Azure · terminal · read-only · experimental

Browse your Azure tenant without leaving the terminal.

Every subscription behind one fuzzy search, console-style detail panes, a network access lens, a change timeline and a security audit. It issues only GETs, and the built-in Reader role is all it needs.

curl -fsSL https://raw.githubusercontent.com/neboto/nebaz/main/install.sh | sh

Needs the Azure CLI, logged in with az login. Or try nebaz --demo: a made-up tenant, no Azure account, no network.

Install Source on GitHub

An outage, from the alert to the rule behind it. Recorded with nebaz --demo; nothing on screen is a real tenant.

nebaz is experimental. Most services were built against Azure's API specs and tested offline, and haven't had in-depth testing against live subscriptions. Expect missing fields and rough edges. The read-only guarantee doesn't depend on any of that.

What you get

20 Azure services, one search. @vm web, @nsg, @aca: an @prefix switches service and fuzzy-matches the rest. About 50 lists, every one subscription-wide.
Console-style detail panes. The overview, the type’s own sections, then Access (the role assignments that apply, principals named through Microsoft Graph), Activity (who did what this week) and Related.
Follow the links. Enter on any ARM id jumps to that resource, across services, resource groups and subscriptions. ⌫ comes back.
Network access lens. N on a VM, NIC, subnet or NSG: the NSG rules that apply, in priority order with the defaults, shadowed rules marked.
“What changed?” W merges the Activity Log, Resource Health and fired alerts for one resource. @changes does it subscription-wide.
@audit. Over 50 security checks: world-open NSG rules, public storage and vaults, open SQL firewalls, expiring app credentials, privileged guests and service principals.
Metrics in place. m charts Azure Monitor metrics in the pane, a curated set per type.
Copy, never run. C picks an az command to copy, with the ids filled in. nebaz runs none of them.

Workflows

Each clip is one question answered against nebaz --demo.

Why can't Power Platform reach the API? @changes shows a new NSG rule, W puts it next to the alert, and N shows it shadowing the default allow for the injected subnet.

Audit. @audit lists what is wrong, worst first. Enter opens the NSG with SSH open to the internet and W shows the vendor's guest account added it.

Who can do what. An app registration with one secret expired and one expiring in six days, and a deploy service principal holding User Access Administrator on the subscription.

Private DNS. A private-link zone with records but no VNet link, so nothing resolves it, and which networks each zone is linked to.

Follow the links. Enter from an application gateway's backend to the container app, its environment and its subnet, then N for what may reach it.

Read-only is the point

nebaz issues only GETs against Azure Resource Manager and Microsoft Graph, and a test fails the build if that ever changes. Keys, connection strings, app settings and secret values are never fetched: Key Vault shows secret names, never values. When you do want to change something, C copies the az command instead.

Why read-only →

On AWS too

nebaz is built on the same core as neboto, the read-only terminal UI for AWS: same keys, same lenses, same guarantee.