How to Restrict Non-Admin Users to Azure CLI Application.
Since the Microsoft Azure CLI application is available to all users of a Microsoft Entra tenant, in this guide you will learn how to restrict its use by non-administrator users.
The Azure CLI is one of the most powerful management tools available in Microsoft Azure. While it simplifies automation and infrastructure management, unrestricted access can expose your environment to unnecessary security risks.
Why Restrict Access to Azure CLI?
By default, any user in a Microsoft Entra tenant can authenticate to Azure CLI unless access is restricted through Microsoft Entra ID or Conditional Access policies.
Although Azure Role-Based Access Control (RBAC) determines what users can do after authentication, it does not prevent them from signing in to Azure CLI. For organizations that follow a need-to-know approach to privilege enforcement, restricting access to the Azure CLI application helps reduce the attack surface and limits interactive access to only authorized users.
Restricting Azure CLI helps:
- Prevent unauthorized scripting and automation through Azure CLI
- Reduce attack surface
- Improve security compliance
- Restrict Azure CLI access to administrators and authorized users
In this tutorial, we'll create a Conditional Access policy that blocks Azure CLI access for all non-admin users while allowing administrators to continue using it.
After applying the policy, when a non-admin user attempts to authenticate through Azure CLI, the sign-in is blocked before the user can obtain an access token. Administrators who are excluded from the policy can continue using Azure CLI normally.
How to Restrict Azure CLI Usage by Non-Admin Users Using a Conditional Access Policy (Microsoft 365).
Prerequisites:
- Microsoft Entra ID Premium P1 or P2
- Microsoft Entra ID admin permissions.
1. Navigate to Microsoft Entra admin center, select Conditional Access on the left side, and then click Create new policy.
Â
2. Type a name for the new policy (e.g., "Restrict Azure CLI Access to Non-Admin Users").
3. Click at Users or agents and do the following:
3a. On the Include tab, select All users.
Â
3b. Then, select the Exclude tab, select Users and groups, and exclude these users:
- Your Microsoft 365 administrator account to avoid locking yourself out
- The Break Glass Administrator
- Any other Microsoft 365 Global Administrator account in your tenant, or any standard user account that you want to allow to use the Azure CLI application.
4a. Now, click Target resources. On the Include tab, select Select resources, and then choose Select specific resources.
4b. In the Resources window, search for "Azure", and then select Azure Resource Manager* from the search results (in newer tenants).**
Notes:
- Azure Resource Manager is the recommended target because it serves as the management layer for Azure resources, authenticating and authorizing each request before forwarding it to the appropriate Azure service (source: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview)
- In older tenants, this resource may appear as Microsoft Azure Management or Windows Azure Service Management API.
5. Then, click Grant and select Block access.
6. Finally, set the Enable policy setting to Report only* to test the policy impact a few days before applying it and click Create.
* Note: It is recommended to leave the policy in Report-only mode for a few days and review its impact before enabling it. This helps identify any unexpected access issues and prevents unintended user lockouts.
7. After verifying that the policy does not negatively affect any user sign-ins, edit the policy and set Enable policy setting to On to enforce it across your tenant.
That's it! Let me know if this guide has helped you by leaving your comment about your experience. Please like and share this guide to help others.
Frequently Asked Questions
What is the purpose of restricting access to the Azure CLI for non-admin users?
Restricting access to the Azure CLI helps prevent unauthorized scripting and automation, reduces the attack surface, improves security compliance, and limits access to only authorized users, thereby enhancing overall security.
What are the prerequisites for implementing the Conditional Access policy to restrict Azure CLI access?
To implement the policy, you need Microsoft Entra ID Premium P1 or P2 and Microsoft Entra ID admin permissions.
How do I enable the Conditional Access policy to restrict Azure CLI access after testing its impact?
First, test the policy in Report-only mode to gauge its effect. After confirming there are no unintended issues, edit the policy and set the Enable policy setting to 'On' to enforce it across your tenant.
Who should be excluded from the policy restricting Azure CLI access?
Exclude your Microsoft 365 administrator account, the Break Glass Administrator, and any other Microsoft 365 Global Administrator account, or any standard user account that you want to allow to use the Azure CLI application.
Still having trouble fixing this issue?
💬 Get WinTips Remote Support →
- How to Restrict Non-Admin Users to Azure CLI Application. - November 11, 2026
- How to Install and Register PnP PowerShell for SharePoint Online. - November 9, 2026
- KB5127648 Fails to Install (0x800f0845) or Causes Windows 11 to Loop in Recovery Mode (0xc000000d): How to Fix - November 4, 2026
