az account show: Inspect the Active Subscription
az account show prints details of the subscription the CLI is currently operating against.
After a federated login you often want to confirm which subscription and tenant the job landed in. account show is the quick sanity check.
What it does
az account show returns the active subscription object: id, name, tenantId, state, and the signed-in user or service principal. It reads the local token cache, so it fails if no login has happened in the job.
Common usage
az account show
# just the subscription id, unquoted
az account show --query id --output tsv
# id and tenant together
az account show --query "{sub:id, tenant:tenantId}" -o jsonSubcommands and flags
| Flag | What it does |
|---|---|
| --query <jmespath> | Filter the output with a JMESPath expression |
| --output, -o | Output format: json, jsonc, tsv, table, yaml |
| --subscription | Show a specific subscription by name or id |
| --only-show-errors | Suppress warnings, useful in pipelines |
In CI
After the azure/login action with OIDC, run az account show to assert the right subscription is active before deploying. Use --query id -o tsv to capture the bare id into a step output without quotes or whitespace.
Common errors in CI
"Please run 'az login' to setup account." means the token cache is empty; the login step did not run or failed. "No subscription found. Run 'az account set'" means you are authenticated but no default subscription is selected; pass --subscription or run az account set first.