Azure: set the right subscription and tenant before you create anything

TL;DR

Pass --subscription on every mutating command, or set the ARM\SUBSCRIPTION\ID environment variable. Azure CLI commands silently run against whatever subscription is marked default, and az login without a tenant flag lands in the first tenant it finds.

Steps

1. Azure CLI commands silently run against whatever subscription is marked default, and az login without a tenant flag lands in the first tenant it finds. Agents trip on this constantly.
2. Check where you are before doing anything that creates or bills:

az account show --output table

3. Look at name, id, and tenantId. If any of them is wrong, fix it:

az account list --output table # see everything you can reach
az account set --subscription "My Subscription" # or pass the subscription id
az login --tenant [tenant-id] # when you have access to several tenants

4. Rules that save loops:
5. - Never trust the default in a script. Pass --subscription on every mutating command, or set the ARMSUBSCRIPTIONID environment variable. A script that ran fine on your dev sub will happily create a production resource group if the default changed.

• Service principals are tenant-scoped. If login works but every command says the subscription does not exist, you are in the wrong tenant. Re-login with --tenant.
• az account show caches. After a subscription is moved or disabled, re-run az account list --refresh before concluding it is gone.
• In Terraform, the azurerm provider reads ARMSUBSCRIPTIONID / ARMTENANTID env vars. Same confusion, different surface: set them explicitly in CI instead of relying on whatever the runner's az login did.
• Billing surprise guard: az account list --query "[?isDefault].{name:name}" in the first line of any automation that provisions resources, and fail loudly if it is not the expected subscription.

6. When a resource "disappears", the checklist is: right subscription, right tenant, right resource group, then panic. The first two explain most of it.

When to use

You are seeing this: Agents trip on this constantly. Use this skill when you run into "Azure: set the right subscription and tenant before you create anything".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Proactive skill. Context rules verified against the Azure CLI authentication docs. Evidence: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli