PowerShell for Azure

The Deployment That Took 4 Hours... Once

When I first started managing Azure infrastructure, creating a new environment meant: log into Azure Portal, click through 47 different configuration screens, copy values from a Word document, hope I didn't miss anything. Creating a dev environment: 4 hours. Creating staging: another 4 hours. Production: 4 hours plus anxiety.

Then I discovered Az PowerShell:

.\Deploy-Environment.ps1 -Environment "Development"

15 minutes later: complete environment deployed. Same configuration every time. Documented in code. That script has deployed 50+ environments without a single misconfiguration.

Installing Az PowerShell Module

The Az module is Microsoft's official PowerShell module for Azure.

Installation

# Install Az module (takes a few minutes)
Install-Module -Name Az -Repository PSGallery -Force -Scope CurrentUser

# Update existing installation
Update-Module -Name Az

# Check installed version
Get-InstalledModule -Name Az

# Import module
Import-Module Az

Connecting to Azure

# Interactive login
Connect-AzAccount

# Login with specific tenant
Connect-AzAccount -TenantId "your-tenant-id"

# Login with Service Principal (automation)
$credential = Get-Credential
Connect-AzAccount -ServicePrincipal -Credential $credential -Tenant "tenant-id"

# Check current context
Get-AzContext

# List available subscriptions
Get-AzSubscription

# Set active subscription
Set-AzContext -SubscriptionId "subscription-id"

Managing Azure Resources

Resource Groups

# Create resource group
New-AzResourceGroup -Name "rg-production" -Location "EastUS"

# List resource groups
Get-AzResourceGroup

# Get specific resource group
Get-AzResourceGroup -Name "rg-production"

# Delete resource group (with confirmation)
Remove-AzResourceGroup -Name "rg-old" -Force

Virtual Machines

# Create VM
$vmParams = @{
    ResourceGroupName = "rg-production"
    Name = "vm-web-01"
    Location = "EastUS"
    ImageName = "Win2022Datacenter"
    Size = "Standard_D2s_v3"
    Credential = Get-Credential
}

New-AzVM @vmParams

# List VMs
Get-AzVM

# Get specific VM
$vm = Get-AzVM -ResourceGroupName "rg-production" -Name "vm-web-01"

# Start VM
Start-AzVM -ResourceGroupName "rg-production" -Name "vm-web-01"

# Stop VM (deallocate)
Stop-AzVM -ResourceGroupName "rg-production" -Name "vm-web-01" -Force

# Restart VM
Restart-AzVM -ResourceGroupName "rg-production" -Name "vm-web-01"

# Remove VM
Remove-AzVM -ResourceGroupName "rg-production" -Name "vm-web-01" -Force

Storage Accounts

# Create storage account
$storageParams = @{
    ResourceGroupName = "rg-production"
    Name = "stproduction001"  # Must be globally unique
    Location = "EastUS"
    SkuName = "Standard_LRS"
    Kind = "StorageV2"
}

New-AzStorageAccount @storageParams

# Get storage account
$storage = Get-AzStorageAccount -ResourceGroupName "rg-production" -Name "stproduction001"

# Get storage account keys
$keys = Get-AzStorageAccountKey -ResourceGroupName "rg-production" -Name "stproduction001"

# Create blob container
$ctx = $storage.Context
New-AzStorageContainer -Name "backups" -Context $ctx -Permission Blob

# Upload file to blob
Set-AzStorageBlobContent -File "C:\backup.zip" -Container "backups" -Blob "backup-2024.zip" -Context $ctx

# Download file from blob
Get-AzStorageBlobContent -Container "backups" -Blob "backup-2024.zip" -Destination "C:\Downloads\" -Context $ctx

Networking

# Create virtual network
$vnetParams = @{
    ResourceGroupName = "rg-production"
    Name = "vnet-production"
    Location = "EastUS"
    AddressPrefix = "10.0.0.0/16"
}

$vnet = New-AzVirtualNetwork @vnetParams

# Add subnet
$subnetConfig = Add-AzVirtualNetworkSubnetConfig -Name "subnet-web" -AddressPrefix "10.0.1.0/24" -VirtualNetwork $vnet
$vnet | Set-AzVirtualNetwork

# Create Network Security Group
$nsgParams = @{
    ResourceGroupName = "rg-production"
    Name = "nsg-web"
    Location = "EastUS"
}

$nsg = New-AzNetworkSecurityGroup @nsgParams

# Add NSG rule
$nsgRule = @{
    Name = "Allow-HTTP"
    Protocol = "Tcp"
    Direction = "Inbound"
    Priority = 1000
    SourceAddressPrefix = "*"
    SourcePortRange = "*"
    DestinationAddressPrefix = "*"
    DestinationPortRange = 80
    Access = "Allow"
}

$nsg | Add-AzNetworkSecurityRuleConfig @nsgRule | Set-AzNetworkSecurityGroup

Real-World Azure Automation

Environment Deployment Script

param(
    [ValidateSet("Development", "Staging", "Production")]
    [string]$Environment = "Development",
    
    [string]$Location = "EastUS"
)

$config = @{
    Development = @{
        VMSize = "Standard_B2s"
        DataDiskSize = 32
    }
    Staging = @{
        VMSize = "Standard_D2s_v3"
        DataDiskSize = 64
    }
    Production = @{
        VMSize = "Standard_D4s_v3"
        DataDiskSize = 128
    }
}

$envConfig = $config[$Environment]
$rgName = "rg-$($Environment.ToLower())"

Write-Host "Deploying $Environment environment..."

# Create Resource Group
Write-Host "Creating resource group: $rgName"
New-AzResourceGroup -Name $rgName -Location $Location -Force | Out-Null

# Create Virtual Network
Write-Host "Creating virtual network..."
$vnet = New-AzVirtualNetwork -ResourceGroupName $rgName `
    -Name "vnet-$($Environment.ToLower())" `
    -Location $Location `
    -AddressPrefix "10.0.0.0/16"

# Add Subnet
$vnet = Add-AzVirtualNetworkSubnetConfig -Name "subnet-app" `
    -AddressPrefix "10.0.1.0/24" `
    -VirtualNetwork $vnet
$vnet | Set-AzVirtualNetwork | Out-Null

# Create Storage Account
Write-Host "Creating storage account..."
$storageName = "st$($Environment.ToLower())$(Get-Random -Minimum 1000 -Maximum 9999)"
New-AzStorageAccount -ResourceGroupName $rgName `
    -Name $storageName `
    -Location $Location `
    -SkuName "Standard_LRS" `
    -Kind "StorageV2" | Out-Null

# Create VM
Write-Host "Creating virtual machine..."
$vmName = "vm-$($Environment.ToLower())-01"
$vmParams = @{
    ResourceGroupName = $rgName
    Name = $vmName
    Location = $Location
    ImageName = "Win2022Datacenter"
    Size = $envConfig.VMSize
    Credential = Get-Credential -UserName "azureuser" -Message "Enter VM password"
}

New-AzVM @vmParams | Out-Null

Write-Host "✓ $Environment environment deployed successfully!" -ForegroundColor Green
Write-Host "Resource Group: $rgName"
Write-Host "VM Size: $($envConfig.VMSize)"

Cost Management Script

function Get-AzureCostReport {
    param(
        [int]$Days = 30
    )
    
    $endDate = Get-Date
    $startDate = $endDate.AddDays(-$Days)
    
    Write-Host "Generating cost report for last $Days days..."
    
    # Get all resource groups
    $resourceGroups = Get-AzResourceGroup
    
    $costs = foreach ($rg in $resourceGroups) {
        $resources = Get-AzResource -ResourceGroupName $rg.ResourceGroupName
        
        [PSCustomObject]@{
            ResourceGroup = $rg.ResourceGroupName
            Location = $rg.Location
            ResourceCount = $resources.Count
            Tags = $rg.Tags
        }
    }
    
    $costs | Export-Csv "azure-cost-report-$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation
    $costs | Format-Table
}

Get-AzureCostReport -Days 30

VM Automation Script

function Start-AzVMScheduled {
    param(
        [string]$ResourceGroupName,
        [string]$TagName = "AutoStart",
        [string]$TagValue = "true"
    )
    
    $vms = Get-AzVM -ResourceGroupName $ResourceGroupName
    
    foreach ($vm in $vms) {
        $tags = (Get-AzResource -ResourceId $vm.Id).Tags
        
        if ($tags[$TagName] -eq $TagValue) {
            $status = (Get-AzVM -ResourceGroupName $ResourceGroupName -Name $vm.Name -Status).Statuses[1].Code
            
            if ($status -eq "PowerState/deallocated") {
                Write-Host "Starting VM: $($vm.Name)"
                Start-AzVM -ResourceGroupName $ResourceGroupName -Name $vm.Name -NoWait
            }
            else {
                Write-Host "VM $($vm.Name) is already running"
            }
        }
    }
}

# Usage
Start-AzVMScheduled -ResourceGroupName "rg-production"

Backup Automation

function Backup-AzVMDisks {
    param(
        [string]$ResourceGroupName,
        [string]$VMName,
        [string]$BackupStorageAccount
    )
    
    $vm = Get-AzVM -ResourceGroupName $ResourceGroupName -Name $VMName
    $storageAccount = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName -Name $BackupStorageAccount
    $ctx = $storageAccount.Context
    
    # Create backup container
    $containerName = "vm-backups"
    New-AzStorageContainer -Name $containerName -Context $ctx -ErrorAction SilentlyContinue
    
    # Backup OS Disk
    $osDiskName = $vm.StorageProfile.OsDisk.Name
    $osDisk = Get-AzDisk -ResourceGroupName $ResourceGroupName -DiskName $osDiskName
    
    $snapshotConfig = New-AzSnapshotConfig -SourceUri $osDisk.Id -CreateOption Copy -Location $vm.Location
    $snapshotName = "$osDiskName-backup-$(Get-Date -Format 'yyyy-MM-dd-HHmm')"
    
    New-AzSnapshot -Snapshot $snapshotConfig -SnapshotName $snapshotName -ResourceGroupName $ResourceGroupName
    
    Write-Host "✓ Backup created: $snapshotName"
}

Azure Automation with Runbooks

# Create Automation Account
$automationParams = @{
    ResourceGroupName = "rg-automation"
    Name = "automation-account"
    Location = "EastUS"
    Plan = "Basic"
}

New-AzAutomationAccount @automationParams

# Import runbook
Import-AzAutomationRunbook -Path "C:\Scripts\Start-VMs.ps1" `
    -ResourceGroupName "rg-automation" `
    -AutomationAccountName "automation-account" `
    -Type PowerShell

# Start runbook
Start-AzAutomationRunbook -Name "Start-VMs" `
    -ResourceGroupName "rg-automation" `
    -AutomationAccountName "automation-account"

Common Pitfalls

1. Not Checking Context

Problem: Operating on wrong subscription Solution: Always verify context

$context = Get-AzContext
Write-Host "Current subscription: $($context.Subscription.Name)"

2. Hardcoding Resource Names

Problem: Naming conflicts Solution: Use variables and parameters

3. Not Cleaning Up Resources

Problem: Unnecessary Azure costs Solution: Delete unused resources regularly

Key Takeaways

• Az module: Official PowerShell for Azure

• Connect-AzAccount: Authenticate to Azure

• Resource automation: Programmatic infrastructure management

• Cost management: Monitor and optimize spending

• Runbooks: Scheduled automation in Azure

What You've Learned

✅ Installing and using Az PowerShell module ✅ Managing Azure resources (VMs, Storage, Networking) ✅ Environment deployment automation ✅ Cost management and reporting ✅ Azure Automation with runbooks

Next Steps

You've learned PowerShell from basics to Azure automation. In the final article, Best Practices and Production Readiness, you'll learn:

• Code organization and style guides

• Testing with Pester

• CI/CD integration

• Security best practices

• Performance optimization

Make your PowerShell production-ready.

---

Ready for production? Continue to Best Practices and Production Readiness →