Use PowerShell to inspect Azure before you automate changes

Overview

This track teaches you to manage Azure with PowerShell — from connecting to your subscription, through resource groups and VMs, to storage, networking, and automation patterns you'll use every day as an Azure admin.

What you'll learn: Az module fundamentals, subscription management, resource groups, VM lifecycle, storage accounts, virtual networks, and building reusable scripts for common Azure tasks.

Prerequisites: Basic PowerShell. An Azure subscription (free tier works). The Az module installed: Install-Module Az -Scope CurrentUser.

Lesson 1: Connect and Set Context

Start with Connect-AzAccount. If you have multiple subscriptions, set the active one with Set-AzContext — otherwise commands run against the wrong subscription.

Connect-AzAccount
# List your subscriptions:
Get-AzSubscription
# Set the one you want to work in:
Set-AzContext -SubscriptionId "your-subscription-id"
# Verify:
Get-AzContext

Exercise: Connect to Azure. List your subscriptions. Set the context to your primary subscription and verify with Get-AzContext.

Lesson 2: Resource Groups

Resource groups are containers for Azure resources. Everything you create lives in a group. Organize by project, environment, or team — not randomly.

# Create a resource group
New-AzResourceGroup -Name "rg-web-prod" -Location "East US"

# List all groups
Get-AzResourceGroup | Select-Object ResourceGroupName, Location

# List resources inside a group
Get-AzResource -ResourceGroupName "rg-web-prod" | Select-Object Name, ResourceType

# Delete a group (and everything in it — be careful!)
Remove-AzResourceGroup -Name "rg-web-prod" -Force

Exercise: Create a resource group called "rg-practice". List it. Then delete it. Confirm it's gone.

Lesson 3: Virtual Machines

VMs are the most common Azure resource. Create, start, stop, and resize them with Az cmdlets.

# Get VM details including power state
Get-AzVM -Status | Select-Object Name, PowerState, Location

# Start a VM
Start-AzVM -ResourceGroupName "rg-web-prod" -Name "web01"

# Stop (deallocate to save cost — Stop alone still charges!)
Stop-AzVM -ResourceGroupName "rg-web-prod" -Name "web01" -Force

# Resize a VM
$vm = Get-AzVM -ResourceGroupName "rg-web-prod" -Name "web01"
$vm.HardwareProfile.VmSize = "Standard_B2s"
Update-AzVM -VM $vm -ResourceGroupName "rg-web-prod"

# Stop all running VMs in a resource group (cost saver)
Get-AzVM -ResourceGroupName "rg-web-prod" -Status |
    Where-Object PowerState -eq "VM running" |
    Stop-AzVM -Force

Key tip: Stop-AzVM deallocates (no compute charge). Stopping from inside the OS keeps the VM allocated (still charged). Always use Stop-AzVM for cost savings.

Exercise: List all VMs in your subscription with their power states. Identify any that are running but shouldn't be.

Lesson 4: Storage Accounts

Storage accounts hold blobs (files), tables, queues, and file shares. Names must be globally unique and lowercase.

# Create a storage account
New-AzStorageAccount -ResourceGroupName "rg-web-prod" `
    -Name "mystorageaccount123" -Location "East US" -SkuName Standard_LRS

# Get the context (needed for blob operations)
$ctx = (Get-AzStorageAccount -ResourceGroupName "rg-web-prod" -Name "mystorageaccount123").Context

# List blobs in a container
Get-AzStorageBlob -Container "backups" -Context $ctx

# Upload a file
Set-AzStorageBlobContent -File "C:\backup.zip" -Container "backups" `
    -Blob "backup-2026-10-24.zip" -Context $ctx

# Download a blob
Get-AzStorageBlobContent -Container "backups" -Blob "backup-2026-10-24.zip" `
    -Destination "C:\Downloads\" -Context $ctx

Exercise: Create a storage account. Upload a test file. List the blobs. Download it back and verify the file matches.

Lesson 5: Virtual Networks and NSGs

VNets isolate your resources. NSGs (Network Security Groups) control traffic with rules — like a firewall for your subnets and NICs.

# List VNets
Get-AzVirtualNetwork | Select-Object Name, Location, AddressSpace

# Get NSG rules
Get-AzNetworkSecurityGroup -ResourceGroupName "rg-web-prod" -Name "nsg-web" |
    Select-Object -ExpandProperty SecurityRules |
    Select-Object Name, Priority, Direction, Access, DestinationPortRange

# Add a rule to allow HTTPS
$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName "rg-web-prod" -Name "nsg-web"
Add-AzNetworkSecurityRuleConfig -NetworkSecurityGroup $nsg `
    -Name "Allow-HTTPS" -Priority 100 -Direction Inbound -Access Allow `
    -Protocol Tcp -SourceAddressPrefix "*" -SourcePortRange "*" `
    -DestinationAddressPrefix "*" -DestinationPortRange 443
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg

Exercise: List your VNets. Check the NSG rules on one. Identify any rule that allows broad inbound access (0.0.0.0/0) and flag it.

Lesson 6: Automation Patterns

The real power of Azure PowerShell is automation — scheduled tasks, bulk operations, and reporting.

# Daily cost report: list all resources with their type and location
Get-AzResource | Select-Object Name, ResourceType, Location |
    Export-Csv -Path "azure-inventory.csv" -NoTypeInformation

# Find unattached managed disks (wasted money)
Get-AzDisk | Where-Object ManagedBy -eq $null |
    Select-Object Name, DiskSizeGB, Location

# Tag all untagged resources
Get-AzResource | Where-Object Tags -eq $null | ForEach-Object {
    Set-AzResource -ResourceId $_.ResourceId -Tag @{ Environment = "Unknown"; Owner = "IT" } -Force
}

# Bulk VM status report
Get-AzVM -Status | Select-Object Name, ResourceGroupName, PowerState, Location |
    Format-Table -AutoSize

Final exercise: Write a script that generates a weekly report: all VMs with their power state, all unattached disks, and total resource count by type. Export it to CSV and email it to yourself.