Setting Up Azure Credentials for Terraform

In this lesson you’ll learn how to authenticate Terraform to Azure using the Azure CLI (az login). This interactive flow is the simplest option for local development and ad-hoc runs. For automation or CI/CD, see the “Additional notes” section below for service principal guidance. Prerequisites

Terraform installed
Azure CLI installed
An Azure subscription

Example Terraform configuration used in this lesson providers.tf

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "4.19.0"
    }
  }
}

provider "azurerm" {
  features {}
}

main.tf

resource "azurerm_resource_group" "example" {
  name     = "example"
  location = "East US"
}

Step-by-step: authenticate Terraform to Azure

Initialize the working directory

Open a terminal in the folder containing your Terraform files and run:

terraform init

This downloads the provider plugins referenced in providers.tf and prepares the working directory.

Try a plan/apply to see the credential error (if not authenticated)

If you run terraform plan or terraform apply before authenticating, the azurerm provider will fail because it cannot locate a subscription context. Example error:

Error: `subscription_id` is a required provider property when performing a plan/apply operation

with provider["registry.terraform.io/hashicorp/azurerm"],
on providers.tf line 10, in provider "azurerm":
10: provider "azurerm" {

This indicates Terraform cannot access Azure credentials for any subscription yet.

Authenticate with the Azure CLI

Authenticate interactively:

az login

This opens your browser and prompts you to sign in. Choose the account tied to the subscription you want to use.

A browser window showing a Microsoft Azure "Pick an account" sign-in dialog with a signed-in account and a "Use another account" option. The window sits over a colorful desktop background with a code editor visible behind it.

After signing in, the CLI will print the subscriptions available for that account. If you have multiple subscriptions, note the subscription ID you want to use. Get or list subscription IDs with:

# show the currently selected subscription ID
az account show --query id -o tsv

# list all subscriptions in a readable table
az account list -o table

Target the subscription for Terraform

Terraform’s Azure provider can use the Azure CLI authentication token, but you must ensure the provider targets the correct subscription. You can either make the subscription active in the Azure CLI or set ARM_SUBSCRIPTION_ID as an environment variable. Set the active subscription in the Azure CLI:

az account set --subscription <subscription-id>

Or set ARM_SUBSCRIPTION_ID directly (examples for common shells/OS):

Platform	Command
macOS / Linux (bash/zsh)	`export ARM_SUBSCRIPTION_ID=4c62e312-4b55-4e4d-8c5f-d40d247a5bb`
Windows Command Prompt (persistent)	`setx ARM_SUBSCRIPTION_ID "4c62e312-4b55-4e4d-8c5f-d40d247a5bb"`
Windows PowerShell (current session)	`$env:ARM_SUBSCRIPTION_ID = "4c62e312-4b55-4e4d-8c5f-d40d247a5bb"`

Note:

If you use setx on Windows, you may need to open a new terminal window for the environment variable to be available. In PowerShell, $env:... sets the variable only for the current session.

Do not commit credentials or secret values (for example, ARM_CLIENT_SECRET) into version control. For automation, prefer using secure variable stores or service principals with least privilege.

Run Terraform apply

With az login complete and the subscription targeted (via az account set or ARM_SUBSCRIPTION_ID), run:

terraform apply

Terraform will authenticate using the Azure CLI token, create or update resources (in this example, a resource group), and write state to the configured backend (local by default). You should see output like “1 to add, 0 to change, 0 to destroy” before confirming the apply.

Additional notes

Azure CLI is required for the az login based workflow. Install it from Microsoft docs: https://learn.microsoft.com/cli/azure/install-azure-cli
For non-interactive automation (CI/CD) or service accounts, create a service principal and set these environment variables instead of using az login:
- ARM_CLIENT_ID
- ARM_CLIENT_SECRET
- ARM_TENANT_ID
- ARM_SUBSCRIPTION_ID
To create a service principal with the Azure CLI, see: https://learn.microsoft.com/cli/azure/create-an-azure-service-principal-azure-cli
Many cloud-based dev environments (Codespaces, Cloud Shell, etc.) include the Azure CLI and can use the same az login flow or managed identities where supported.

Links and References

That’s it — authenticate with az login and ensure ARM_SUBSCRIPTION_ID (or the CLI active subscription) is set so Terraform targets the correct Azure subscription.

Course Introduction

Preparing Your Environment

Terraform Foundations

The Core Terraform Workflow

Terraform CLI

Terraform File Structure and Organization

Terraform Configuration - Fundamentals

Understading and Managing Terraform State

Marking Code Reusable

Refactoring Terraform State

Terraform Modules

Managing Resource Behavior and Dependencies

Securing Terraform Configurations

Terraform Troubleshooting

HCP Terraform

Setting Up Azure Credentials for Terraform

Watch Video