Purpose
Use this skill for tightly scoped Azure control-plane validation with approved tenant or subscription access.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure
Use When
- Need to confirm the scope of an approved Azure identity.
- Need to inspect subscriptions, roles, or exposed resources.
- Need a low-impact retest after Azure remediation.
Avoid When
- Tenant, subscription, or identity scope is unclear.
- Commands would change state without explicit approval.
Inputs
- Approved tenant or subscription
- Authorized identity context
- Read-only versus mutating boundaries
Procedure
- Confirm the active account, tenant, and subscription.
- Query only the services relevant to the current hypothesis.
- Keep validation read-oriented unless stronger actions are explicitly approved.
- Tie material exposure to real business services.
- Preserve the exact account and subscription scope for retest.
Command Syntax
Replace sample subscription values with approved in-scope values.
# Authenticate with device code flow
az login --use-device-code
# Show current identity and subscription
az account show
# List all subscriptions
az account list --output table
# List resource groups
az group list --output table
# List virtual machines
az vm list --output table
# List storage accounts
az storage account list --subscription '<subscription-id>' -o table
# List containers in a storage account
az storage container list --account-name contosoprod --output table
# List Key Vault secrets
az keyvault secret list --vault-name contoso-prod-kv --output table
# Get IAM role assignments
az role assignment list --output table
Evidence to Capture
- Effective Azure identity and subscription scope
- Material resource exposure or role boundary issues
- Exact account and subscription context used
Safety Boundaries
- Default to read-only validation.
- Do not mutate resources or roles without explicit written approval.