Switching Azure Accounts

Switching Azure Accounts

Key Takeaways

• Logout clears tokens: az logout removes cached credentials; always do this before switching accounts.
• Tenant vs. subscription: Tenant = organization/directory; subscription = billing container. You need both correct.
• Verify before deploying: Always run az account show to confirm your active context matches your intent.

Working with multiple Azure tenants and subscriptions requires clear commands and careful verification. This guide walks through switching contexts safely—whether you’re toggling between corporate and personal accounts, or managing multi-tenant deployments.

The 6-Step Process

Step 1: Logout to clear cached tokens

az logout

Removes all cached tokens; essential when switching between accounts to avoid stale credentials.

Step 2: Login to your target account

az login
# Or with explicit tenant (recommended for multi-tenant orgs):
az login --tenant "your-tenant-id"

Opens browser auth, or prompts for device code. Using --tenant prevents Azure from guessing your directory.

Step 3: List available subscriptions

az account list --output table

Displays subscription ID, name, and tenant; helps you pick the right subscription.

Step 4: Set your active subscription

az account set --subscription "Your-Subscription-ID-or-Name"

Activates a subscription; use either the subscription ID or friendly name.

Step 5: Configure Azure Developer CLI (if using azd)

azd env set AZURE_SUBSCRIPTION_ID <ID> -e <env-name>
azd env set AZURE_LOCATION eastus -e <env-name>

Syncs your CLI context to azd workflows; azd maintains its own environment file separate from az.

Step 6: Verify your active context

az account show --output table

Confirms you’re logged into the correct tenant and subscription before running any deployment.

Interview Angle

The distinction between tenant (Entra ID directory) and subscription (billing/resource container) trips up engineers who assume “login” is enough. In multi-tenant scenarios, an account can have access to multiple subscriptions across multiple tenants—you must be explicit about both. Also note: az and azd maintain separate caches; switching in CLI doesn’t auto-sync azd environments.

Common Scenarios

Scenario	Command
Quick subscription switch (already logged in)	az account set --subscription "my-prod-sub"
List all my subscriptions	az account list --output table
Check who I am right now	az account show --output table
Switch tenants (multi-org)	az logout && az login --tenant "tenant-id"

Common Gotchas

• Forgot to logout before switching: You’ll stay logged into the old account. Always az logout first, especially across tenant boundaries.
• Azd cache mismatch: If az account show says you’re in the right context but azd deploys to the wrong subscription, you didn’t run azd env set AZURE_SUBSCRIPTION_ID.
• Wrong tenant selected: Double-check az account show after login—Azure may default to the “first” tenant if you have multiple, not necessarily your target.
• Corrupted cache (nuclear option): az cache purge or rm -rf ~/.azd if authentication behaves weirdly after major OS/tool updates.

Pro Tips

• Always verify before deploying. Three seconds of az account show saves hours of troubleshooting wrong-tenant incidents.
• Use subscription names thoughtfully. Name subscriptions descriptively (e.g., prod-internal-billing, client-a-dev) so typos are obvious.
• Document tenant IDs. Save a local reference (plaintext or password manager) for frequently-used tenant IDs—beats hunting through Azure portal every time.