[Feature] azd update command, auto-update, and channel management by rajeshkamal5050 · Pull Request #6942 · Azure/azure-dev

rajeshkamal5050 · 2026-02-28T03:36:30Z

Feature

Adds a hidden and feature-toggled azd update command for self-updating azd — background
update checks, staged binary downloads with verification, and channel switching (stable ↔ daily).

Design Doc: #6910
Epic: #6721

Closes #6675
Closes #6722
Closes #6723
Closes #6724
Closes #6726

Follow-up enhancements (tracked under epic #6721)

azd update: rollback/recovery on failed update #6982 — Rollback/recovery on failed update
azd update: crash-loop guard for auto-update #6983 — Crash-loop guard for auto-update
azd update: version pinning support #6984 — Version pinning support
azd update: checksum verification and TOCTOU mitigation #6985 — Checksum verification and TOCTOU mitigation
azd update: concurrent update locking #6986 — Concurrent update locking
azd update: leverage existing install scripts for download and verification #6987 — Leverage existing install scripts for download and verification

Changes

azd update command (cmd/update.go) — Hidden, auto-enables alpha feature on first run. Downloads, verifies, and applies updates. --channel flag for switching between stable/daily with confirmation prompt.
Update manager (pkg/update/manager.go) — Version check via GitHub releases API, download, staged binary verification (codesign on macOS, min size check), and safe file replacement. Injected *http.Client for testability.
Update config (pkg/update/config.go) — updates.channel and updates.autoUpdate settings, gated behind update alpha feature flag.
Auto-update (main.go) — Background check on every invocation with 60s context timeout, stages binaries, auto-applies or shows elevation warning on next run.
Package manager detection — Delegates to brew upgrade (macOS), winget upgrade / choco upgrade (Windows). Script installs use direct binary replacement.
Windows MSI support — Non-package-manager Windows installs download and run the MSI via msiexec /i. msiexec is spawned detached (CREATE_NEW_PROCESS_GROUP | DETACHED_PROCESS) so azd can exit cleanly and release the binary lock before msiexec replaces it.
Version display (cmd/version.go) — Shows (daily) or (stable) channel suffix, channel-aware "out of date" warnings.
Telemetry (internal/tracing/fields/fields.go) — Update outcome, channel, method, error codes.
CI pipeline (eng/pipelines/) — Publishes version.txt alongside daily builds.
Unit tests (pkg/update/*_test.go) — Covers config, update checking, download, verification, staging, and apply flows.

E2E Testing

30 test cases across macOS, Linux, and Windows — all passing.

Test	macOS	Linux	Windows	Notes
A1 Stable update	✅	✅	✅	.zip (mac), .tar.gz (linux), .msi (win)
A2 Already up to date	✅	✅	✅
A3 Daily update	✅	✅	✅
A4 Stable→daily	✅	✅	✅	`--no-prompt` used in Linux/Windows CI
A5 Daily→stable	✅	✅	✅	`--no-prompt` used in Linux/Windows CI
A6 No network	⏭	⏭	☐	Requires manual network disconnect
A7 Invalid channel	✅	✅	✅
A8 Config-only	✅	✅	✅
A9 Help text	✅	✅	✅
A10 CI detection	✅	✅	✅
A11 Toggle off	✅	✅	✅
B1 Brew update	✅	—	—	macOS only
B2 Brew daily blocked	✅	—	—	macOS only
B3 Config-only (brew)	✅	—	—	macOS only
C1 Auto-stage + apply	✅	✅	N/A	Win: staging skipped by design, uses MSI
C2 Elevation warning	✅	⏭	N/A	Linux/Win: CI runs as root/admin
C3 Truncated binary	✅	✅	N/A	Win: staging is mac/linux only
C4 Auto-update off	✅	✅	✅
D1 Combined flags	✅	✅	✅
D2 Code signature	✅	—	✅	Mac: codesign. Win: Authenticode (Valid, Microsoft Corp)
W1 Winget delegation	—	—	⚠️	Delegation works; winget needs interactive terms in CI
W2 Script MSI update	—	—	✅	MSI download + `msiexec /i`
W3 Winget daily blocked	—	—	✅
W4 Choco delegation	—	—	✅	`choco upgrade` successful
W5 Choco daily blocked	—	—	✅
W6 MSI in-place update	—	—	✅	Detached msiexec replaces binary in ~1.7s

Platform Notes

macOS: Tested locally. Downloads .zip, verifies Apple codesign.
Linux: Docker golang:1.25 (linux/amd64). Downloads .tar.gz. ETXTBSY fix (remove-then-create in copyFile) enables C1 auto-apply.
Windows: GitHub Actions windows-latest (Server 2025), full suite run #22610574260 — 38/38 steps pass. Uses MSI installer. W6 validates detached msiexec — binary replaced in ~1.7s while azd exits cleanly (exit code 0).

Known Limitations

Stale daily version.txt — Remote version.txt doesn't match actual binary version. Pipeline fix needed (not an azd code issue).
Auto-update banner — Won't show when updating to production binaries that lack this code. Works once feature ships.
Windows auto-staging — StageUpdate() skips on Windows by design. Windows uses MSI via msiexec, not binary replacement.
Winget interactive terms — winget upgrade requires terms acceptance, which can't be automated in CI.
Elevation warning (C2) — Requires non-admin context. CI environments (admin/root) can't trigger it; success path covered by A1/W2.

Full E2E test details with logs: https://gist.github.com/rajeshkamal5050/d509c03e30a7249a6a4a931ab761a286

Copilot

Pull request overview

Introduces an (alpha/hidden) self-update capability for the azd CLI, including channel selection (stable/daily) and an opt-in background stage/apply auto-update flow, with supporting telemetry and CI artifact publishing.

Changes:

Added azd update (hidden, alpha-gated) plus update configuration (channel, auto-update, check interval).
Implemented update manager for version checks, downloads, staging/applying binaries, and Windows MSI/package-manager aware update paths.
Updated startup/version flows: background update checks + optional staging, applied-update banner, channel suffix in azd version, and added telemetry fields/error mapping.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
eng/pipelines/templates/stages/publish.yml	Publishes `version.txt` for daily builds to support daily version checks.
cli/azd/resources/alpha_features.yaml	Adds `update` alpha feature toggle entry.
cli/azd/pkg/update/manager.go	Core update logic (check/download/stage/apply/replace/verify).
cli/azd/pkg/update/manager_test.go	Unit tests for update manager behaviors.
cli/azd/pkg/update/config.go	Update config + cache read/write helpers (channel/auto-update/interval).
cli/azd/pkg/update/config_test.go	Unit tests for update config + cache compatibility.
cli/azd/pkg/update/errors.go	Typed update errors with telemetry result codes.
cli/azd/main.go	Startup auto-update apply/stage flow + updated out-of-date banner logic.
cli/azd/internal/tracing/fields/fields.go	Adds update-related telemetry attribute keys.
cli/azd/internal/cmd/errors.go	Maps `UpdateError` codes into telemetry errorCode.
cli/azd/cmd/update.go	Implements `azd update` command/action (alpha-gated).
cli/azd/cmd/version.go	Adds optional channel suffix display when update alpha enabled.
cli/azd/cmd/root.go	Registers the hidden `update` command.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cli/azd/pkg/update/config.go

cli/azd/main.go

cli/azd/pkg/update/manager.go

cli/azd/cmd/version.go

cli/azd/pkg/update/config.go

cli/azd/pkg/update/manager.go

cli/azd/cmd/update.go

cli/azd/pkg/update/manager.go

cli/azd/cmd/update.go

hemarina

Should we remainder users to check env if current version is dev version for example azd version 0.0.0-dev.0 (commit 0000000000000000000000000000000000000000)? When I'm in dev version, the azd update runs successfully and I would assume azd version is up to date but I'm actually in dev version. This might be confusing to users.

cli/azd/cmd/update.go

Installs PR Azure#6942 MSI to Program Files, then runs azd update from that location to test msiexec replacing an in-use binary.

wbreza

Consolidated Code Review — PR #6942 vs Design Review (#6910)

TL;DR

The implementation is well-engineered at the code level — clean separation of concerns, thoughtful platform handling, solid test coverage, and proper integration with existing telemetry and error infrastructure. However, none of the 4 critical findings from the design review (#6910) have been addressed, and several new implementation-level issues were found.

Design Feedback Resolution

Category	Raised in #6910	Addressed in #6942	Unresolved
🔴 Critical	4	0	4
🟠 High	8	1 (partial)	7
🆕 New in implementation	—	—	8

🔴 Still-Unresolved Criticals from #6910

Unsigned binaries accepted — verifyStagedBinary still allows unsigned binaries ("not signed at all" → OK). Note: danieljurek commented "Sha does not need to be checked as the download is occurring over HTTPS only" — if the team has accepted this, please document the threat model decision.
No rollback/recovery — ApplyStagedUpdate() overwrites the current binary with no backup. A broken update requires manual reinstall.
No crash-loop guard — No sentinel file or AZD_SKIP_AUTO_UPDATE escape hatch. The marker file is display-only. If the new binary panics during startup before completing initialization, users have no env var to bypass auto-update.
No version pinning — No --version flag or .azd-version file. azd update always gets "latest".

🟠 Still-Unresolved Highs from #6910

No checksum verification — Downloads trust HTTPS only
TOCTOU between stage and apply — No integrity hash stored at staging time; staged binary sits in user-writable space
"daily" vs "nightly" naming — Team disagreement unresolved
MSI for all script installs — Even PowerShell-script-installed azd uses MSI (escalates privilege requirements)
Command conflates config with action — azd update --auto-update on --channel daily does both
"update" vs "upgrade" naming — hemarina: "upgrade" for consistency; kristenwomack: "update" is standard
No concurrent update locking — No file locking on staging directory

🆕 New Implementation Issues

See inline comments for details on each.

✅ What Looks Good

Staged update architecture follows VS Code/Chrome pattern — download in background, apply on next startup
Multi-layered opt-in (alpha flag + auto-update setting + CI detection) is appropriately conservative
ETXTBSY handling on Linux (remove-then-create in copyFile) is a thoughtful detail many implementations miss
Platform-specific MSI/detached process correctly handles binary-in-use constraint on Windows
Telemetry integration with structured error codes follows existing MapError patterns perfectly
Comprehensive test coverage — unit tests for parsing, caching, extraction, staging lifecycle, HTTP transport, and error cases
Error types with UpdateError integrate cleanly with existing error infrastructure

Overall Assessment: Request changes

cli/azd/pkg/update/manager.go

cli/azd/cmd/update.go

cli/azd/main.go

cli/azd/pkg/update/manager.go

cli/azd/pkg/update/manager_test.go

vhvb1989 · 2026-03-03T21:39:51Z

Consolidated Code Review — PR #6942 vs Design Review (#6910)

TL;DR

The implementation is well-engineered at the code level — clean separation of concerns, thoughtful platform handling, solid test coverage, and proper integration with existing telemetry and error infrastructure. However, none of the 4 critical findings from the design review (#6910) have been addressed, and several new implementation-level issues were found.

Design Feedback Resolution

Category Raised in #6910 Addressed in #6942 Unresolved
🔴 Critical 4 0 4
🟠 High 8 1 (partial) 7
🆕 New in implementation — — 8

🔴 Still-Unresolved Criticals from #6910

Unsigned binaries accepted — verifyStagedBinary still allows unsigned binaries ("not signed at all" → OK). Note: danieljurek commented "Sha does not need to be checked as the download is occurring over HTTPS only" — if the team has accepted this, please document the threat model decision.

No rollback/recovery — ApplyStagedUpdate() overwrites the current binary with no backup. A broken update requires manual reinstall.

No crash-loop guard — No sentinel file or AZD_SKIP_AUTO_UPDATE escape hatch. The marker file is display-only. If the new binary panics during startup before completing initialization, users have no env var to bypass auto-update.

No version pinning — No --version flag or .azd-version file. azd update always gets "latest".

🟠 Still-Unresolved Highs from #6910

No checksum verification — Downloads trust HTTPS only

TOCTOU between stage and apply — No integrity hash stored at staging time; staged binary sits in user-writable space

"daily" vs "nightly" naming — Team disagreement unresolved

MSI for all script installs — Even PowerShell-script-installed azd uses MSI (escalates privilege requirements)

Command conflates config with action — azd update --auto-update on --channel daily does both

"update" vs "upgrade" naming — hemarina: "upgrade" for consistency; kristenwomack: "update" is standard

No concurrent update locking — No file locking on staging directory

🆕 New Implementation Issues

See inline comments for details on each.

✅ What Looks Good

Staged update architecture follows VS Code/Chrome pattern — download in background, apply on next startup

Multi-layered opt-in (alpha flag + auto-update setting + CI detection) is appropriately conservative

ETXTBSY handling on Linux (remove-then-create in copyFile) is a thoughtful detail many implementations miss

Platform-specific MSI/detached process correctly handles binary-in-use constraint on Windows

Telemetry integration with structured error codes follows existing MapError patterns perfectly

Comprehensive test coverage — unit tests for parsing, caching, extraction, staging lifecycle, HTTP transport, and error cases

Error types with UpdateError integrate cleanly with existing error infrastructure

Overall Assessment: Request changes

This looks like a GA-ready roadmap for the feature.
It should be OK to move on as we are starting with the feature in alpha mode. @wbreza let it be in alpha and let's use your list to iterate the feature to graduation.

cli/azd/internal/tracing/fields/fields.go

cli/azd/pkg/update/config.go

cli/azd/pkg/update/manager.go

rajeshkamal5050 · 2026-03-04T03:19:37Z

@wbreza Thanks for the comments 👍

All fixed in c9db168:

- Code signature hard-fail — verifyStagedBinary now returns CodeSignatureInvalid error instead of silently succeeding.
- http.DefaultClient no timeout — NewManager accepts injected *http.Client (defaults to 30s timeout). All HTTP calls go through m.httpClient.Do().
- MSI hardcoded to amd64 — buildMSIDownloadURL now uses runtime.GOARCH.
- Alpha auto-enable surprising — Updated banner to clearly state the feature has been auto-enabled and how to disable.
- Background goroutine no cancellation — Now uses context.WithTimeout(60s), cancel called after channel receive.
- Manager bypasses IoC — Intentional. main.go runs pre-IoC for ApplyStagedUpdate at startup (same pattern as tracing init). cmd/update.go goes through IoC normally.
- Loose archive extraction — Replaced broad HasPrefix("azd-") with isAzdBinary() matching exact name or azd-{GOOS}-{GOARCH}.
- Tests modify DefaultTransport — Added testClientWithRewrite() helper with isolated *http.Client. No more global transport swapping.
- Unsigned binaries accepted. Codesign verification now hard-fails. See "Code signature hard-fail"

Pending enhancements tracked as new issues under epic #6721:

- No rollback/recovery — #6982
- No crash-loop guard — #6983
- No version pinning — #6984
- No checksum verification / TOCTOU — #6985. Download is HTTPS-only today. Will evaluate SHA256 verification.
- No concurrent update locking — #6986

Addressed feedback comments - #6942 (comment)

rajeshkamal5050 · 2026-03-04T03:41:03Z

/azp run azure-dev - cli

azure-pipelines · 2026-03-04T03:41:16Z

Azure Pipelines failed to run 1 pipeline(s).

Implements azd update (epic Azure#6721) as a hidden command behind the alpha.update feature toggle (default: off). Features: - Manual update via 'azd update' with install-method-aware strategy (brew/winget/choco delegation, direct binary download for scripts) - Channel switching (stable/daily) with downgrade confirmation - Auto-update: background staging + apply on next startup with re-exec - SHA256 checksum and code signing verification (macOS/Windows) - Elevation-aware auto-update (graceful fallback to warning for system installs, silent apply for user-writable locations) - Daily version tracking via single-line version.txt with build number parsed from the daily.N suffix - CI detection to skip auto-update in pipelines - 13 telemetry error codes integrated into MapError pipeline - azd version shows channel suffix when feature is enabled - Zero behavior change when alpha.update is off Pipeline changes: - Daily publish writes version.txt with full version string - SHA256 checksum generation for binary downloads Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

On Linux, os.Create fails with ETXTBSY when overwriting a running executable. Fix copyFile to unlink the old file first (the running process retains its fd via the inode), then create a new file at the same path. If the unlink fails with permission denied (e.g. root-owned directory), return the permission error so ApplyStagedUpdate can trigger the elevation/keep-staged path. Also preserve source file permissions via os.Chmod after remove-then- create, since the new file would otherwise get default 0666 permissions instead of the original executable 0755. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dev builds should not self-update — developers build from source. Returns a clear error message instead of silently replacing the dev binary with a release build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

msiexec cannot replace a locked executable. Previously azd ran msiexec as a child process and waited. msiexec would kill the parent azd before completing, leaving the binary unreplaced. Now msiexec is spawned detached with CREATE_NEW_PROCESS_GROUP and DETACHED_PROCESS on Windows so azd can exit normally and release the binary lock. msiexec then completes the replacement independently. Always writes verbose MSI log to ~/.azd/logs/msi-update.log for diagnosability. Debug mode shows the log path and msiexec command line. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The auto-enable logic re-enables the alpha feature on every run, so telling users to unset it is confusing since it has no effect. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ontext timeout - N1+C1: Code signature verification hard-fails with CodeSignatureInvalid instead of silently skipping on error - N2+N6: Inject *http.Client into Manager with 30s timeout, replacing http.DefaultClient usage (resolves gosec G704 SSRF warnings) - N3: Background goroutine uses context.WithTimeout(60s) instead of context.Background() to prevent hung goroutines - N4: MSI download URL uses runtime.GOARCH instead of hardcoded amd64 - N5: Alpha auto-enable banner clarifies what gets enabled - N7: Archive extraction uses isAzdBinary() to match exact name or platform-specific name (azd-{os}-{arch}), not broad prefix - N8: Tests inject HTTP client via constructor instead of swapping http.DefaultTransport globally Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The new pwsh and AzurePowerShell steps were indented 2 spaces too deep, making them appear nested under the previous template's parameters block instead of as sibling steps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

azure-sdk · 2026-03-04T14:47:05Z

Azure Dev CLI Install Instructions

Install scripts

MacOS/Linux

May elevate using sudo on some platforms and configurations

bash:

curl -fsSL https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/uninstall-azd.sh | bash;
curl -fsSL https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/install-azd.sh | bash -s -- --base-url https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942 --version '' --verbose --skip-verify

pwsh:

Invoke-RestMethod 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/uninstall-azd.ps1' -OutFile uninstall-azd.ps1; ./uninstall-azd.ps1
Invoke-RestMethod 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/install-azd.ps1' -OutFile install-azd.ps1; ./install-azd.ps1 -BaseUrl 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942' -Version '' -SkipVerify -Verbose

Windows

PowerShell install

powershell -c "Set-ExecutionPolicy Bypass Process; irm 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/uninstall-azd.ps1' > uninstall-azd.ps1; ./uninstall-azd.ps1;"
powershell -c "Set-ExecutionPolicy Bypass Process; irm 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/install-azd.ps1' > install-azd.ps1; ./install-azd.ps1 -BaseUrl 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942' -Version '' -SkipVerify -Verbose;"

MSI install

powershell -c "irm 'https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/azd-windows-amd64.msi' -OutFile azd-windows-amd64.msi; msiexec /i azd-windows-amd64.msi /qn"

Standalone Binary

MSI

x86_64 - https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/pr/6942/azd-windows-amd64.msi

Documentation

learn.microsoft.com documentation

title: Azure Developer CLI reference
description: This article explains the syntax and parameters for the various Azure Developer CLI commands.
author: alexwolfmsft
ms.author: alexwolf
ms.date: 03/04/2026
ms.service: azure-dev-cli
ms.topic: conceptual
ms.custom: devx-track-azdevcli

Azure Developer CLI reference

This article explains the syntax and parameters for the various Azure Developer CLI commands.

azd

The Azure Developer CLI (azd) is an open-source tool that helps onboard and manage your project on Azure

Options

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --docs         Opens the documentation for azd in your web browser.
  -h, --help         Gets help for azd.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd add

Add a component to your project.

azd add [flags]

Options

      --docs   Opens the documentation for azd add in your web browser.
  -h, --help   Gets help for add.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd auth

Authenticate with Azure.

Options

      --docs   Opens the documentation for azd auth in your web browser.
  -h, --help   Gets help for auth.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd auth login

Log in to Azure.

Synopsis

Log in to Azure.

When run without any arguments, log in interactively using a browser. To log in using a device code, pass
--use-device-code.

To log in as a service principal, pass --client-id and --tenant-id as well as one of: --client-secret,
--client-certificate, or --federated-credential-provider.

To log in using a managed identity, pass --managed-identity, which will use the system assigned managed identity.
To use a user assigned managed identity, pass --client-id in addition to --managed-identity with the client id of
the user assigned managed identity you wish to use.

azd auth login [flags]

Options

      --check-status                           Checks the log-in status instead of logging in.
      --client-certificate string              The path to the client certificate for the service principal to authenticate with.
      --client-id string                       The client id for the service principal to authenticate with.
      --client-secret string                   The client secret for the service principal to authenticate with. Set to the empty string to read the value from the console.
      --docs                                   Opens the documentation for azd auth login in your web browser.
      --federated-credential-provider string   The provider to use to acquire a federated token to authenticate with. Supported values: github, azure-pipelines, oidc
  -h, --help                                   Gets help for login.
      --managed-identity                       Use a managed identity to authenticate.
      --redirect-port int                      Choose the port to be used as part of the redirect URI during interactive login.
      --tenant-id string                       The tenant id or domain name to authenticate with.
      --use-device-code[=true]                 When true, log in by using a device code instead of a browser.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd auth logout

Log out of Azure.

Synopsis

Log out of Azure

azd auth logout [flags]

Options

      --docs   Opens the documentation for azd auth logout in your web browser.
  -h, --help   Gets help for logout.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd auth status

Show the current authentication status.

Synopsis

Display whether you are logged in to Azure and the associated account information.

azd auth status [flags]

Options

      --docs   Opens the documentation for azd auth status in your web browser.
  -h, --help   Gets help for status.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd completion

Generate shell completion scripts.

Synopsis

Generate shell completion scripts for azd.

The completion command allows you to generate autocompletion scripts for your shell,
currently supports bash, zsh, fish and PowerShell.

See each sub-command's help for details on how to use the generated script.

Options

      --docs   Opens the documentation for azd completion in your web browser.
  -h, --help   Gets help for completion.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd completion bash

Generate bash completion script.

azd completion bash

Options

      --docs   Opens the documentation for azd completion bash in your web browser.
  -h, --help   Gets help for bash.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd completion fig

Generate Fig autocomplete spec.

azd completion fig

Options

      --docs   Opens the documentation for azd completion fig in your web browser.
  -h, --help   Gets help for fig.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd completion fish

Generate fish completion script.

azd completion fish

Options

      --docs   Opens the documentation for azd completion fish in your web browser.
  -h, --help   Gets help for fish.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd completion powershell

Generate PowerShell completion script.

azd completion powershell

Options

      --docs   Opens the documentation for azd completion powershell in your web browser.
  -h, --help   Gets help for powershell.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd completion zsh

Generate zsh completion script.

azd completion zsh

Options

      --docs   Opens the documentation for azd completion zsh in your web browser.
  -h, --help   Gets help for zsh.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config

Manage azd configurations (ex: default Azure subscription, location).

Synopsis

Manage the Azure Developer CLI user configuration, which includes your default Azure subscription and location.

Available since azure-dev-cli_0.4.0-beta.1.

The easiest way to configure azd for the first time is to run azd init. The subscription and location you select will be stored in the config.json file located in the config directory. To configure azd anytime afterwards, you'll use azd config set.

The default value of the config directory is:

$HOME/.azd on Linux and macOS
%USERPROFILE%.azd on Windows

The configuration directory can be overridden by specifying a path in the AZD_CONFIG_DIR environment variable.

Options

      --docs   Opens the documentation for azd config in your web browser.
  -h, --help   Gets help for config.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config get

Gets a configuration.

Synopsis

Gets a configuration in the configuration path.

The default value of the config directory is:

$HOME/.azd on Linux and macOS
%USERPROFILE%\.azd on Windows

The configuration directory can be overridden by specifying a path in the AZD_CONFIG_DIR environment variable.

azd config get <path> [flags]

Options

      --docs   Opens the documentation for azd config get in your web browser.
  -h, --help   Gets help for get.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config list-alpha

Display the list of available features in alpha stage.

azd config list-alpha [flags]

Options

      --docs   Opens the documentation for azd config list-alpha in your web browser.
  -h, --help   Gets help for list-alpha.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config options

List all available configuration settings.

Synopsis

List all possible configuration settings that can be set with azd, including descriptions and allowed values.

azd config options [flags]

Options

      --docs   Opens the documentation for azd config options in your web browser.
  -h, --help   Gets help for options.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config reset

Resets configuration to default.

Synopsis

Resets all configuration in the configuration path.

The default value of the config directory is:

$HOME/.azd on Linux and macOS
%USERPROFILE%\.azd on Windows

The configuration directory can be overridden by specifying a path in the AZD_CONFIG_DIR environment variable to the default.

azd config reset [flags]

Options

      --docs    Opens the documentation for azd config reset in your web browser.
  -f, --force   Force reset without confirmation.
  -h, --help    Gets help for reset.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config set

Sets a configuration.

Synopsis

Sets a configuration in the configuration path.

The default value of the config directory is:

$HOME/.azd on Linux and macOS
%USERPROFILE%\.azd on Windows

The configuration directory can be overridden by specifying a path in the AZD_CONFIG_DIR environment variable.

azd config set <path> <value> [flags]

Examples

azd config set defaults.subscription <yourSubscriptionID>
azd config set defaults.location eastus

Options

      --docs   Opens the documentation for azd config set in your web browser.
  -h, --help   Gets help for set.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config show

Show all the configuration values.

Synopsis

Show all configuration values in the configuration path.

The default value of the config directory is:

$HOME/.azd on Linux and macOS
%USERPROFILE%\.azd on Windows

The configuration directory can be overridden by specifying a path in the AZD_CONFIG_DIR environment variable.

azd config show [flags]

Options

      --docs   Opens the documentation for azd config show in your web browser.
  -h, --help   Gets help for show.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd config unset

Unsets a configuration.

Synopsis

Removes a configuration in the configuration path.

The default value of the config directory is:

$HOME/.azd on Linux and macOS
%USERPROFILE%\.azd on Windows

The configuration directory can be overridden by specifying a path in the AZD_CONFIG_DIR environment variable.

azd config unset <path> [flags]

Examples

azd config unset defaults.location

Options

      --docs   Opens the documentation for azd config unset in your web browser.
  -h, --help   Gets help for unset.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd deploy

Deploy your project code to Azure.

azd deploy <service> [flags]

Options

      --all                   Deploys all services that are listed in azure.yaml
      --docs                  Opens the documentation for azd deploy in your web browser.
  -e, --environment string    The name of the environment to use.
      --from-package string   Deploys the packaged service located at the provided path. Supports zipped file packages (file path) or container images (image tag).
  -h, --help                  Gets help for deploy.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd down

Delete your project's Azure resources.

azd down [<layer>] [flags]

Options

      --docs                 Opens the documentation for azd down in your web browser.
  -e, --environment string   The name of the environment to use.
      --force                Does not require confirmation before it deletes resources.
  -h, --help                 Gets help for down.
      --purge                Does not require confirmation before it permanently deletes resources that are soft-deleted by default (for example, key vaults).

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env

Manage environments (ex: default environment, environment variables).

Options

      --docs   Opens the documentation for azd env in your web browser.
  -h, --help   Gets help for env.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env config

Manage environment configuration (ex: stored in .azure//config.json).

Options

      --docs   Opens the documentation for azd env config in your web browser.
  -h, --help   Gets help for config.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env config get

Gets a configuration value from the environment.

Synopsis

Gets a configuration value from the environment's config.json file.

azd env config get <path> [flags]

Options

      --docs                 Opens the documentation for azd env config get in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for get.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env config set

Sets a configuration value in the environment.

Synopsis

Sets a configuration value in the environment's config.json file.

Values are automatically parsed as JSON types when possible. Booleans (true/false),
numbers (42, 3.14), arrays ([...]), and objects ({...}) are stored with their native
JSON types. Plain text values are stored as strings. To force a JSON-typed value to be
stored as a string, wrap it in JSON quotes (e.g. '"true"' or '"8080"').

azd env config set <path> <value> [flags]

Examples

azd env config set myapp.endpoint https://example.com
azd env config set myapp.debug true
azd env config set myapp.count 42
azd env config set infra.parameters.tags '{"env":"dev"}'
azd env config set myapp.port '"8080"'

Options

      --docs                 Opens the documentation for azd env config set in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for set.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env config unset

Unsets a configuration value in the environment.

Synopsis

Removes a configuration value from the environment's config.json file.

azd env config unset <path> [flags]

Examples

azd env config unset myapp.endpoint

Options

      --docs                 Opens the documentation for azd env config unset in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for unset.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env get-value

Get specific environment value.

azd env get-value <keyName> [flags]

Options

      --docs                 Opens the documentation for azd env get-value in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for get-value.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env get-values

Get all environment values.

azd env get-values [flags]

Options

      --docs                 Opens the documentation for azd env get-values in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for get-values.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env list

List environments.

azd env list [flags]

Options

      --docs   Opens the documentation for azd env list in your web browser.
  -h, --help   Gets help for list.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env new

Create a new environment and set it as the default.

azd env new <environment> [flags]

Options

      --docs                  Opens the documentation for azd env new in your web browser.
  -h, --help                  Gets help for new.
  -l, --location string       Azure location for the new environment
      --subscription string   ID of an Azure subscription to use for the new environment

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env refresh

Refresh environment values by using information from a previous infrastructure provision.

azd env refresh <environment> [flags]

Options

      --docs                 Opens the documentation for azd env refresh in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for refresh.
      --hint string          Hint to help identify the environment to refresh
      --layer string         Provisioning layer to refresh the environment from.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env remove

Remove an environment.

azd env remove <environment> [flags]

Options

      --docs                 Opens the documentation for azd env remove in your web browser.
  -e, --environment string   The name of the environment to use.
      --force                Skips confirmation before performing removal.
  -h, --help                 Gets help for remove.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env select

Set the default environment.

azd env select [<environment>] [flags]

Options

      --docs   Opens the documentation for azd env select in your web browser.
  -h, --help   Gets help for select.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env set

Set one or more environment values.

Synopsis

Set one or more environment values using key-value pairs or by loading from a .env formatted file.

azd env set [<key> <value>] | [<key>=<value> ...] | [--file <filepath>] [flags]

Options

      --docs                 Opens the documentation for azd env set in your web browser.
  -e, --environment string   The name of the environment to use.
      --file string          Path to .env formatted file to load environment values from.
  -h, --help                 Gets help for set.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd env set-secret

Set a name as a reference to a Key Vault secret in the environment.

Synopsis

You can either create a new Key Vault secret or select an existing one.
The provided name is the key for the .env file which holds the secret reference to the Key Vault secret.

azd env set-secret <name> [flags]

Options

      --docs                 Opens the documentation for azd env set-secret in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for set-secret.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension

Manage azd extensions.

Options

      --docs   Opens the documentation for azd extension in your web browser.
  -h, --help   Gets help for extension.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension install

Installs specified extensions.

azd extension install <extension-id> [flags]

Options

      --docs             Opens the documentation for azd extension install in your web browser.
  -f, --force            Force installation, including downgrades and reinstalls
  -h, --help             Gets help for install.
  -s, --source string    The extension source to use for installs
  -v, --version string   The version of the extension to install

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension list

List available extensions.

azd extension list [--installed] [flags]

Options

      --docs            Opens the documentation for azd extension list in your web browser.
  -h, --help            Gets help for list.
      --installed       List installed extensions
      --source string   Filter extensions by source
      --tags strings    Filter extensions by tags

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension show

Show details for a specific extension.

azd extension show <extension-id> [flags]

Options

      --docs            Opens the documentation for azd extension show in your web browser.
  -h, --help            Gets help for show.
  -s, --source string   The extension source to use.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension source

View and manage extension sources

Options

      --docs   Opens the documentation for azd extension source in your web browser.
  -h, --help   Gets help for source.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension source add

Add an extension source with the specified name

azd extension source add [flags]

Options

      --docs              Opens the documentation for azd extension source add in your web browser.
  -h, --help              Gets help for add.
  -l, --location string   The location of the extension source
  -n, --name string       The name of the extension source
  -t, --type string       The type of the extension source. Supported types are 'file' and 'url'

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension source list

List extension sources

azd extension source list [flags]

Options

      --docs   Opens the documentation for azd extension source list in your web browser.
  -h, --help   Gets help for list.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension source remove

Remove an extension source with the specified name

azd extension source remove <name> [flags]

Options

      --docs   Opens the documentation for azd extension source remove in your web browser.
  -h, --help   Gets help for remove.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension source validate

Validate an extension source's registry.json file.

Synopsis

Validate an extension source's registry.json file.

Accepts a source name (from 'azd extension source list'), a local file path,
or a URL. Checks required fields, valid capabilities, semver version format,
platform artifact structure, and extension ID format.

azd extension source validate <name-or-path-or-url> [flags]

Options

      --docs     Opens the documentation for azd extension source validate in your web browser.
  -h, --help     Gets help for validate.
      --strict   Enable strict validation (require checksums)

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension uninstall

Uninstall specified extensions.

azd extension uninstall [extension-id] [flags]

Options

      --all    Uninstall all installed extensions
      --docs   Opens the documentation for azd extension uninstall in your web browser.
  -h, --help   Gets help for uninstall.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd extension upgrade

Upgrade specified extensions.

azd extension upgrade [extension-id] [flags]

Options

      --all              Upgrade all installed extensions
      --docs             Opens the documentation for azd extension upgrade in your web browser.
  -h, --help             Gets help for upgrade.
  -s, --source string    The extension source to use for upgrades
  -v, --version string   The version of the extension to upgrade to

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd hooks

Develop, test and run hooks for a project.

Options

      --docs   Opens the documentation for azd hooks in your web browser.
  -h, --help   Gets help for hooks.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd hooks run

Runs the specified hook for the project and services

azd hooks run <name> [flags]

Options

      --docs                 Opens the documentation for azd hooks run in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for run.
      --platform string      Forces hooks to run for the specified platform.
      --service string       Only runs hooks for the specified service.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd infra

Manage your Infrastructure as Code (IaC).

Options

      --docs   Opens the documentation for azd infra in your web browser.
  -h, --help   Gets help for infra.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd infra generate

Write IaC for your project to disk, allowing you to manually manage it.

azd infra generate [flags]

Options

      --docs                 Opens the documentation for azd infra generate in your web browser.
  -e, --environment string   The name of the environment to use.
      --force                Overwrite any existing files without prompting
  -h, --help                 Gets help for generate.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd init

Initialize a new application.

azd init [flags]

Options

  -b, --branch string         The template branch to initialize from. Must be used with a template argument (--template or -t).
      --docs                  Opens the documentation for azd init in your web browser.
  -e, --environment string    The name of the environment to use.
  -f, --filter strings        The tag(s) used to filter template results. Supports comma-separated values.
      --from-code             Initializes a new application from your existing code.
  -h, --help                  Gets help for init.
  -l, --location string       Azure location for the new environment
  -m, --minimal               Initializes a minimal project.
  -s, --subscription string   ID of an Azure subscription to use for the new environment
  -t, --template string       Initializes a new application from a template. You can use a Full URI, <owner>/<repository>, <repository> if it's part of the azure-samples organization, or a local directory path (./dir, ../dir, or absolute path).
      --up                    Provision and deploy to Azure after initializing the project from a template.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd mcp

Manage Model Context Protocol (MCP) server. (Alpha)

Options

      --docs   Opens the documentation for azd mcp in your web browser.
  -h, --help   Gets help for mcp.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd mcp consent

Manage MCP tool consent.

Synopsis

Manage consent rules for MCP tool execution.

Options

      --docs   Opens the documentation for azd mcp consent in your web browser.
  -h, --help   Gets help for consent.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd mcp consent grant

Grant consent trust rules.

Synopsis

Grant trust rules for MCP tools and servers.

This command creates consent rules that allow MCP tools to execute
without prompting for permission. You can specify different permission
levels and scopes for the rules.

Examples:

Grant always permission to all tools globally

azd mcp consent grant --global --permission always

Grant project permission to a specific tool with read-only scope

azd mcp consent grant --server my-server --tool my-tool --permission project --scope read-only

azd mcp consent grant [flags]

Options

      --action string       Action type: 'all' or 'readonly' (default "all")
      --docs                Opens the documentation for azd mcp consent grant in your web browser.
      --global              Apply globally to all servers
  -h, --help                Gets help for grant.
      --operation string    Operation type: 'tool' or 'sampling' (default "tool")
      --permission string   Permission: 'allow', 'deny', or 'prompt' (default "allow")
      --scope string        Rule scope: 'global', or 'project' (default "global")
      --server string       Server name
      --tool string         Specific tool name (requires --server)

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd mcp consent list

List consent rules.

Synopsis

List all consent rules for MCP tools.

azd mcp consent list [flags]

Options

      --action string       Action type to filter by (readonly, any)
      --docs                Opens the documentation for azd mcp consent list in your web browser.
  -h, --help                Gets help for list.
      --operation string    Operation to filter by (tool, sampling)
      --permission string   Permission to filter by (allow, deny, prompt)
      --scope string        Consent scope to filter by (global, project). If not specified, lists rules from all scopes.
      --target string       Specific target to operate on (server/tool format)

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd mcp consent revoke

Revoke consent rules.

Synopsis

Revoke consent rules for MCP tools.

azd mcp consent revoke [flags]

Options

      --action string       Action type to filter by (readonly, any)
      --docs                Opens the documentation for azd mcp consent revoke in your web browser.
  -h, --help                Gets help for revoke.
      --operation string    Operation to filter by (tool, sampling)
      --permission string   Permission to filter by (allow, deny, prompt)
      --scope string        Consent scope to filter by (global, project). If not specified, revokes rules from all scopes.
      --target string       Specific target to operate on (server/tool format)

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd mcp start

Starts the MCP server.

Synopsis

Starts the Model Context Protocol (MCP) server.

This command starts an MCP server that can be used by MCP clients to access
azd functionality through the Model Context Protocol interface.

azd mcp start [flags]

Options

      --docs   Opens the documentation for azd mcp start in your web browser.
  -h, --help   Gets help for start.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd monitor

Monitor a deployed project.

azd monitor [flags]

Options

      --docs                 Opens the documentation for azd monitor in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for monitor.
      --live                 Open a browser to Application Insights Live Metrics. Live Metrics is currently not supported for Python apps.
      --logs                 Open a browser to Application Insights Logs.
      --overview             Open a browser to Application Insights Overview Dashboard.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd package

Packages the project's code to be deployed to Azure.

azd package <service> [flags]

Options

      --all                  Packages all services that are listed in azure.yaml
      --docs                 Opens the documentation for azd package in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for package.
      --output-path string   File or folder path where the generated packages will be saved.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd pipeline

Manage and configure your deployment pipelines.

Options

      --docs   Opens the documentation for azd pipeline in your web browser.
  -h, --help   Gets help for pipeline.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd pipeline config

Configure your deployment pipeline to connect securely to Azure. (Beta)

azd pipeline config [flags]

Options

  -m, --applicationServiceManagementReference string   Service Management Reference. References application or service contact information from a Service or Asset Management database. This value must be a Universally Unique Identifier (UUID). You can set this value globally by running azd config set pipeline.config.applicationServiceManagementReference <UUID>.
      --auth-type string                               The authentication type used between the pipeline provider and Azure for deployment (Only valid for GitHub provider). Valid values: federated, client-credentials.
      --docs                                           Opens the documentation for azd pipeline config in your web browser.
  -e, --environment string                             The name of the environment to use.
  -h, --help                                           Gets help for config.
      --principal-id string                            The client id of the service principal to use to grant access to Azure resources as part of the pipeline.
      --principal-name string                          The name of the service principal to use to grant access to Azure resources as part of the pipeline.
      --principal-role stringArray                     The roles to assign to the service principal. By default the service principal will be granted the Contributor and User Access Administrator roles. (default [Contributor,User Access Administrator])
      --provider string                                The pipeline provider to use (github for Github Actions and azdo for Azure Pipelines).
      --remote-name string                             The name of the git remote to configure the pipeline to run on. (default "origin")

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd provision

Provision Azure resources for your project.

azd provision [<layer>] [flags]

Options

      --docs                  Opens the documentation for azd provision in your web browser.
  -e, --environment string    The name of the environment to use.
  -h, --help                  Gets help for provision.
  -l, --location string       Azure location for the new environment
      --no-state              (Bicep only) Forces a fresh deployment based on current Bicep template files, ignoring any stored deployment state.
      --preview               Preview changes to Azure resources.
      --subscription string   ID of an Azure subscription to use for the new environment

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd publish

Publish a service to a container registry.

azd publish <service> [flags]

Options

      --all                   Publishes all services that are listed in azure.yaml
      --docs                  Opens the documentation for azd publish in your web browser.
  -e, --environment string    The name of the environment to use.
      --from-package string   Publishes the service from a container image (image tag).
  -h, --help                  Gets help for publish.
      --to string             The target container image in the form '[registry/]repository[:tag]' to publish to.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd restore

Restores the project's dependencies.

azd restore <service> [flags]

Options

      --all                  Restores all services that are listed in azure.yaml
      --docs                 Opens the documentation for azd restore in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for restore.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd show

Display information about your project and its resources.

azd show [resource-name|resource-id] [flags]

Options

      --docs                 Opens the documentation for azd show in your web browser.
  -e, --environment string   The name of the environment to use.
  -h, --help                 Gets help for show.
      --show-secrets         Unmask secrets in output.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template

Find and view template details.

Options

      --docs   Opens the documentation for azd template in your web browser.
  -h, --help   Gets help for template.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template list

Show list of sample azd templates. (Beta)

azd template list [flags]

Options

      --docs             Opens the documentation for azd template list in your web browser.
  -f, --filter strings   The tag(s) used to filter template results. Supports comma-separated values.
  -h, --help             Gets help for list.
  -s, --source string    Filters templates by source.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template show

Show details for a given template. (Beta)

azd template show <template> [flags]

Options

      --docs   Opens the documentation for azd template show in your web browser.
  -h, --help   Gets help for show.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template source

View and manage template sources. (Beta)

Options

      --docs   Opens the documentation for azd template source in your web browser.
  -h, --help   Gets help for source.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template source add

Adds an azd template source with the specified key. (Beta)

Synopsis

The key can be any value that uniquely identifies the template source, with well-known values being:
・default: Default templates
・awesome-azd: Templates from https://aka.ms/awesome-azd

azd template source add <key> [flags]

Options

      --docs              Opens the documentation for azd template source add in your web browser.
  -h, --help              Gets help for add.
  -l, --location string   Location of the template source. Required when using type flag.
  -n, --name string       Display name of the template source.
  -t, --type string       Kind of the template source. Supported types are 'file', 'url' and 'gh'.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template source list

Lists the configured azd template sources. (Beta)

azd template source list [flags]

Options

      --docs   Opens the documentation for azd template source list in your web browser.
  -h, --help   Gets help for list.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd template source remove

Removes the specified azd template source (Beta)

azd template source remove <key> [flags]

Options

      --docs   Opens the documentation for azd template source remove in your web browser.
  -h, --help   Gets help for remove.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd up

Provision and deploy your project to Azure with a single command.

azd up [flags]

Options

      --docs                  Opens the documentation for azd up in your web browser.
  -e, --environment string    The name of the environment to use.
  -h, --help                  Gets help for up.
  -l, --location string       Azure location for the new environment
      --subscription string   ID of an Azure subscription to use for the new environment

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

azd version

Print the version number of Azure Developer CLI.

azd version [flags]

Options

      --docs   Opens the documentation for azd version in your web browser.
  -h, --help   Gets help for version.

Options inherited from parent commands

  -C, --cwd string   Sets the current working directory.
      --debug        Enables debugging and diagnostics logging.
      --no-prompt    Accepts the default value instead of prompting, or it fails if there is no default.

Re-review Summary (PR #6942)

Re-evaluating my previous Critical findings with additional design context from the team:

Previous Criticals — Revised

Issue	Previous	Revised	Rationale
Unsigned binaries	Critical	Resolved	Code signature now hard-fails for invalid signatures. Unsigned dev builds being allowed is intentional
No rollback	Critical	Medium	For a CLI tool with signature verification, corrupt update risk is low. Users can reinstall. Nice-to-have, not a blocker
No crash-loop guard	Critical	Medium	`ApplyStagedUpdate` consumes staged binary, so auto-update won't loop. Alpha feature with CI exclusion
No version pinning	Critical	By Design	`azd update` is forward-only, not a package manager

What Improved Since Last Review

HTTP client injection for testability
Code signature hard-fail for invalid signatures
Context timeout added
Dev build blocking (0.0.0-dev.0)
Linux ETXTBSY handling

Remaining Suggestion

Consider documenting the recovery path (reinstall via curl or MSI) in the azd update output or help text, so users know what to do if an update goes wrong.

Assessment: Progress made on previous feedback. The design decisions around no version pinning and forward-only updates make sense for the tool's use case.

wbreza

Code Review - Prior Feedback Verification

All prior review items addressed

I verified all 23 prior review comment threads across Copilot (9), wbreza (8), hemarina/vhvb1989 (2), danieljurek (3), and weikanglim (1).

Status	Count
Fully Resolved	17
Partially Addressed (justified)	3
Unresolved Discussion	1
New Findings (Medium)	2

Key resolutions since last review:

Code signature verification now returns hard errors instead of swallowing failures
HTTP client has 30s timeout (no more unbounded DefaultClient)
Background goroutine uses context.WithTimeout(60s) + cancel
MSI URL uses runtime.GOARCH (ARM64-safe)
Archive extraction uses exact binary name matching
Tests use injected HTTP clients instead of modifying global DefaultTransport
StageUpdate correctly skips on Windows
Alpha auto-enable shows user-facing heads-up message

Remaining minor items (non-blocking):

replaceBinary/ApplyStagedUpdate copy is not atomic (temp+rename) - mitigated by staged binary verification on next startup
verifyStagedBinary vs verifyCodesignMac have different unsigned-binary policies - intentional for dev builds in auto-apply path
IoC bypass in main.go is justified (background check runs before container init)

What Looks Good:

Comprehensive table-driven tests (650+ lines) with httptest.NewServer and injected clients
Clean separation: config, errors, platform-specific MSI, core logic
Proper context propagation throughout
Well-structured telemetry with clear result codes
Install-method-aware update dispatch

Overall: Approving - all prior feedback addressed or tracked in follow-up issues (#6982, #6985, #6986, #6987).

cli/azd/cmd/update.go

cli/azd/pkg/update/manager.go

Copilot AI review requested due to automatic review settings February 28, 2026 03:36

rajeshkamal5050 requested review from JeffreyCA, danieljurek, hemarina, tg-msft, vhvb1989, wbreza and weikanglim as code owners February 28, 2026 03:36

microsoft-github-policy-service bot assigned rajeshkamal5050 Feb 28, 2026

Copilot started reviewing on behalf of rajeshkamal5050 February 28, 2026 03:37 View session

Copilot AI reviewed Feb 28, 2026

View reviewed changes

rajeshkamal5050 force-pushed the feature/azd-update branch 3 times, most recently from fbdb4c1 to 723509e Compare February 28, 2026 06:07

vhvb1989 approved these changes Mar 1, 2026

View reviewed changes

cli/azd/cmd/update.go Show resolved Hide resolved

rajeshkamal5050 force-pushed the feature/azd-update branch from 723509e to 2d57468 Compare March 1, 2026 07:50

vhvb1989 approved these changes Mar 2, 2026

View reviewed changes

hemarina reviewed Mar 2, 2026

View reviewed changes

cli/azd/cmd/update.go Outdated Show resolved Hide resolved

kristenwomack approved these changes Mar 3, 2026

View reviewed changes

rajeshkamal5050 added a commit to rajeshkamal5050/azure-dev that referenced this pull request Mar 3, 2026

Add W6: MSI in-place self-update test

ee1b45a

Installs PR Azure#6942 MSI to Program Files, then runs azd update from that location to test msiexec replacing an in-use binary.

hemarina approved these changes Mar 3, 2026

View reviewed changes

rajeshkamal5050 requested review from hemarina, kristenwomack and vhvb1989 March 3, 2026 19:15

wbreza previously requested changes Mar 3, 2026

View reviewed changes

danieljurek reviewed Mar 3, 2026

View reviewed changes

cli/azd/internal/tracing/fields/fields.go Show resolved Hide resolved

danieljurek reviewed Mar 3, 2026

View reviewed changes

cli/azd/pkg/update/config.go Show resolved Hide resolved

danieljurek reviewed Mar 3, 2026

View reviewed changes

cli/azd/pkg/update/manager.go Show resolved Hide resolved

rajeshkamal5050 mentioned this pull request Mar 4, 2026

azd update: rollback/recovery on failed update #6982

Open

This was referenced Mar 4, 2026

azd update: concurrent update locking #6986

Open

azd update: leverage existing install scripts for download and verification #6987

Open

rajeshkamal5050 requested a review from wbreza March 4, 2026 03:22

rajeshkamal5050 and others added 8 commits March 3, 2026 19:47

Block azd update for dev builds (0.0.0-dev.0)

f4607c1

Dev builds should not self-update — developers build from source. Returns a clear error message instead of silently replacing the dev binary with a release build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove misleading alpha toggle hint from azd update

232521c

The auto-enable logic re-enables the alpha feature on every run, so telling users to unset it is confusing since it has no effect. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix gosec G204 lint for msiexec command

eef1b07

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix lll lint: move nolint directive to line above

2e21f1b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rajeshkamal5050 force-pushed the feature/azd-update branch from c9db168 to e4d3be2 Compare March 4, 2026 03:48

rajeshkamal5050 and others added 2 commits March 3, 2026 19:50

chore: remove publish.yml changes, handled by Azure#6989

fa86797

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

weikanglim reviewed Mar 4, 2026

View reviewed changes

cli/azd/pkg/update/manager.go Show resolved Hide resolved

This was referenced Mar 4, 2026

azd update: open design decisions requiring team alignment #7002

Open

[design] azd update command, auto-update, and channel management #6910

Merged

wbreza reviewed Mar 4, 2026

View reviewed changes

weikanglim approved these changes Mar 5, 2026

View reviewed changes

wbreza approved these changes Mar 5, 2026

View reviewed changes

cli/azd/cmd/update.go Show resolved Hide resolved

cli/azd/pkg/update/manager.go Show resolved Hide resolved

rajeshkamal5050 merged commit a6464ed into Azure:main Mar 5, 2026
26 checks passed

rajeshkamal5050 mentioned this pull request Mar 5, 2026

[minor-fixes] azd update: infer channel from binary version and block PR builds #7011

Merged

This was referenced Mar 5, 2026

Add azd update command for upgrading CLI and switching between stable/insiders channels #6673

Closed

Prototype opt‑in auto‑update for Insiders builds #6725

Closed

rajeshkamal5050 deleted the feature/azd-update branch March 7, 2026 03:45

Conversation

rajeshkamal5050 commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Feature

Follow-up enhancements (tracked under epic #6721)

Changes

E2E Testing

Platform Notes

Known Limitations

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hemarina left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wbreza left a comment

Choose a reason for hiding this comment

Consolidated Code Review — PR #6942 vs Design Review (#6910)

TL;DR

Design Feedback Resolution

🔴 Still-Unresolved Criticals from #6910

🟠 Still-Unresolved Highs from #6910

🆕 New Implementation Issues

✅ What Looks Good

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vhvb1989 commented Mar 3, 2026

Consolidated Code Review — PR #6942 vs Design Review (#6910)

TL;DR

Design Feedback Resolution

🔴 Still-Unresolved Criticals from #6910

🟠 Still-Unresolved Highs from #6910

🆕 New Implementation Issues

✅ What Looks Good

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rajeshkamal5050 commented Mar 4, 2026

Uh oh!

rajeshkamal5050 commented Mar 4, 2026

Uh oh!

azure-pipelines bot commented Mar 4, 2026

Uh oh!

azure-sdk commented Mar 4, 2026

Azure Dev CLI Install Instructions

Install scripts

MacOS/Linux

Windows

Standalone Binary

MSI

Documentation

title: Azure Developer CLI reference description: This article explains the syntax and parameters for the various Azure Developer CLI commands. author: alexwolfmsft ms.author: alexwolf ms.date: 03/04/2026 ms.service: azure-dev-cli ms.topic: conceptual ms.custom: devx-track-azdevcli

Azure Developer CLI reference

azd

Options

See also

azd add

Options

rajeshkamal5050 commented Feb 28, 2026 •

edited

Loading

title: Azure Developer CLI reference
description: This article explains the syntax and parameters for the various Azure Developer CLI commands.
author: alexwolfmsft
ms.author: alexwolf
ms.date: 03/04/2026
ms.service: azure-dev-cli
ms.topic: conceptual
ms.custom: devx-track-azdevcli