Azure MacBook Setup (Account + CLI + AKS)

Prerequisites (Mac)

Terminal + Homebrew

You will install and manage CLI tools using Homebrew. If you already have Homebrew, skip the install step below.

# Install Homebrew (if not installed)
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Verify brew
brew --version

Azure subscription access

You need an Azure tenant + subscription where you can create resource groups and deploy resources. If you are in a corporate tenant, confirm you have permissions (or request them).

Minimum role (typical): Contributor on the subscription or target resource group
For AKS: often requires additional permissions depending on policy

Corporate tenant note

In many enterprise tenants, policy may block resource creation, require naming rules, or force regions/tags. If deployments fail, check policy errors and confirm required tags and allowed regions.

Create your Microsoft Azure account

Account + Subscription

A) Choose the right identity

Personal learning: use a personal Microsoft account
Work interview / enterprise: use your corporate Microsoft Entra ID account

Your “tenant” is the identity boundary (organization directory). Your “subscription” is the billing + quota boundary.

B) Create/activate subscription

Sign up and complete verification requirements (email/phone)
Enable MFA if prompted (recommended even if not required)
Ensure you have an active subscription visible in the Azure Portal

You can confirm subscription visibility later using az account list.

Minimum “ready” outcome

You can sign in to the Azure Portal and you have at least one subscription where you can create a Resource Group.

Install Azure CLI on macOS

az

Install via Homebrew

brew update
brew install azure-cli

# Verify
az version
az --help

If you previously installed Azure CLI by another method, ensure your PATH points to the desired az.

Basic health checks

# Confirm az is on PATH
which az

# Confirm CLI can start and list commands
az help

If az is “command not found”, restart Terminal or verify Homebrew’s shell initialization.

Authenticate and select the target subscription

az login

Interactive login (typical)

# Opens browser login
az login

If you belong to multiple tenants, Azure CLI may show multiple subscriptions after login.

Pick the correct subscription

# List subscriptions
az account list --output table

# Set the one you want (use subscription id or name)
az account set --subscription "<SUBSCRIPTION_ID_OR_NAME>"

# Confirm active context
az account show --output table

Permission reality check

If you can’t create Resource Groups, your Bicep deploy will fail later. Validate by creating a tiny RG (next step).

AKS tooling (optional but recommended)

kubectl + aks

You only need this section if your Bicep stack will create AKS, or if you plan to interact with AKS after deployment.

Install kubectl

brew install kubectl
kubectl version --client

kubectl is the Kubernetes client used to query clusters, apply manifests, view pods/services, etc.

Ensure the AKS CLI extension exists

# List extensions
az extension list --output table

# Install AKS extension if needed (safe to run; it will install if missing)
az extension add --name aks-preview

# Or install the standard aks extension if preview isn't desired (often built-in, but extension may still apply)
az extension add --name aks

Use aks-preview only if you require preview features. Otherwise prefer stable.

Post-AKS creation

Once AKS exists, you typically fetch kubeconfig like: az aks get-credentials -g <RG> -n <AKS_NAME> and then validate with kubectl get nodes.

Final validation: you can deploy Bicep

Ready to run az deployment

A) Confirm you can create a Resource Group

# Choose a region (example: eastus, westus2, centralus)
az account show --output table

# Create a resource group (smoke test)
az group create -n rg-aks-demo -l eastus

If this fails due to authorization/policy, fix that first (role assignment, allowed regions, required tags).

B) Validate Bicep is usable and run a deployment

# Check Bicep tooling (current CLI often handles it automatically)
az bicep version

# Validate (what-if) before deploying
az deployment group what-if \
  --resource-group rg-aks-demo \
  --template-file main.bicep \
  --parameters @main.parameters.json

# Deploy Bicep to the resource group (creates the "stack" of resources)
az deployment group create \
  --name aks-demo-deploy \
  --resource-group rg-aks-demo \
  --template-file main.bicep \
  --parameters @main.parameters.json

Completion criteria

At this point the engineer has: an Azure subscription selected in CLI, Azure CLI installed and authenticated, optional AKS tooling installed, and can successfully run a group deployment using Bicep.