific virtual machine. Deprecated. Use the azure-compute-vm-get command instead. Required permission: Microsoft.Compute/virtualMachines/read.

Powers off a specific virtual machine. Deprecated. Use the azure-compute-vm-power-off command instead. Required permissions: Microsoft.Compute/virtualMachines/read, Microsoft.Compute/virtualMachines/poweroff/action.

Powers on a specific virtual machine. Deprecated. Use the azure-compute-vm-start command instead. Required permissions: Microsoft.Compute/virtualMachines/read, Microsoft.Compute/virtualMachines/start/action.

Retrieves the properties of a specific network interface. Deprecated. Use the azure-vn-network-interface-get command instead. Required permission: Microsoft.Network/networkInterfaces/read.

Retrieves the properties of a specific public IP address. Deprecated. Use the azure-vn-public-ip-address-get command instead. Required permission: Microsoft.Network/publicIPAddresses/read.

Gets the properties of a given network interface. Required permissions: Microsoft.Network/networkInterfaces/read.

Updates a network interface. Required Permissions: Microsoft.Network/networkInterfaces/read, Microsoft.Network/networkInterfaces/write, Microsoft.Network/virtualNetworks/subnets/join/action, Microsoft.Network/publicIPAddresses/join/action, Microsoft.Network/networkSecurityGroups/join/action, Microsoft.Network/loadBalancers/backendAddressPools/join/action.

Gets network interfaces in a resource group. Required permissions: Microsoft.Network/networkInterfaces/read.

Gets the properties of a given public IP address. Permissions required: Microsoft.Network/publicIPAddresses/read.

Gets public IP addresses in a resource group. Required permissions: Microsoft.Network/publicIPAddresses/read.

Creates a network security group. Required Permissions: Microsoft.Network/networkSecurityGroups/write.

List all network security groups. Required permissions: Microsoft.Network/networkSecurityGroups/read.

Create a security rule. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/read, Microsoft.Network/networkSecurityGroups/securityRules/write.

Delete a security rule. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/delete.

Get a specific rule. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/read.

Update a security rule. If one does not exist, it will be created. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/read, Microsoft.Network/networkSecurityGroups/securityRules/write.

Gets all security rules in a network security group. Required permissions: Microsoft.Network/networkSecurityGroups/securityRules/read.

Assigns a system managed identity to the web app, enabling secure access to other Azure services without managing credentials. Deprecated. Use Assign Web App Managed Identity instead. Required permission: Microsoft.Web/sites/read, Microsoft.Web/sites/write.

Updates the authentication and authorization settings of an existing Azure Web App. Deprecated. Use the azure-appservice-webapp-auth-settings-update command instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Enables App Service Authentication for the web app. Deprecated. Use Enable Azure App Service Authentication instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Updates the configuration settings of an existing Azure Web App. Deprecated. Use the azure-appservice-webapp-config-update command instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Disables remote debugging for the web app to reduce the risk of unauthorized code access. Deprecated. Use Disable Remote Debugging on Web App instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Enables client certificate authentication for the App Service to secure incoming requests. Only clients that have a valid certificate will be able to reach the app.

Enables HTTP 2.0 for the web app. Deprecated. Use Set Web App HTTP Version to 2.0 instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Sets the web app's minimum accepted TLS version to 1.2 to enhance security. Deprecated. Use Set Web App Minimum TLS Version instead. Required permissions: Microsoft.Web/sites/config/read, Microsoft.Web/sites/config/write.

Enforces HTTPS-only traffic for the App Service.

Updates an Azure Web App. Deprecated. Use the azure-appservice-webapp-update command instead. Required permissions: Microsoft.Web/sites/read, Microsoft.Web/sites/write.

Assigns a system-managed identity to the identified Function App, enabling secure access to Azure services without manual credential management. Deprecated. Use Assign Web App Managed Identity instead. Required permissions: Microsoft.Web/sites/read, Microsoft.Web/sites/write.