A practical Azure workstation needs a terminal, Git, an editor, Azure CLI, and optional PowerShell and Terraform. Bicep is available through Azure CLI. Install tools from official publishers, keep them updated, and authenticate interactively or with workload identity—never by writing a personal password into a script.
Time: 30–60 minutes · Cost: none · Prerequisite: an active Azure subscription for login verification.
Use the official installation pages because package commands and supported operating systems change:
Recommended VS Code extensions: Bicep by Microsoft, Azure Resources by Microsoft, Terraform by HashiCorp, and the language extensions for your application. Install only extensions you trust.
PowerShell:
If az bicep version cannot find Bicep, run az bicep install from an official Azure CLI installation. In locked-down environments, use the approved package process instead of downloading executables yourself.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
If a terminal cannot open a browser, use the device-code option only on a trusted device and follow the displayed official Microsoft URL:
Prefer workload identity federation in GitHub Actions and Azure DevOps, or managed identity for workloads running in Azure. Avoid long-lived client secrets. A service principal is an application identity; it should receive only the roles and scopes it needs.
Local learning scripts may use your interactive identity. Production CI must not depend on a developer completing MFA at deployment time.
Create a .gitignore before adding generated files. Do not commit .env, Terraform state, plan files that contain sensitive values, local Azure token caches, certificates, private keys, or exported deployment outputs containing secrets.
Use strict shell behavior in Bash scripts:
Use -WhatIf where supported in PowerShell, Bicep what-if, and Terraform plan before change. Require an explicit subscription value in production scripts instead of relying on whichever subscription was selected yesterday.
No cloud resource is required, so there is nothing to clean up. Delete the local test directory only if you no longer want it.