Azure Cloud Shell without terminal trouble

Start with the subscription, company-specific naming, quota and resource-provider preflight, including Microsoft.OperationalInsights and separate Bash check/register blocks. Review what the scripts change and when to redeploy or change region.

1. Open portal.azure.com and switch to the customer tenant.
2. In the black portal bar, select the Cloud Shell terminal icon. Alternatively, open shell.azure.com.
3. Select Bash. The commands on this page are written for Bash.
4. On first use, Azure may ask for a subscription and storage for your Cloud Shell files. Follow the wizard and wait for the prompt ending in $.

Before every script, check which tenant and subscription Azure CLI is using. A subscription visible in the portal is not necessarily the active CLI subscription.

az account show \
  --query "{subscription:name, subscriptionId:id, tenant:tenantId, user:user.name}" \
  -o table

az account list \
  --query "[].{Name:name, Id:id, Tenant:tenantId, Default:isDefault}" \
  -o table

az account set --subscription "<subscription name or subscription ID>"

az account show \
  --query "{subscription:name, tenant:tenantId, user:user.name}" \
  -o table

az ad signed-in-user show --query id -o tsv

This command returns the object ID of the signed-in user. Use it as the initial administrator only if that exact account will perform the initial setup. For another person, copy their object ID from the user profile in the Entra admin center.

Paste the complete block into Bash. It downloads both scripts to the current Cloud Shell directory and makes them executable.

curl -fsSL \
  https://www.smarterbusiness.at/downloads/smarter-visitor-registration/prepare-app-registration.sh \
  -o prepare-app-registration.sh

curl -fsSL \
  https://www.smarterbusiness.at/downloads/smarter-visitor-registration/grant-graph-permissions.sh \
  -o grant-graph-permissions.sh

chmod +x prepare-app-registration.sh grant-graph-permissions.sh
ls -l prepare-app-registration.sh grant-graph-permissions.sh

First choose the final web app name and deployment prefix on the Marketplace Basics step. Then run the preparation script with exactly the same values. You need at least Application Administrator or Cloud Application Administrator in the target tenant.

./prepare-app-registration.sh \
  contoso-visitor-registration \
  visitorreg

When the Marketplace deployment has completed successfully, run the second script. This requires Privileged Role Administrator or Global Administrator.

./grant-graph-permissions.sh \
  "rg-visitor-registration" \
  "visitorreg" \
  "11111111-2222-3333-4444-555555555555"

If you prefer PowerShell in Cloud Shell, switch to PowerShell using the shell selector and download the .ps1 variants. Do not mix Bash and PowerShell syntax in the same input.

Invoke-WebRequest   -Uri "https://www.smarterbusiness.at/downloads/smarter-visitor-registration/prepare-app-registration.ps1"   -OutFile "prepare-app-registration.ps1"

Invoke-WebRequest   -Uri "https://www.smarterbusiness.at/downloads/smarter-visitor-registration/grant-graph-permissions.ps1"   -OutFile "grant-graph-permissions.ps1"

./prepare-app-registration.ps1   -WebAppName "contoso-visitor-registration"   -DeploymentName "visitorreg"

./grant-graph-permissions.ps1   -ResourceGroup "rg-visitor-registration"   -DeploymentName "visitorreg"   -ClientId "11111111-2222-3333-4444-555555555555"

• Never send session secrets, passwords, access tokens or the output of az account get-access-token by email or chat.
• Client IDs and tenant IDs are not passwords. Still redact usernames, subscription IDs and unrelated tenant data in screenshots.
• Generate the session secret, for example with openssl rand -hex 32, and enter it only in the protected Marketplace fields.
• When asking for help, send the command without secrets, the exact error message and the step at which it occurred.