{"allowContribute":false,"item":{"allowContribute":false,"cardFieldsDef":[{"name":"指令名稱","type":"TEXT"},{"name":"分類","options":["運算","網路","身分","儲存","監控","DevOps","安全性","通用"],"type":"SELECT"},{"name":"類型","options":["Azure CLI","PowerShell","Bash","Bicep","Portal 操作"],"type":"SELECT"},{"name":"指令本文","type":"TEXTAREA"},{"name":"參數說明","type":"TEXTAREA"},{"name":"標籤","type":"TAGS"},{"name":"官方文件連結","type":"URL"},{"name":"驗證狀態","options":["已驗證","未驗證","待確認"],"type":"SELECT"}],"createdAt":1787148400417,"id":"79902acb2d254c578660fd8d","isPublic":true,"itemType":"CARD_FOLDER","name":"指令卡片庫","parents":{"card":1787148400717},"templateCss":".card-template-root{width:360px;max-width:100%;background:var(--card);color:var(--foreground);border-radius:16px;overflow:hidden;box-shadow:0 2px 12px color-mix(in srgb,var(--foreground) 10%,transparent);border:1px solid color-mix(in srgb,var(--foreground) 10%,transparent);display:flex;flex-direction:column;gap:0;font-family:inherit;}\n.card-template-header{display:flex;gap:6px;padding:12px 14px 0;flex-wrap:wrap;align-items:center;}\n.card-template-badge{font-size:11px;font-weight:700;letter-spacing:0.04em;padding:3px 8px;border-radius:999px;border:1px solid transparent;line-height:1;}\n.card-template-badge--category{background:color-mix(in srgb,var(--foreground) 8%,transparent);border-color:color-mix(in srgb,var(--foreground) 12%,transparent);}\n.card-template-badge--type{background:color-mix(in srgb,var(--link) 12%,transparent);color:var(--link);border-color:color-mix(in srgb,var(--link) 20%,transparent);}\n.card-template-badge--status{background:color-mix(in srgb,#22c55e 12%,transparent);color:#16a34a;border-color:color-mix(in srgb,#22c55e 20%,transparent);}\n.card-template-badge--status[data-value=\"未驗證\"]{background:color-mix(in srgb,#f59e0b 14%,transparent);color:#b45309;border-color:color-mix(in srgb,#f59e0b 22%,transparent);}\n.card-template-badge--status[data-value=\"待確認\"]{background:color-mix(in srgb,var(--foreground) 6%,transparent);color:var(--foreground);}\n.card-template-title{padding:10px 14px 8px;font-size:15px;font-weight:800;line-height:1.35;word-wrap:break-word;overflow-wrap:break-word;}\n.card-template-code{margin:0 14px;background:color-mix(in srgb,var(--foreground) 6%,transparent);border:1px solid color-mix(in srgb,var(--foreground) 9%,transparent);border-radius:10px;padding:10px 12px;display:flex;gap:8px;align-items:flex-start;overflow:hidden;}\n.card-template-code .g-icon{font-size:16px;opacity:0.6;flex-shrink:0;margin-top:2px;}\n.card-template-code-text{margin:0;flex:1;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;line-height:1.55;white-space:pre-wrap;word-break:break-all;overflow-wrap:break-word;max-height:120px;overflow:auto;}\n.card-template-params{padding:10px 14px 0;font-size:12.5px;line-height:1.6;opacity:0.78;word-wrap:break-word;overflow-wrap:break-word;overflow:hidden;display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;}\n.card-template-tags{padding:8px 14px 0;display:flex;flex-wrap:wrap;gap:6px;}\n.card-template-tags span{background:color-mix(in srgb,var(--foreground) 7%,transparent);border:1px solid color-mix(in srgb,var(--foreground) 10%,transparent);border-radius:999px;padding:2px 8px;font-size:11px;line-height:1.4;}\n.card-template-link{margin:10px 14px 14px;display:inline-flex;align-items:center;gap:4px;font-size:12.5px;font-weight:600;color:var(--link);text-decoration:none;word-break:break-all;}\n.card-template-link .g-icon{font-size:14px;}","templateHtml":"\u003cdiv class=\"card-template-root\"\u003e\u003cdiv class=\"card-template-header\"\u003e\u003cspan class=\"card-template-badge card-template-badge--category\" data-value=\"{{分類}}\"\u003e{{分類}}\u003c/span\u003e\u003cspan class=\"card-template-badge card-template-badge--type\" data-value=\"{{類型}}\"\u003e{{類型}}\u003c/span\u003e\u003cspan class=\"card-template-badge card-template-badge--status\" data-value=\"{{驗證狀態}}\"\u003e{{驗證狀態}}\u003c/span\u003e\u003c/div\u003e\u003cdiv class=\"card-template-title\"\u003e{{指令名稱}}\u003c/div\u003e\u003cdiv class=\"card-template-code\"\u003e\u003cspan class=\"g-icon\"\u003eterminal\u003c/span\u003e\u003cpre class=\"card-template-code-text\"\u003e{{指令本文}}\u003c/pre\u003e\u003c/div\u003e\u003cdiv class=\"card-template-params\"\u003e{{參數說明}}\u003c/div\u003e\u003cdiv class=\"card-template-tags\"\u003e{{標籤}}\u003c/div\u003e\u003ca class=\"card-template-link\" href=\"{{官方文件連結}}\"\u003e\u003cspan class=\"g-icon\"\u003eopen_in_new\u003c/span\u003e 官方文件\u003c/a\u003e\u003c/div\u003e","updatedAt":1787152273965,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},"ownerName":"Norman","subtree":[{"allowContribute":false,"cardFieldsDef":[{"name":"指令名稱","type":"TEXT"},{"name":"分類","options":["運算","網路","身分","儲存","監控","DevOps","安全性","通用"],"type":"SELECT"},{"name":"類型","options":["Azure CLI","PowerShell","Bash","Bicep","Portal 操作"],"type":"SELECT"},{"name":"指令本文","type":"TEXTAREA"},{"name":"參數說明","type":"TEXTAREA"},{"name":"標籤","type":"TAGS"},{"name":"官方文件連結","type":"URL"},{"name":"驗證狀態","options":["已驗證","未驗證","待確認"],"type":"SELECT"}],"createdAt":1787148400417,"id":"79902acb2d254c578660fd8d","isPublic":true,"itemType":"CARD_FOLDER","name":"指令卡片庫","parents":{"card":1787148400717},"templateCss":".card-template-root{width:360px;max-width:100%;background:var(--card);color:var(--foreground);border-radius:16px;overflow:hidden;box-shadow:0 2px 12px color-mix(in srgb,var(--foreground) 10%,transparent);border:1px solid color-mix(in srgb,var(--foreground) 10%,transparent);display:flex;flex-direction:column;gap:0;font-family:inherit;}\n.card-template-header{display:flex;gap:6px;padding:12px 14px 0;flex-wrap:wrap;align-items:center;}\n.card-template-badge{font-size:11px;font-weight:700;letter-spacing:0.04em;padding:3px 8px;border-radius:999px;border:1px solid transparent;line-height:1;}\n.card-template-badge--category{background:color-mix(in srgb,var(--foreground) 8%,transparent);border-color:color-mix(in srgb,var(--foreground) 12%,transparent);}\n.card-template-badge--type{background:color-mix(in srgb,var(--link) 12%,transparent);color:var(--link);border-color:color-mix(in srgb,var(--link) 20%,transparent);}\n.card-template-badge--status{background:color-mix(in srgb,#22c55e 12%,transparent);color:#16a34a;border-color:color-mix(in srgb,#22c55e 20%,transparent);}\n.card-template-badge--status[data-value=\"未驗證\"]{background:color-mix(in srgb,#f59e0b 14%,transparent);color:#b45309;border-color:color-mix(in srgb,#f59e0b 22%,transparent);}\n.card-template-badge--status[data-value=\"待確認\"]{background:color-mix(in srgb,var(--foreground) 6%,transparent);color:var(--foreground);}\n.card-template-title{padding:10px 14px 8px;font-size:15px;font-weight:800;line-height:1.35;word-wrap:break-word;overflow-wrap:break-word;}\n.card-template-code{margin:0 14px;background:color-mix(in srgb,var(--foreground) 6%,transparent);border:1px solid color-mix(in srgb,var(--foreground) 9%,transparent);border-radius:10px;padding:10px 12px;display:flex;gap:8px;align-items:flex-start;overflow:hidden;}\n.card-template-code .g-icon{font-size:16px;opacity:0.6;flex-shrink:0;margin-top:2px;}\n.card-template-code-text{margin:0;flex:1;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;line-height:1.55;white-space:pre-wrap;word-break:break-all;overflow-wrap:break-word;max-height:120px;overflow:auto;}\n.card-template-params{padding:10px 14px 0;font-size:12.5px;line-height:1.6;opacity:0.78;word-wrap:break-word;overflow-wrap:break-word;overflow:hidden;display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;}\n.card-template-tags{padding:8px 14px 0;display:flex;flex-wrap:wrap;gap:6px;}\n.card-template-tags span{background:color-mix(in srgb,var(--foreground) 7%,transparent);border:1px solid color-mix(in srgb,var(--foreground) 10%,transparent);border-radius:999px;padding:2px 8px;font-size:11px;line-height:1.4;}\n.card-template-link{margin:10px 14px 14px;display:inline-flex;align-items:center;gap:4px;font-size:12.5px;font-weight:600;color:var(--link);text-decoration:none;word-break:break-all;}\n.card-template-link .g-icon{font-size:14px;}","templateHtml":"\u003cdiv class=\"card-template-root\"\u003e\u003cdiv class=\"card-template-header\"\u003e\u003cspan class=\"card-template-badge card-template-badge--category\" data-value=\"{{分類}}\"\u003e{{分類}}\u003c/span\u003e\u003cspan class=\"card-template-badge card-template-badge--type\" data-value=\"{{類型}}\"\u003e{{類型}}\u003c/span\u003e\u003cspan class=\"card-template-badge card-template-badge--status\" data-value=\"{{驗證狀態}}\"\u003e{{驗證狀態}}\u003c/span\u003e\u003c/div\u003e\u003cdiv class=\"card-template-title\"\u003e{{指令名稱}}\u003c/div\u003e\u003cdiv class=\"card-template-code\"\u003e\u003cspan class=\"g-icon\"\u003eterminal\u003c/span\u003e\u003cpre class=\"card-template-code-text\"\u003e{{指令本文}}\u003c/pre\u003e\u003c/div\u003e\u003cdiv class=\"card-template-params\"\u003e{{參數說明}}\u003c/div\u003e\u003cdiv class=\"card-template-tags\"\u003e{{標籤}}\u003c/div\u003e\u003ca class=\"card-template-link\" href=\"{{官方文件連結}}\"\u003e\u003cspan class=\"g-icon\"\u003eopen_in_new\u003c/span\u003e 官方文件\u003c/a\u003e\u003c/div\u003e","updatedAt":1787152273965,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"運算","參數說明":"--namespace {{namespace}}：資源提供者命名空間，本卡為 Microsoft.Compute。\n--name {{featureName}}：預覽功能名稱，本卡為 EncryptionAtHost（VM 主機層加密，大小寫敏感）。\naz feature show --query \"properties.state\"：查詢註冊狀態，可能為 Registering（註冊中）/ Registered（已完成）/ Pending，需等 Registered 才可下一步。\naz provider register --namespace {{namespace}}：重新註冊提供者，讓功能在訂用帳戶生效；即使 feature 已 Registered 仍需此步，否則主機加密選項不會出現。\naz provider show --query \"registrationState\"：確認是否為 Registered。\n\n可用佔位 {{featureName}} / {{namespace}} 在指令中樞一鍵替換後複製；本卡預設範例為 EncryptionAtHost + Microsoft.Compute。\n提示：feature 註冊為訂用帳戶層級，生效需等待且部分功能需提支援票；啟用後建立 VM 時方可選 --enable-host-encryption / 磁碟主機加密，且 VM 大小需支援此功能。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/feature#az-feature-register","指令名稱":"啟用主機加密預覽功能 (EncryptionAtHost / Microsoft.Compute)","指令本文":"# 1. 註冊預覽功能（主機加密 EncryptionAtHost）\naz feature register --namespace Microsoft.Compute --name EncryptionAtHost\n\n# 參數化範本（替換 {{featureName}} / {{namespace}} 即可複用其他 Compute 預覽功能）\naz feature register --namespace {{namespace}} --name {{featureName}}\n\n# 2. 查詢註冊狀態（Registered / Registering / Pending，需等 Registered）\naz feature show --namespace Microsoft.Compute --name EncryptionAtHost --query \"properties.state\"\naz feature show --namespace {{namespace}} --name {{featureName}} --query \"properties.state\" -o table\n\n# 輪詢直到 Registered（約 5-15 分，Registering 屬正常）\nwatch -n 30 'az feature show --namespace Microsoft.Compute --name EncryptionAtHost --query \"properties.state\" -o tsv'\n\n# 3. 重新註冊資源提供者（使功能在訂用帳戶生效，feature 變 Registered 後執行）\naz provider register --namespace Microsoft.Compute\naz provider register --namespace {{namespace}}\n\n# 驗證提供者狀態（Registered 即就緒）\naz provider show --namespace Microsoft.Compute --query \"registrationState\" -o tsv\naz provider show --namespace {{namespace}} --query \"registrationState\" -o table\n\n# 完整流程（三步依序執行，缺一不可）\naz feature register --namespace Microsoft.Compute --name EncryptionAtHost\naz feature show --namespace Microsoft.Compute --name EncryptionAtHost --query \"properties.state\"\naz provider register --namespace Microsoft.Compute","標籤":["EncryptionAtHost","主機加密","Microsoft.Compute","az feature","az provider","預覽功能","Azure CLI"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787155937850,"deletedAt":null,"id":"928b4560163cedc2fe2a3611","isNew":false,"isPublic":false,"itemType":"CARD","name":"啟用主機加密預覽功能 EncryptionAtHost","parents":{"79902acb2d254c578660fd8d":1787155937850},"preParentID":null,"updatedAt":1787155937850,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"身分","參數說明":"--tenant {{tenantId}}：指定要登入的 Azure AD 租戶 ID 或網域名稱，未指定則登入預設租戶。\n--use-device-code：裝置碼流程，適用於無法開啟瀏覽器的環境。\n可用佔位 {{tenantId}} 在指令中樞一鍵替換後複製。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/authenticate-azure-cli","指令名稱":"az login","指令本文":"az login\n# 指定租戶\naz login --tenant {{tenantId}}\n# 裝置碼登入（無瀏覽器/遠端環境）\naz login --use-device-code","標籤":["身分驗證","Azure CLI","登入"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787150765175,"deletedAt":null,"id":"ffaccae458546b91851c10fc","isNew":false,"isPublic":false,"itemType":"CARD","name":"az login","parents":{"79902acb2d254c578660fd8d":1787150765175},"preParentID":null,"updatedAt":1787150765175,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"網路","參數說明":"--name {{vnetName}}：虛擬網路名稱，需在資源群組內唯一。\n--resource-group {{resourceGroup}}：目標資源群組名稱。\n--location {{location}}：Azure 區域，例如 japaneast / eastus / southeastasia。\n--address-prefixes {{addressPrefix}}：VNet 位址空間，CIDR 格式，例如 10.0.0.0/16，可多段空白分隔。\n--subnet-name {{subnetName}}：初始子網路名稱（選用，未指定則自動建 default）。\n--subnet-prefixes {{subnetPrefix}}：子網路位址範圍，需落在 VNet 位址空間內，例如 10.0.1.0/24。\n\n可用佔位 {{vnetName}} / {{resourceGroup}} / {{location}} / {{addressPrefix}} / {{subnetName}} / {{subnetPrefix}} 在指令中樞一鍵替換後複製。\n提示：若 VNet 已存在同指令會報錯，先用 az network vnet show 確認；位址空間重疊會導致對等互連 / VPN 失敗，規劃前先確認網段。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/network/vnet#az-network-vnet-create","指令名稱":"建立虛擬網路 (az network vnet create)","指令本文":"# 建立虛擬網路（最簡）\naz network vnet create --name {{vnetName}} --resource-group {{resourceGroup}} --location {{location}} --address-prefixes {{addressPrefix}}\n\n# 含子網路一次建好（推薦）\naz network vnet create \\\n  --name {{vnetName}} \\\n  --resource-group {{resourceGroup}} \\\n  --location {{location}} \\\n  --address-prefixes {{addressPrefix}} \\\n  --subnet-name {{subnetName}} \\\n  --subnet-prefixes {{subnetPrefix}}\n\n# 範例（對應原指令）\naz network vnet create --name 'vnet-department-website-dev-jpe-01' --resource-group {{resourceGroup}} --location 'japaneast' --address-prefixes '10.0.0.0/16'\n\n# 驗證\naz network vnet show --name {{vnetName}} --resource-group {{resourceGroup}} --output table\naz network vnet list --resource-group {{resourceGroup}} --output table","標籤":["虛擬網路","VNet","網路","Azure CLI","az network"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787150461133,"deletedAt":null,"id":"6a85c07db4b33fea6f8e76a5","isPublic":false,"itemType":"CARD","name":"建立虛擬網路","parents":{"79902acb2d254c578660fd8d":1787150764175},"preParentID":null,"updatedAt":1787152634664,"updatedBy":{"agentId":"ceo","agentName":"CEO","userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":3},{"cardFields":{"分類":"安全性","參數說明":"--resource-group {{resourceGroup}}：資源群組。\n--vnet-name {{vnetName}}：已存在的 VNet，需包含 AzureFirewallSubnet。\n--name AzureFirewallSubnet：防火牆專用子網路名稱「不可改」，位址至少 {{firewallSubnetPrefix}} 例如 10.0.1.0/26，不能與其他服務共用。\n--public-ip {{publicIpName}} / az network public-ip create：防火牆對外 Public IP，需 Standard SKU；2_create 內會自動建立，可先手動建好再綁。\n--sku {{sku}}：AZFW_VNet（VNet 模式）或 AZFW_Hub（Virtual WAN Hub 模式）。\n--tier {{tier}}：Basic / Standard / Premium，對應功能與吞吐量差異。\n--zones 1 2 3：可用性區域，跨區域高可用。\n--virtual-hub {{virtualHubName}} + --public-ip-count：僅 Hub 模式需要。\n\n可用佔位 {{resourceGroup}} / {{vnetName}} / {{firewallSubnetPrefix}} / {{publicIpName}} / {{location}} / {{firewallName}} / {{tier}} / {{virtualHubName}} 在指令中樞一鍵替換後複製。\n前置檢查：VNet 位址空間不可與地端重疊；若 az network firewall create 卡住超過 10 分鐘屬正常（部署約 5-10 分），可加 --no-wait 背景執行再用 az network firewall show 查詢 provisioningState。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/network/firewall#az-network-firewall-create","指令名稱":"建立 Azure 防火牆 (az network firewall create)","指令本文":"# 1. 準備專用子網路（名稱必須為 AzureFirewallSubnet，至少 /26）\naz network vnet subnet create \\\n  --resource-group {{resourceGroup}} \\\n  --vnet-name {{vnetName}} \\\n  --name AzureFirewallSubnet \\\n  --address-prefixes {{firewallSubnetPrefix}}\n\n# 2. 建立 Public IP（Standard SKU，區域備援）\naz network public-ip create \\\n  --name {{publicIpName}} \\\n  --resource-group {{resourceGroup}} \\\n  --location {{location}} \\\n  --sku Standard --allocation-method Static --zone 1 2 3\n\n# 3a. 建立防火牆 - VNet 模式（最常用）\naz network firewall create \\\n  --name {{firewallName}} \\\n  --resource-group {{resourceGroup}} \\\n  --location {{location}} \\\n  --sku AZFW_VNet --tier {{tier}}\n\n# 3b. 明確指定 VNet（舊版參數，仍可用）\naz network firewall create \\\n  --name {{firewallName}} \\\n  --resource-group {{resourceGroup}} \\\n  --vnet-name {{vnetName}} \\\n  --sku AZFW_VNet --tier Standard\n\n# 3c. 可用性區域部署（高可用，推薦 1 2 3）\naz network firewall create \\\n  --name {{firewallName}} \\\n  --resource-group {{resourceGroup}} \\\n  --zones 1 2 3 \\\n  --sku AZFW_VNet --tier Premium \\\n  --vnet-name {{vnetName}}\n\n# 3d. Virtual WAN / Secure Hub 模式\naz network firewall create \\\n  --name {{firewallName}} \\\n  --resource-group {{resourceGroup}} \\\n  --sku AZFW_Hub --tier Standard \\\n  --virtual-hub {{virtualHubName}} --public-ip-count 1\n\n# 驗證\naz network firewall show --name {{firewallName}} --resource-group {{resourceGroup}} --output table\naz network firewall list --resource-group {{resourceGroup}} --output table","標籤":["Azure 防火牆","Firewall","安全性","網路","Azure CLI","az network"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787153246577,"deletedAt":null,"id":"4cb2064ff56d89910432541d","isNew":false,"isPublic":false,"itemType":"CARD","name":"建立 Azure 防火牆","parents":{"79902acb2d254c578660fd8d":1787153246577},"preParentID":null,"updatedAt":1787153246577,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"身分","參數說明":"--display-name \"{{groupName}}\"：群組顯示名稱，必填，建議用部門-用途-環境命名，如 sec-firewall-admins-dev。\n--mail-nickname \"{{mailNickname}}\"：郵件別名，必填，僅限英數、點、連字號、底線，不可含空格，例如 {{mailNickname}}。\n--description \"{{description}}\"：選用，說明群組用途。\n--group-types \"Unified\"：選用，加上即為 Microsoft 365 群組，不加即為安全性群組。\n\n可用佔位 {{groupName}} / {{mailNickname}} / {{description}} 在指令中樞一鍵替換後複製。\n提示：建立後用 az ad group member add --group {{groupName}} --member-id {{userObjectId}} 加入成員；Entra ID 群組名稱可重複，建議用 az ad group show --group \u003cobjectId\u003e 以 ID 精確操作。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/ad/group#az-ad-group-create","指令名稱":"新增 Entra ID 群組 (az ad group create)","指令本文":"# 建立安全性群組（最簡）\naz ad group create --display-name \"{{groupName}}\" --mail-nickname \"{{mailNickname}}\"\n\n# 含描述\naz ad group create --display-name \"{{groupName}}\" --mail-nickname \"{{mailNickname}}\" --description \"{{description}}\"\n\n# Microsoft 365 群組（加上 --group-types）\naz ad group create --display-name \"{{groupName}}\" --mail-nickname \"{{mailNickname}}\" --group-types \"Unified\"\n\n# 驗證\naz ad group show --group \"{{groupName}}\" --output table\naz ad group list --display-name \"{{groupName}}\" --output table\naz ad group member list --group \"{{groupName}}\" --output table","標籤":["Entra ID","Azure AD","群組","az ad","身分驗證"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787153636913,"deletedAt":null,"id":"369be400891b99c7e6391eae","isNew":false,"isPublic":false,"itemType":"CARD","name":"新增 Entra ID 群組","parents":{"79902acb2d254c578660fd8d":1787153637013},"preParentID":null,"updatedAt":1787153636913,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"身分","參數說明":"--display-name \"{{displayName}}\"：顯示名稱，例如 {{displayName}}。\n--user-principal-name \"{{upn}}\"：登入帳號，格式 user@{{domain}}，{{domain}} 需為租戶已驗證網域。\n--password \"{{password}}\"：初始密碼，需符合租戶密碼原則，建議用亂數 + 立即啟用 MFA。\n--force-change-password-next-sign-in：true（預設）會要求首次登入強制改密碼，設 false 則不強制。\n--member-id {{userObjectId}}：使用者的 Object ID（az ad user show --id {{upn}} --query id -o tsv 取得）。\n\n可用佔位 {{displayName}} / {{upn}} / {{password}} / {{groupName}} / {{userObjectId}} / {{domain}} 在指令中樞一鍵替換後複製。\n提醒：大量建帳請改用 Entra ID 邀請或 SCIM 同步；建立後立即指派群組與條件式存取原則，避免帳號裸奔。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/ad/user#az-ad-user-create","指令名稱":"新增 Entra ID 使用者 (az ad user create)","指令本文":"# 建立使用者（最簡，首次登入需變更密碼）\naz ad user create \\\n  --display-name \"{{displayName}}\" \\\n  --user-principal-name \"{{upn}}\" \\\n  --password \"{{password}}\"\n\n# 自訂是否強制首次變更密碼\naz ad user create \\\n  --display-name \"{{displayName}}\" \\\n  --user-principal-name \"{{upn}}\" \\\n  --password \"{{password}}\" \\\n  --force-change-password-next-sign-in false\n\n# 驗證\naz ad user show --id \"{{upn}}\" --output table\naz ad user list --display-name \"{{displayName}}\" --output table\n\n# 加入群組（接續上一張卡）\naz ad group member add --group \"{{groupName}}\" --member-id \"{{userObjectId}}\"","標籤":["Entra ID","Azure AD","使用者","az ad","身分驗證"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787153636913,"deletedAt":null,"id":"4a9bd96d710b7a0e6f36585f","isNew":false,"isPublic":false,"itemType":"CARD","name":"新增 Entra ID 使用者","parents":{"79902acb2d254c578660fd8d":1787153637113},"preParentID":null,"updatedAt":1787153636913,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"儲存","參數說明":"--name {{storageAccountName}}：全域唯一，僅 3-24 字元小寫英數，不可含連字號大寫，建立後不可改名。\n--resource-group {{resourceGroup}} / --location {{location}}：資源群組與區域。\n--sku {{sku}}：Standard_LRS（本地備援，最便宜）/ Standard_GRS（異地備援，推薦生產）/ Standard_RAGRS / Premium_LRS 等。\n--kind：StorageV2（通用 v2，支援 Blob/File/Queue/Table）/ BlobStorage / FileStorage 等。\n--access-tier Hot / Cool：僅 Blob 儲存相關，Hot 存取頻繁、Cool 適合封存。\n--https-only true + --min-tls-version TLS1_2：強制 HTTPS 與最低 TLS 版本。\n--allow-blob-public-access false：關閉 Blob 公開存取，符合安全基準。\n\n可用佔位 {{storageAccountName}} / {{resourceGroup}} / {{location}} / {{sku}} 在指令中樞一鍵替換後複製。\n提示：名稱先用 az storage account check-name --name {{storageAccountName}} 檢查可用性；建立後用 az storage container create --account-name {{storageAccountName}} --name {{containerName}} 建容器。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/storage/account#az-storage-account-create","指令名稱":"建立 Azure Storage Account (az storage account create)","指令本文":"# 建立 Storage Account（通用 v2，推薦最簡）\naz storage account create \\\n  --name {{storageAccountName}} \\\n  --resource-group {{resourceGroup}} \\\n  --location {{location}} \\\n  --sku {{sku}} \\\n  --kind StorageV2\n\n# 含存取層 + 安全強化（生產環境推薦）\naz storage account create \\\n  --name {{storageAccountName}} \\\n  --resource-group {{resourceGroup}} \\\n  --location {{location}} \\\n  --sku Standard_GRS \\\n  --kind StorageV2 \\\n  --access-tier Hot \\\n  --https-only true \\\n  --min-tls-version TLS1_2 \\\n  --allow-blob-public-access false\n\n# 驗證\naz storage account show --name {{storageAccountName}} --resource-group {{resourceGroup}} --output table\naz storage account list --resource-group {{resourceGroup}} --output table\n\n# 取得連線金鑰（後續上傳檔案用）\naz storage account keys list --account-name {{storageAccountName}} --resource-group {{resourceGroup}} --output table","標籤":["Storage Account","儲存體","儲存","az storage","Azure CLI"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787153636913,"deletedAt":null,"id":"7a2b293a037c53aa714a29b6","isNew":false,"isPublic":false,"itemType":"CARD","name":"建立 Azure Storage Account","parents":{"79902acb2d254c578660fd8d":1787153638113},"preParentID":null,"updatedAt":1787153798467,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":4},{"cardFields":{"分類":"安全性","參數說明":"Get-AzFirewall -Name {{firewallName}} -ResourceGroupName {{resourceGroup}}：取得防火牆物件，後續 Deallocate / Allocate 都操作此物件。\n$azfw.Deallocate() + Set-AzFirewall -AzureFirewall $azfw：官方停止方式，釋放防火牆運算資源、停止計費，但 VNet / AzureFirewallSubnet / Public IP 與規則設定保留。\n$azfw.Allocate($vnet, $pip) + Set-AzFirewall：官方啟動方式，必須重新帶回 VNet 與 Public IP。\nGet-AzVirtualNetwork -Name {{vnetName}}：防火牆所屬的 Hub VNet，需與防火牆同資源群組（或指定正確 RG）。\nGet-AzPublicIpAddress -Name {{publicIpName}}：防火牆對外 Public IP，需為 Standard SKU，與 VNet 同區域。\n\n可用佔位 {{firewallName}} / {{resourceGroup}} / {{vnetName}} / {{publicIpName}} 在指令中樞一鍵替換後複製。\n重點：Deallocate 期間經過防火牆的流量會中斷，請先改 UDR 繞行或於維護窗執行；Azure CLI 沒有 stop/start，az network firewall delete 是刪除重建（設定需重建），非等價於 Deallocate。","官方文件連結":"https://learn.microsoft.com/powershell/module/az.network/get-azfirewall","指令名稱":"Azure 防火牆開關 (Deallocate / Allocate — PowerShell 正式做法)","指令本文":"# Azure Firewall 沒有 az ... stop 這種指令，正式做法是 Deallocate（釋放）/ Allocate（重新配置），主要靠 PowerShell\n\n# ---------- 停止（Deallocate）— 官方支援方式，保留設定僅停止計費 ----------\n$azfw = Get-AzFirewall -Name \"{{firewallName}}\" -ResourceGroupName \"{{resourceGroup}}\"\n$azfw.Deallocate()\nSet-AzFirewall -AzureFirewall $azfw\n\n# 驗證是否已釋放（ProvisioningState = Succeeded 且無有效 IP 配置）\nGet-AzFirewall -Name \"{{firewallName}}\" -ResourceGroupName \"{{resourceGroup}}\" | Format-List Name, ProvisioningState, IpConfigurations\n\n# ---------- 重新啟動（Allocate）— 必須把 VNet 與 Public IP 再帶回去 ----------\n$rg   = \"{{resourceGroup}}\"\n$azfw = Get-AzFirewall -Name \"{{firewallName}}\" -ResourceGroupName $rg\n$vnet = Get-AzVirtualNetwork -Name \"{{vnetName}}\" -ResourceGroupName $rg\n$pip  = Get-AzPublicIpAddress -Name \"{{publicIpName}}\" -ResourceGroupName $rg\n$azfw.Allocate($vnet, $pip)\nSet-AzFirewall -AzureFirewall $azfw\n\n# 驗證已重新啟動\nGet-AzFirewall -Name \"{{firewallName}}\" -ResourceGroupName \"{{resourceGroup}}\" | Format-Table Name, ProvisioningState, ThreatIntelMode\n\n# ---------- 備用：Azure CLI 刪除（破壞性，計費停止但設定遺失） ----------\n# 若不需保留設定、或 PowerShell 不可用，才用此法；刪除後需用 az network firewall create 重建\n# az network firewall delete --name {{firewallName}} --resource-group {{resourceGroup}} --yes\n# az network firewall delete --name {{firewallName}} --resource-group {{resourceGroup}} --yes --no-wait\n# az network firewall show --name {{firewallName}} --resource-group {{resourceGroup}}","標籤":["Azure 防火牆","Firewall","Deallocate","Allocate","PowerShell","開關","AZFW"],"類型":"PowerShell","驗證狀態":"已驗證"},"createdAt":1787153636913,"deletedAt":null,"id":"b9201f77b9fa5db0c1c40d52","isNew":false,"isPublic":false,"itemType":"CARD","name":"Azure 防火牆開關","parents":{"79902acb2d254c578660fd8d":1787153636913},"preParentID":null,"updatedAt":1787154562107,"updatedBy":{"agentId":"ceo","agentName":"CEO","userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":3},{"cardFields":{"分類":"身分","參數說明":"--assignee \"{{assignee}}\"：被授權對象，可為 UPN（user@domain）、Object ID 或服務主體 ID。建議生產環境改用 --assignee-object-id \"{{objectId}}\" 更穩定。\n--assignee-object-id \"{{objectId}}\" + --assignee-principal-type \"{{principalType}}\"：{{principalType}} 填 User / Group / ServicePrincipal，搭配 az ad user/group show 取得的 id 使用，避免名稱歧義。\n--role \"{{roleName}}\"：角色名稱或 ID，常用：Reader / Contributor / Owner / \"Storage Blob Data Contributor\" / \"Key Vault Administrator\"。可用 az role definition list --query \"[].{name:roleName, id:id}\" -o table 查詢。\n--scope \"/subscriptions/{{subscriptionId}}\"：授權範圍，必填。訂用層級 /subscriptions/{{subscriptionId}}、資源群組 /subscriptions/{{subscriptionId}}/resourceGroups/{{resourceGroup}}、或單一資源完整 ID。範圍越小越符合最小權限。\n--ids \"{{assignmentId}}\"：角色指派的完整資源 ID（az role assignment list 取得），delete 時最精確，不受名稱重複影響。\n\n可用佔位 {{assignee}} / {{objectId}} / {{principalType}} / {{roleName}} / {{subscriptionId}} / {{resourceGroup}} / {{storageAccountName}} / {{assignmentId}} 在指令中樞一鍵替換後複製。\n提示：指派後約 5-30 秒生效，若立即驗證失敗請重試；刪除前務必用 list 預覽，避免誤刪 Owner 導致失聯。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/role/assignment#az-role-assignment-create","指令名稱":"az role assignment create / delete（RBAC 角色指派與移除）","指令本文":"# ========== 建立指派 (create) ==========\n# 訂用帳戶層級（最常用）\naz role assignment create --assignee \"{{assignee}}\" --role \"{{roleName}}\" --scope \"/subscriptions/{{subscriptionId}}\"\n\n# 資源群組層級\naz role assignment create --assignee \"{{assignee}}\" --role \"{{roleName}}\" --scope \"/subscriptions/{{subscriptionId}}/resourceGroups/{{resourceGroup}}\"\n\n# 單一資源層級（例：Storage Account）\naz role assignment create --assignee \"{{assignee}}\" --role \"{{roleName}}\" --scope \"/subscriptions/{{subscriptionId}}/resourceGroups/{{resourceGroup}}/providers/Microsoft.Storage/storageAccounts/{{storageAccountName}}\"\n\n# 用 Object ID + 明確主體類型（群組 / 服務主體 / 使用者）\naz role assignment create --assignee-object-id \"{{objectId}}\" --assignee-principal-type \"{{principalType}}\" --role \"{{roleName}}\" --scope \"/subscriptions/{{subscriptionId}}\"\n\n# ========== 驗證 ==========\naz role assignment list --assignee \"{{assignee}}\" --scope \"/subscriptions/{{subscriptionId}}\" --output table\naz role assignment list --assignee \"{{assignee}}\" --all --output table\naz role assignment list --scope \"/subscriptions/{{subscriptionId}}/resourceGroups/{{resourceGroup}}\" --output table\n\n# ========== 刪除指派 (delete) ==========\n# 精確刪除（推薦：assignee + role + scope 三件套）\naz role assignment delete --assignee \"{{assignee}}\" --role \"{{roleName}}\" --scope \"/subscriptions/{{subscriptionId}}\"\n\n# 用指派 ID 刪除（最精確，適合腳本，先用 list 取得 id）\naz role assignment delete --ids \"{{assignmentId}}\"\n\n# 用 Object ID 刪除\naz role assignment delete --assignee \"{{objectId}}\" --role \"{{roleName}}\" --scope \"/subscriptions/{{subscriptionId}}/resourceGroups/{{resourceGroup}}\"\n\n# 刪除前先預覽將刪除的項目\naz role assignment list --assignee \"{{assignee}}\" --scope \"/subscriptions/{{subscriptionId}}\" --query \"[].{id:id, role:roleDefinitionName, principal:principalName, scope:scope}\" -o table","標籤":["RBAC","角色指派","az role","身分驗證","Azure CLI","權限"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787154027090,"deletedAt":null,"id":"80e4fc6a4806e65b42f8a2a8","isNew":false,"isPublic":false,"itemType":"CARD","name":"az role assignment create / delete","parents":{"79902acb2d254c578660fd8d":1787154027090},"preParentID":null,"updatedAt":1787154027090,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"通用","參數說明":"--name {{featureName}}：預覽功能名稱，例 EnableApplicationGatewayNetworkIsolation，需與 --namespace 配對，大小寫敏感。\n--namespace {{namespace}}：資源提供者命名空間，例 Microsoft.Network / Microsoft.Compute / Microsoft.ContainerService。\naz feature show：查詢註冊狀態，properties.state 可能為 Registering（註冊中）/ Registered（已完成）/ Pending 等，需等 Registered 才可下一步。\naz provider register --namespace {{namespace}}：重新註冊提供者，讓功能在訂用帳戶生效；feature 已 Registered 後仍需此步，否則新能力不會出現。\naz provider show --namespace {{namespace}}：確認 registrationState 為 Registered。\n\n可用佔位 {{featureName}} / {{namespace}} 在指令中樞一鍵替換後複製；本卡以 EnableApplicationGatewayNetworkIsolation + Microsoft.Network 為預設範例。\n提示：feature 註冊為訂用帳戶層級，生效需等待且不可取消（部分功能需提支援票）；若 show 長時間卡在 Registering 屬正常，持續輪詢即可，完成後再執行 provider register。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/feature#az-feature-register","指令名稱":"註冊預覽功能與資源提供者 (az feature / az provider register)","指令本文":"# 1. 註冊預覽功能（以 Application Gateway 網路隔離為例）\naz feature register --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network\n\n# 參數化範本（替換 {{featureName}} / {{namespace}} 即可複用其他預覽功能）\naz feature register --name {{featureName}} --namespace {{namespace}}\n\n# 2. 查詢註冊狀態（Registered / Registering / Pending）\naz feature show --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network\naz feature show --name {{featureName}} --namespace {{namespace}} --query \"properties.state\" -o table\n\n# 進階：輪詢直到 Registered（約 5-15 分，多數需等待）\nwatch -n 30 'az feature show --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network --query \"properties.state\" -o tsv'\n\n# 3. 重新註冊資源提供者（使新功能在訂用帳戶生效，feature 變 Registered 後執行）\naz provider register --namespace Microsoft.Network\naz provider register --namespace {{namespace}}\n\n# 驗證提供者狀態（Registered 即就緒）\naz provider show --namespace Microsoft.Network --query \"registrationState\" -o tsv\naz provider show --namespace {{namespace}} --query \"registrationState\" -o table\n\n# 完整流程（依序執行，三步缺一不可）\naz feature register --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network\naz feature show --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network\naz provider register --namespace Microsoft.Network","標籤":["az feature","az provider","預覽功能","Application Gateway","Network Isolation","Azure CLI"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787155867117,"deletedAt":null,"id":"8481921af8ed4d30827e0dfc","isNew":false,"isPublic":false,"itemType":"CARD","name":"註冊預覽功能與資源提供者","parents":{"79902acb2d254c578660fd8d":1787155867117},"preParentID":null,"updatedAt":1787155867117,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":2},{"cardFields":{"分類":"身分","參數說明":"--subscription {{subscriptionId}}：目標訂用帳戶的 ID（GUID）或訂用名稱，必填。建議用 ID，最穩定不會因更名失效。\n--subscription \"{{subscriptionName}}\"：也可用顯示名稱，有空格時需加引號。\naz account show：顯示當前預設訂用，確認 isDefault=true 是否為目標。\naz account list --output table：列出本帳號有權存取的全部訂用，對照 ID / 名稱 / 狀態。\n可用佔位 {{subscriptionId}} / {{subscriptionName}} / {{tenantId}} 在指令中樞一鍵替換後複製。\n常見錯誤：InvalidSubscription 表示 ID 打錯或帳號無權限，先用 az account list 確認；跨租戶請先 az login --tenant {{tenantId}} 再 set。","官方文件連結":"https://learn.microsoft.com/zh-tw/cli/azure/account#az-account-set","指令名稱":"az account set --subscription（切換訂用帳戶）","指令本文":"# 切換預設訂用帳戶（ID 或名稱皆可）\naz account set --subscription {{subscriptionId}}\n\n# 用名稱切換（有空格時加引號）\naz account set --subscription \"{{subscriptionName}}\"\n\n# 驗證是否切換成功\naz account show --output table\n\n# 列出所有可存取的訂用帳戶\naz account list --output table","標籤":["Azure CLI","訂用帳戶","subscription","az account","身分驗證"],"類型":"Azure CLI","驗證狀態":"已驗證"},"createdAt":1787151945279,"deletedAt":null,"id":"6faad29254d0cb31edaf0c40","isNew":false,"isPublic":false,"itemType":"CARD","name":"az account set --subscription","parents":{"79902acb2d254c578660fd8d":1787151945279},"preParentID":null,"updatedAt":1787240986594,"updatedBy":{"userId":"6a3fd27c01e9e9f30ab01d","userName":"Norman"},"version":4}]}