otty / apps

All apps/Azure CLI

Azure CLI

azure-cli

A set of commands used to create and manage Azure resources.

Runs as az|macOS, Linux, Windows|learn.microsoft.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Azure CLI in your home directory Every rule on this page, by file

…

[logging]

enable_log_file = yes

log_dir = /Users/octocat/Library/Logs/azuremachine-local

[defaults]

group = octocat-rg

…

Each machine keeps its own copy of these.

keysas_tokenconnection_stringaccess_keystorage_key

Lifted into your secret store; the rest of the file syncs.

· clouds.config Sync

· msal_token_cache.json Never synced

· msal_token_cache.bin Never synced

· service_principal_entries.json Never synced

· service_principal_entries.bin Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/azure-cli/otty.tomlThe file this page is generated from

id = "azure-cli"

name = "Azure CLI"

homepage = "https://learn.microsoft.com/cli/azure/"

description = "A set of commands used to create and manage Azure resources."

icon = "theSVG:azure"

executables = ["az"]

[dotfiles]

# https://learn.microsoft.com/cli/azure/azure-cli-configuration: "The

# configuration file itself is located at $AZURE_CONFIG_DIR/config. The default

# value of AZURE_CONFIG_DIR is $HOME/.azure on Linux and macOS, and

# %USERPROFILE%\.azure on Windows" — one location, written here as ~/.azure

# because %USERPROFILE% resolves to the same directory. Confirmed in

# src/azure-cli-core/azure/cli/core/_environment.py:

# os.getenv('AZURE_CONFIG_DIR', None) or os.path.expanduser(os.path.join('~', '.azure'))

# clouds.config holds the custom clouds registered with `az cloud register`:

# CLOUD_CONFIG_FILE = os.path.join(GLOBAL_CONFIG_DIR, 'clouds.config')

# (src/azure-cli-core/azure/cli/core/cloud.py), also INI.

paths = [

"~/.azure/config",

"~/.azure/clouds.config",

]

# Everything else in ~/.azure is state or cache, not configuration:

# azureProfile.json (the signed-in subscriptions), az.json, az.sess,

# commandIndex.json, extensionIndex.json, helpIndex.json,

# extensionHelpIndex.json and versionCheck.json are the session files loaded in

# src/azure-cli-core/azure/cli/core/__init__.py, msal_http_cache.bin is MSAL's

# HTTP cache, and logs/ and commands/ are logs. None of them is named above.

exclude = []

# The token cache and the service-principal store are credentials end to end.

# src/azure-cli-core/azure/cli/core/auth/identity.py builds them as

# self._token_cache_file = os.path.join(config_dir, "msal_token_cache")

# self._secret_file = os.path.join(config_dir, "service_principal_entries")

# and src/azure-cli-core/azure/cli/core/auth/persistence.py appends the

# extension for the mode in use:

# file_extensions = {True: '.bin', False: '.json'}

# so both spellings of each exist in the wild — plaintext JSON where the CLI

# runs unencrypted, the encrypted .bin where it does not.

secret = [

"~/.azure/msal_token_cache.json",

"~/.azure/msal_token_cache.bin",

"~/.azure/service_principal_entries.json",

"~/.azure/service_principal_entries.bin",

]

# Read when the command starts and written back by `az config set`.

side_effect = false

# logging.log_dir is "The directory to write logs to" — an absolute path into

# this machine's disk. It is only in the file because the user moved it, so it

# is part of how they set this machine up and is kept for a rebuild: backup.

[[dotfiles.machine_lines]]

file = "~/.azure/config"

match = { prefix = ["log_dir"] }

scope = "backup"

# The defaults the CLI stores for the data-plane commands include account

# keys: storage.key, storage.sas_token, storage.connection_string,

# batch.access_key and batchai.storage_key are all listed as configurable in

# https://learn.microsoft.com/cli/azure/azure-cli-configuration, and the file

# is INI, so each is written as `<name>=<value>` on its own line.

[[dotfiles.secret_paths]]

file = "~/.azure/config"

match = { prefix = ["key", "sas_token", "connection_string", "access_key", "storage_key"] }

[commands]

format = 1

label = "Azure CLI"

description = "Create, list and delete resource groups. The rest of the az command tree (thousands of commands) is not modeled."

quality = "ai-draft"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.subcommand]]

path = ["group", "create"]

label = "Create a resource group"

[[commands.subcommand.source]]

id = "ref"

kind = "manual"

url = "https://learn.microsoft.com/en-us/cli/azure/group"

revision = "2026-10-27"

evidence = '''

az group create --location

--name --resource-group

[--managed-by]

[--tags]

--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--name --resource-group -g -n

Name of the new resource group.

--managed-by

The ID of the resource that manages this resource group.

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

az group create -l westus -n MyResourceGroup

--output -o

Output format.

Accepted values:

json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

'''

[[commands.subcommand.field]]

id = "name"

label = "Resource group"

type = "string"

option = ["--name", "--resource-group", "-g", "-n"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "location"

label = "Location"

description = "Values from az account list-locations."

type = "string"

option = ["--location", "-l"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "tags"

label = "Tags"

description = "Space-separated key[=value] pairs."

type = "string"

option = ["--tags"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "managed_by"

label = "Managed by"

description = "ID of the resource that manages this group."

type = "string"

option = ["--managed-by"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "output"

label = "Output format"

type = "enum"

option = ["--output", "-o"]

choices = [{ value = "json", label = "JSON" }, { value = "jsonc", label = "Colored JSON" }, { value = "none", label = "None" }, { value = "table", label = "Table" }, { value = "tsv", label = "TSV" }, { value = "yaml", label = "YAML" }, { value = "yamlc", label = "Colored YAML" }]

sources = ["ref"]

[[commands.subcommand.field]]

id = "subscription"

label = "Subscription"

description = "Name or ID."

type = "string"

option = ["--subscription"]

sources = ["ref"]

[[commands.subcommand.task]]

id = "create"

label = "Create"

fields = ["name", "location", "tags", "output"]

required = ["name", "location"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["name", "location", "tags"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["managed_by", "output", "subscription"]

[[commands.subcommand]]

path = ["group", "delete"]

label = "Delete a resource group"

[[commands.subcommand.source]]

id = "ref"

kind = "manual"

url = "https://learn.microsoft.com/en-us/cli/azure/group"

revision = "2026-10-27"

evidence = '''

az group delete --name --resource-group

[--force-deletion-types {Microsoft.Compute/virtualMachineScaleSets, Microsoft.Compute/virtualMachines, Microsoft.Databricks/workspaces}]

[--no-wait]

[--yes]

--name --resource-group -g -n

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--force-deletion-types -f

The resource types you want to force delete.

Microsoft.Compute/virtualMachineScaleSets, Microsoft.Compute/virtualMachines, Microsoft.Databricks/workspaces

--no-wait

Do not wait for the long-running operation to finish.

--yes -y

Do not prompt for confirmation.

az group delete -n MyResourceGroup

--output -o

Output format.

Accepted values:

json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

'''

[[commands.subcommand.field]]

id = "name"

label = "Resource group"

type = "string"

option = ["--name", "--resource-group", "-g", "-n"]

effect = "delete"

sources = ["ref"]

[[commands.subcommand.field]]

id = "force_types"

label = "Force-delete resource types"

type = "enum"

option = ["--force-deletion-types", "-f"]

effect = "delete"

choices = [{ value = "Microsoft.Compute/virtualMachineScaleSets", label = "Scale sets" }, { value = "Microsoft.Compute/virtualMachines", label = "Virtual machines" }, { value = "Microsoft.Databricks/workspaces", label = "Databricks workspaces" }]

sources = ["ref"]

[[commands.subcommand.field]]

id = "no_wait"

label = "Do not wait"

type = "boolean"

option = ["--no-wait"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "yes"

label = "Do not ask for confirmation"

type = "boolean"

option = ["--yes", "-y"]

effect = "delete"

sources = ["ref"]

[[commands.subcommand.field]]

id = "subscription"

label = "Subscription"

description = "Name or ID."

type = "string"

option = ["--subscription"]

sources = ["ref"]

[[commands.subcommand.task]]

id = "delete"

label = "Delete"

fields = ["name", "no_wait", "yes"]

required = ["name"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["name", "no_wait", "yes"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["force_types", "subscription"]

[[commands.subcommand]]

path = ["group", "list"]

label = "List resource groups"

[[commands.subcommand.source]]

id = "ref"

kind = "manual"

url = "https://learn.microsoft.com/en-us/cli/azure/group"

revision = "2026-10-27"

evidence = '''

az group list [--tag]

--tag

A single tag in 'key[=value]' format. Use "" to clear existing tags.

az group list --query "[?location=='westus']"

--output -o

Output format.

Accepted values:

json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

'''

[[commands.subcommand.field]]

id = "tag"

label = "Tag filter"

description = "key[=value]"

type = "string"

option = ["--tag"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "query"

label = "JMESPath query"

type = "string"

option = ["--query"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "output"

label = "Output format"

type = "enum"

option = ["--output", "-o"]

sources = ["ref"]

[[commands.subcommand.field]]

id = "subscription"

label = "Subscription"

description = "Name or ID."

type = "string"

option = ["--subscription"]

sources = ["ref"]

[[commands.subcommand.task]]

id = "list"

label = "List"

fields = ["tag", "query", "output"]

required = []

[[commands.subcommand.task]]

id = "table"

label = "List as a table"

set = { output = ["table"] }

fields = ["tag", "output"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["tag", "query", "output"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["subscription"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/azure-cli. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits log_dir for you — that part is Otty’s own sync, or a template you write by hand.