Azure PowerShell

Introduction

Azure PowerShell is a set of PowerShell modules, the Az modules, for managing Azure resources. It reaches the LocalStack Azure emulator through a custom Azure environment that you register with Add-AzEnvironment.

Getting started

Prerequisites

• PowerShell 7.
• The Az.Accounts and Az.Resources modules.
• LocalStack for Azure, with the emulator running. For more information, see Installation.

Install-Module -Name Az.Accounts  -Scope CurrentUser -Force
Install-Module -Name Az.Resources -Scope CurrentUser -Force

Configure the session

Run the following commands first:

Disable-AzContextAutosave -Scope Process
Update-AzConfig -DisableInstanceDiscovery $true -Scope Process

Both settings apply only to the current PowerShell session, so your saved Azure sign-ins and settings stay as they are:

• Disable-AzContextAutosave stops Azure PowerShell from saving the emulator’s sign-in as your default Azure context.
• DisableInstanceDiscovery stops the Az modules from asking Microsoft Entra ID to validate the emulator’s sign-in endpoint, which Microsoft Entra ID doesn’t know. Update-AzConfig prints a warning that the setting also turns off authority validation. That’s expected.

Caution

Without DisableInstanceDiscovery, every cmdlet that requests a token stalls for minutes. Measured against the emulator:

DisableInstanceDiscovery	Connect-AzAccount	New-AzResourceGroup
$false (default)	about 300 seconds	about 100 seconds
$true	under 1 second	about 1 second
:::

Register the environment

Register the emulator’s endpoints as an Azure environment called LocalStack:

Add-AzEnvironment -Name LocalStack `
  -ActiveDirectoryEndpoint "https://azure.localhost.localstack.cloud:4566/" `
  -ResourceManagerEndpoint "https://azure.localhost.localstack.cloud:4566/" `
  -StorageEndpoint "core.azure.localhost.localstack.cloud:4566"

-StorageEndpoint sets the suffix that the storage data-plane cmdlets of the Az.Storage module use, for example when you create a context with New-AzStorageContext. Keep the port in it: without :4566, those requests go to port 443, where the emulator doesn’t listen.

Caution

Don’t use the -ARMEndpoint parameter. Azure PowerShell rejects the emulator with Endpoint provided is invalid. Please check the value and retry again with the correct value. (Parameter 'url').

Sign in

The emulator accepts any service principal:

$sec  = ConvertTo-SecureString "dummy" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("any-app", $sec)

Connect-AzAccount -Environment LocalStack -ServicePrincipal -Credential $cred `
  -Tenant "00000000-0000-0000-0000-000000000000"

Output

WARNING: Unable to acquire token for tenant '' with error 'Tenant id cannot be null. You can locate your tenant id by following the instructions listed here: https://learn.microsoft.com/partner-center/find-ids-and-domain-names (Parameter 'tenantId')'

Subscription name                         Tenant
-----------------                         ------
Emulated Azure Subscription by LocalStack 00000000-0000-0000-0000-000000000000

The warning is harmless: the sign-in succeeds, and the following cmdlets work. For more information about the values that the emulator accepts, see Credentials.

Manage resources

Create a resource group:

New-AzResourceGroup -Name MyResourceGroup -Location westeurope

Output

ResourceGroupName : MyResourceGroup
Location          : westeurope
ProvisioningState : Succeeded
Tags              :
ResourceId        : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup

Show it:

Get-AzResourceGroup -Name MyResourceGroup | Select-Object ResourceGroupName, Location, ProvisioningState

Output

ResourceGroupName Location   ProvisioningState
----------------- --------   -----------------
MyResourceGroup   westeurope Succeeded

Azure PowerShell and the Azure CLI talk to the same emulator, so each tool sees the resources that the other creates. To check with the Azure CLI, run lstk az start-interception, then az group list --output table.

Delete the resource group:

Remove-AzResourceGroup -Name MyResourceGroup -Force

Output

True

Clean up

Sign out and remove the environment:

Disconnect-AzAccount
Remove-AzEnvironment -Name LocalStack

The session settings end when you close PowerShell.

Notes

• If a cmdlet seems to hang, run Get-AzConfig -DisableInstanceDiscovery. A pause of several minutes means that the setting is still False in this session.
• Cmdlets work for the services and operations that the emulator implements. For the list, see Local Azure Services.