diff --git a/SCEPman/Private/app-service.ps1 b/SCEPman/Private/app-service.ps1
index ef6da56..37681f6 100644
--- a/SCEPman/Private/app-service.ps1
+++ b/SCEPman/Private/app-service.ps1
@@ -143,7 +143,7 @@ function CreateSCEPmanAppService ( $SCEPmanResourceGroup, $SCEPmanAppServiceName
 }
 
 function GetAppServicePlan ( $AppServicePlanName, $ResourceGroup, $SubscriptionId) {
-  $asp = ExecuteAzCommandRobustly -azCommand "az appservice plan list -g $ResourceGroup --query `"[?name=='$AppServicePlanName']`" --subscription $SubscriptionId" | Convert-LinesToObject
+  $asp = Invoke-Az @("appservice", "plan", "list", "-g", $ResourceGroup, "--query", "[?name=='$AppServicePlanName']", "--subscription", $SubscriptionId) | Convert-LinesToObject
   return $asp
 }
 
@@ -166,11 +166,11 @@ function IsAppServicePlanLinux ($AppServicePlanId) {
 }
 
 function GetAppServiceHostNames ($SCEPmanResourceGroup, $AppServiceName, $DeploymentSlotName = $null) {
-  if ($null -eq $DeploymentSlotName) {
-    return ExecuteAzCommandRobustly -azCommand "az webapp config hostname list --webapp-name $AppServiceName --resource-group $SCEPmanResourceGroup --query `"[].name`" --output tsv"
-  } else {
-    return ExecuteAzCommandRobustly -azCommand "az webapp config hostname list --webapp-name $AppServiceName --resource-group $SCEPmanResourceGroup --slot $DeploymentSlotName --query `"[].name`" --output tsv"
+  $command = @("webapp", "config", "hostname", "list", "--webapp-name", $AppServiceName, "--resource-group", $SCEPmanResourceGroup, "--query", "[].name", "--output", "tsv")
+  if ($null -ne $DeploymentSlotName) {
+    $command += @("--slot", $DeploymentSlotName)
   }
+  return Invoke-Az -azCommand $command
 }
 
 function GetPrimaryAppServiceHostName ($SCEPmanResourceGroup, $AppServiceName, $DeploymentSlotName = $null) {
@@ -183,7 +183,7 @@ function GetPrimaryAppServiceHostName ($SCEPmanResourceGroup, $AppServiceName, $
 }
 
 function GetAppServiceVnetId ($AppServiceName, $ResourceGroup) {
-  $vnetId = ExecuteAzCommandRobustly -callAzNatively -azCommand @("webapp", "show", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", 'virtualNetworkSubnetId', "--output", "tsv")
+  $vnetId = Invoke-Az @("webapp", "show", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", 'virtualNetworkSubnetId', "--output", "tsv")
   return $vnetId
 }
 
@@ -192,7 +192,7 @@ function SetAppServiceVnetId ($AppServiceName, $ResourceGroup, $vnetId, $Deploym
   if ($null -ne $DeploymentSlotName) {
     $command += @("--slot", $DeploymentSlotName)
   }
-  $null = ExecuteAzCommandRobustly -callAzNatively -azCommand $command
+  $null = Invoke-Az -azCommand $command
 }
 
 function CreateSCEPmanDeploymentSlot ($SCEPmanResourceGroup, $SCEPmanAppServiceName, $DeploymentSlotName) {
@@ -204,15 +204,14 @@ function CreateSCEPmanDeploymentSlot ($SCEPmanResourceGroup, $SCEPmanAppServiceN
     Write-Information "Specified Production Slot Activation as such via AppConfig:AuthConfig:ManagedIdentityEnabledForWebsiteHostname"
   }
 
-  $azOutput = az webapp deployment slot create --name $SCEPmanAppServiceName --resource-group $SCEPmanResourceGroup --slot $DeploymentSlotName --configuration-source $SCEPmanAppServiceName
-  $null = CheckAzOutput -azOutput $azOutput -fThrowOnError $true
+  $null = Invoke-Az @("webapp", "deployment", "slot", "create", "--name", $SCEPmanAppServiceName, "--resource-group", $SCEPmanResourceGroup, "--slot", $DeploymentSlotName, "--configuration-source", $SCEPmanAppServiceName)
   Write-Information "Created SCEPman Deployment Slot $DeploymentSlotName"
 
-  return Convert-LinesToObject -lines $(az webapp identity assign --name $SCEPmanAppServiceName --resource-group $SCEPmanResourceGroup --slot $DeploymentSlotName --identities [system])
+  return Convert-LinesToObject -lines $(Invoke-Az @("webapp", "identity", "assign", "--name", $SCEPmanAppServiceName, "--resource-group", $SCEPmanResourceGroup, "--slot", $DeploymentSlotName, "--identities", "[system]"))
 }
 
 function GetDeploymentSlots($appServiceName, $resourceGroup) {
-  $deploymentSlots = ExecuteAzCommandRobustly -azCommand "az webapp deployment slot list --name $appServiceName --resource-group $resourceGroup --query '[].name'" | Convert-LinesToObject
+  $deploymentSlots = Invoke-Az @("webapp", "deployment", "slot", "list", "--name", $appServiceName, "--resource-group", $resourceGroup, "--query", "[].name") | Convert-LinesToObject
   if ($null -eq $deploymentSlots) {
     return @()
   } else {
@@ -276,7 +275,7 @@ function ConfigureSCEPmanInstance ($SCEPmanResourceGroup, $SCEPmanAppServiceName
     if ($null -ne $DeploymentSlotName) {
       $azCommand += @("--slot", $DeploymentSlotName)
     }
-    $null = ExecuteAzCommandRobustly -callAzNatively -azCommand $azCommand
+    $null = Invoke-Az -azCommand $azCommand
     Write-Verbose "[$SCEPmanAppServiceName-$DeploymentSlotName] Backed up ApplicationKey"
   }
 
@@ -318,7 +317,7 @@ function ConfigureCertMasterAppService($CertMasterResourceGroup, $CertMasterAppS
   $isCertMasterLinux = IsAppServiceLinux -AppServiceName $CertMasterAppServiceName -ResourceGroup $CertMasterResourceGroup
   $CertmasterAppSettingsJson = AppSettingsHashTable2AzJson -psHashTable $CertmasterAppSettings -convertForLinux $isCertMasterLinux
 
-  $null = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings set --name $CertMasterAppServiceName --resource-group $CertMasterResourceGroup --settings '$CertmasterAppSettingsJson'"
+  $null = Invoke-Az @("webapp", "config", "appsettings", "set", "--name", $CertMasterAppServiceName, "--resource-group", $CertMasterResourceGroup, "--settings", $CertmasterAppSettingsJson)
 }
 
 function Update-ToConfiguredChannel {
@@ -342,8 +341,8 @@ function Update-ToConfiguredChannel {
     } else {
       Write-Verbose "Artifacts URL is $ArtifactsUrl"
       if ($PSCmdlet.ShouldProcess($AppServiceName, ("Switching App Service to channel {0}" -f $intendedChannel))) {
-        $null = ExecuteAzCommandRobustly -azCommand @("webapp", "config", "appsettings", "set", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--settings", "WEBSITE_RUN_FROM_PACKAGE=$ArtifactsUrl") -callAzNatively
-        $null = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings delete --name $AppServiceName --resource-group $ResourceGroup --setting-names ""Update_Channel"""
+        $null = Invoke-Az -azCommand @("webapp", "config", "appsettings", "set", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--settings", "WEBSITE_RUN_FROM_PACKAGE=$ArtifactsUrl")
+        $null = Invoke-Az @("webapp", "config", "appsettings", "delete", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--setting-names", "Update_Channel")
       }
     }
   }
@@ -387,7 +386,7 @@ function SetAppSettings($AppServiceName, $ResourceGroup, $Settings, $Slot = $nul
       $command += @('--slot', $Slot)
     }
 
-    $null = ExecuteAzCommandRobustly -callAzNatively -azCommand $command
+    $null = Invoke-Az -azCommand $command
     $processedSettingsCount++
     Write-Progress -Activity "Setting app settings" -Status "Processed $processedSettingsCount of $totalSettingsCount settings" -PercentComplete (($processedSettingsCount / $totalSettingsCount) * 100)
   }
@@ -397,8 +396,8 @@ function SetAppSettings($AppServiceName, $ResourceGroup, $Settings, $Slot = $nul
 }
 
 function ReadAppSettings($AppServiceName, $ResourceGroup) {
-  $slotSettings = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings list --name $AppServiceName --resource-group $ResourceGroup --query `"[?slotSetting]`"" | Convert-LinesToObject
-  $unboundSettings = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings list --name $AppServiceName --resource-group $ResourceGroup --query `"[?!slotSetting]`"" | Convert-LinesToObject
+  $slotSettings = Invoke-Az @("webapp", "config", "appsettings", "list", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", "[?slotSetting]") | Convert-LinesToObject
+  $unboundSettings = Invoke-Az @("webapp", "config", "appsettings", "list", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", "[?!slotSetting]") | Convert-LinesToObject
 
   Write-Information "Read $($slotSettings.Count) slot settings and $($unboundSettings.Count) other settings from app $AppServiceName"
 
diff --git a/SCEPman/Private/appregistrations.ps1 b/SCEPman/Private/appregistrations.ps1
index e55f8bd..5a8489c 100644
--- a/SCEPman/Private/appregistrations.ps1
+++ b/SCEPman/Private/appregistrations.ps1
@@ -1,5 +1,5 @@
 function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $homepage = $null, $EnableIdToken = $false, $createIfNotExists = $true) {
-  $azureAdAppReg = Convert-LinesToObject -lines $(az ad app list --filter "displayname eq '$name'" --query "[0]" --only-show-errors)
+  $azureAdAppReg = Convert-LinesToObject -lines $(Invoke-Az @("ad", "app", "list", "--filter", "displayname eq '$name'", "--query", "[0]", "--only-show-errors"))
 
   if($null -eq $azureAdAppReg) {
     if ($createIfNotExists) {
@@ -28,7 +28,7 @@ function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $hom
         }
       }
 
-      $azureAdAppReg = Convert-LinesToObject -lines $(ExecuteAzCommandRobustly -callAzNatively -azCommand $azAppRegistrationCommand)
+      $azureAdAppReg = Convert-LinesToObject -lines $(Invoke-Az -azCommand $azAppRegistrationCommand)
       Write-Verbose "Created app registration $name (App ID $($azureAdAppReg.appId))"
 
         # Check whether the AppRoles were added correctly
@@ -60,7 +60,7 @@ function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $hom
     if ($anything2Update) {
       Write-Information "Adding new roles to app registration $name"
       $appRolesJson = HashTable2AzJson -psHashTable $updatedAppRoles
-      ExecuteAzCommandRobustly -callAzNatively -azCommand @("ad", "app", "update", "--id", $azureAdAppReg.appId, "--app-roles", $appRolesJson)
+      Invoke-Az -azCommand @("ad", "app", "update", "--id", $azureAdAppReg.appId, "--app-roles", $appRolesJson)
 
         # Reload app registration with new roles
       $azureAdAppReg = Invoke-Az -azCommand $('ad', 'app', 'show', '--id', $azureAdAppReg.id) | Convert-LinesToObject
@@ -80,7 +80,7 @@ function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $hom
           # ExecuteAzCommandRobustly -callAzNatively -azCommand @("ad", "app", "update", "--id", $azureAdAppReg.appId, "--web-home-page-url", $homepage, "--web-redirect-uris", $allReplyUrls)
         }
         $azCommandToAddReplyUrls += $existingReplyUrls + $replyUrlsToAdd
-        ExecuteAzCommandRobustly -callAzNatively -azCommand $azCommandToAddReplyUrls
+        Invoke-Az -azCommand $azCommandToAddReplyUrls
       }
     }
     $azureAdAppReg.web.redirectUris
@@ -97,7 +97,7 @@ function CreateSCEPmanAppRegistration ($AzureADAppNameForSCEPman, $CertMasterSer
   $servicePrincipalScepmanId = CreateServicePrincipal -appId $($appregsc.appId)
 
   # Expose SCEPman API
-  ExecuteAzCommandRobustly -azCommand "az ad app update --id $($appregsc.appId) --identifier-uris `"api://$($appregsc.appId)`""
+  Invoke-Az -azCommand @("ad", "app", "update", "--id", $appregsc.appId, "--identifier-uris", "api://$($appregsc.appId)")
 
   Write-Information "Allowing CertMaster to submit CSR requests to SCEPman API"
   $ScepManSubmitCSRPermission = $appregsc.appRoles.Where({ $_.value -eq "CSR.Request"}, "First")
@@ -124,7 +124,7 @@ function CreateCertMasterAppRegistration ($AzureADAppNameForCertMaster, $CertMas
   $null = CreateServicePrincipal -appId $($appregcm.appId)
 
   # Expose CertMaster API
-  ExecuteAzCommandRobustly -azCommand "az ad app update --id $($appregcm.appId) --identifier-uris `"api://$($appregcm.appId)`""
+  Invoke-Az -azCommand @("ad", "app", "update", "--id", $appregcm.appId, "--identifier-uris", "api://$($appregcm.appId)")
 
   Write-Verbose "Adding Delegated permission to CertMaster App Registration"
   # Add Microsoft Graph's User.Read as delegated permission for CertMaster
@@ -145,7 +145,7 @@ function Add-AzAsTrustedClientApplication {
   param(
     [Parameter(Mandatory=$true)]$AppId
   )
-  $AppJson = ExecuteAzCommandRobustly -callAzNatively -azCommand @('ad', 'app', 'show', '--id', $AppId)
+  $AppJson = Invoke-Az -azCommand @('ad', 'app', 'show', '--id', $AppId)
   $AppObject = Convert-LinesToObject -Lines $AppJson
 
   $existingAzAuthorization = $AppObject.api.preAuthorizedApplications | Where-Object { $_.appId -eq $AzAppId }
@@ -160,7 +160,7 @@ function Add-AzAsTrustedClientApplication {
     $preAuthorizationsBody = "{'api':{'preAuthorizedApplications':$($preAuthorizationsInner.Replace("delegatedPermissionIds", "permissionIds").Replace('"', "'"))}}"
 
     if ($PSCmdlet.ShouldProcess("Application with id $($AppObject.id)", "Add az (App Id: $AzAppId) as authorized application")) {
-      $null = ExecuteAzCommandRobustly -callAzNatively -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $preAuthorizationsBody, '--headers', 'Content-Type=application/json')
+      $null = Invoke-Az -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $preAuthorizationsBody, '--headers', 'Content-Type=application/json')
     }
 
     return $true
@@ -188,6 +188,6 @@ function Remove-AzAsTrustedClientApplication {
   $previousPreAuthorizationsBody = "{'api':{'preAuthorizedApplications':$($previousPreAuthorizationsInner.Replace("delegatedPermissionIds", "permissionIds").Replace('"', "'"))}}"
 
   if ($PSCmdlet.ShouldProcess("Application with id $($AppObject.id)", "Remove az (App Id: $AzAppId) as authorized application")) {
-    $null = ExecuteAzCommandRobustly -callAzNatively -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $previousPreAuthorizationsBody, '--headers', 'Content-Type=application/json')
+    $null = Invoke-Az -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $previousPreAuthorizationsBody, '--headers', 'Content-Type=application/json')
   }
 }
\ No newline at end of file
diff --git a/SCEPman/Private/key-vault.ps1 b/SCEPman/Private/key-vault.ps1
index 6239a98..b238a00 100644
--- a/SCEPman/Private/key-vault.ps1
+++ b/SCEPman/Private/key-vault.ps1
@@ -12,9 +12,9 @@ function AddSCEPmanPermissionsToKeyVault ($KeyVault, $PrincipalId) {
     $null = Invoke-Az @("role", "assignment", "create", "--role", "Key Vault Secrets User", "--assignee-object-id", $PrincipalId, "--assignee-principal-type", "ServicePrincipal", "--scope", $KeyVault.id)
   } else {
     Write-Information "Setting policy permissions for Key Vault"
-    $null = ExecuteAzCommandRobustly -azCommand "az keyvault set-policy --name $($KeyVault.Name) --object-id $PrincipalId --subscription $($KeyVault.SubscriptionId) --key-permissions get create unwrapKey sign"
-    $null = ExecuteAzCommandRobustly -azCommand "az keyvault set-policy --name $($KeyVault.Name) --object-id $PrincipalId --subscription $($KeyVault.SubscriptionId) --secret-permissions get list"
-    $null = ExecuteAzCommandRobustly -azCommand "az keyvault set-policy --name $($KeyVault.Name) --object-id $PrincipalId --subscription $($KeyVault.SubscriptionId) --certificate-permissions get list create managecontacts"
+    $null = Invoke-Az @("keyvault", "set-policy", "--name", $KeyVault.Name, "--object-id", $PrincipalId, "--subscription", $KeyVault.SubscriptionId, "--key-permissions", "get", "create", "unwrapKey", "sign")
+    $null = Invoke-Az @("keyvault", "set-policy", "--name", $KeyVault.Name, "--object-id", $PrincipalId, "--subscription", $KeyVault.SubscriptionId, "--secret-permissions", "get", "list")
+    $null = Invoke-Az @("keyvault", "set-policy", "--name", $KeyVault.Name, "--object-id", $PrincipalId, "--subscription", $KeyVault.SubscriptionId, "--certificate-permissions", "get", "list", "create", "managecontacts")
   }
 }
 
@@ -67,8 +67,8 @@ function New-IntermediateCaCsr {
     #az keyvault certificate create --policy @C:\temp\certs\keyvault\rsa-policy.json --vault-name $vaultName --name $certificateName
 
       # The direct graph call instead works
-    $creationResponseLines = ExecuteAzCommandRobustly -azCommand @("rest", "--method", "post", "--uri", "$($vaultUrl)certificates/$certificateName/create?api-version=7.0",
-    "--headers", "Content-Type=application/json", "--resource", $vaultDomain, "--body", $caPolicyJson) -callAzNatively
+    $creationResponseLines = Invoke-Az -azCommand @("rest", "--method", "post", "--uri", "$($vaultUrl)certificates/$certificateName/create?api-version=7.0",
+    "--headers", "Content-Type=application/json", "--resource", $vaultDomain, "--body", $caPolicyJson)
     $creationResponse = Convert-LinesToObject -lines $creationResponseLines
 
     Write-Information "Created a CSR with Request ID $($creationResponse.request_id)"
diff --git a/SCEPman/Private/log-analytics.ps1 b/SCEPman/Private/log-analytics.ps1
index 4b2e7b9..798985a 100644
--- a/SCEPman/Private/log-analytics.ps1
+++ b/SCEPman/Private/log-analytics.ps1
@@ -390,12 +390,12 @@ function AddLogIngestionAPISettings($ResourceGroup, $AppServiceName, $DcrDetails
 function AddAppRoleAssignmentsForLogIngestionAPI($ResourceGroup, $AppServiceName, $DcrDetails, $SkipAppRoleAssignments = $false) {
     $servicePrincipal = GetServicePrincipal -appServiceNameParam $AppServiceName -resourceGroupParam $ResourceGroup
     if($null -ne $servicePrincipal.principalId) {
-        $azCommandToAssignRole = "az role assignment create --role 'Monitoring Metrics Publisher' --assignee-object-id $($servicePrincipal.principalId) --assignee-principal-type ServicePrincipal --scope $($DcrDetails.id)"
+        $azCommandToAssignRole = @("role", "assignment", "create", "--role", "Monitoring Metrics Publisher", "--assignee-object-id", $servicePrincipal.principalId, "--assignee-principal-type", "ServicePrincipal", "--scope", $DcrDetails.id)
         if($SkipAppRoleAssignments) {
-            Write-Warning "Skipping app role assignment (please execute manually): $azCommandToAssignRole"
+            Write-Warning "Skipping app role assignment (please execute manually): az $($azCommandToAssignRole -join ' ')"
             return
         }
-        $null = ExecuteAzCommandRobustly -azCommand $azCommandToAssignRole
+        $null = Invoke-Az -azCommand $azCommandToAssignRole
         Write-Information "Role 'Monitoring Metrics Publisher' assigned to the App Service $AppServiceName service principal"
     } else {
         Write-Information "$AppServiceName does not have a System-assigned Managed Identity turned on"
diff --git a/SCEPman/Private/permissions.ps1 b/SCEPman/Private/permissions.ps1
index a087451..0b5b1a6 100644
--- a/SCEPman/Private/permissions.ps1
+++ b/SCEPman/Private/permissions.ps1
@@ -1,9 +1,9 @@
 function GetServicePrincipal($appServiceNameParam, $resourceGroupParam, $slotNameParam = $null) {
-    $identityShowParams = "";
+    $command = @("webapp", "identity", "show", "--name", $appServiceNameParam, "--resource-group", $resourceGroupParam)
     if($null -ne $slotNameParam) {
-        $identityShowParams = "--slot '$slotNameParam'"
+        $command += @("--slot", $slotNameParam)
     }
-    return ExecuteAzCommandRobustly -azCommand "az webapp identity show --name $appServiceNameParam --resource-group $resourceGroupParam $identityShowParams" | Convert-LinesToObject
+    return Invoke-Az -azCommand $command | Convert-LinesToObject
 }
 
 function GetUserAssignedPrincipalIdsFromServicePrincipal($servicePrincipal) {
@@ -23,7 +23,7 @@ function GetAzureResourceAppId($appId) {
         $queryParam = '[0].id'
     }
 
-    return $(az ad sp list --filter "appId eq '$appId'" --query $queryParam --out tsv --only-show-errors)
+    return $(Invoke-Az @("ad", "sp", "list", "--filter", "appId eq '$appId'", "--query", $queryParam, "--out", "tsv", "--only-show-errors"))
 }
 
 function SetManagedIdentityPermissions($principalId, $resourcePermissions, $GraphBaseUri, $SkipAppRoleAssignments = $false) {
@@ -31,7 +31,7 @@ function SetManagedIdentityPermissions($principalId, $resourcePermissions, $Grap
     $permissionLevelReached = -1
 
     $graphEndpointForAppRoleAssignments = "$GraphBaseUri/v1.0/servicePrincipals/$principalId/appRoleAssignments"
-    $alreadyAssignedPermissions = ExecuteAzCommandRobustly -azCommand "az rest --method get --uri '$graphEndpointForAppRoleAssignments' --headers 'Content-Type=application/json' --query 'value[].appRoleId' --output tsv"
+    $alreadyAssignedPermissions = Invoke-Az @("rest", "--method", "get", "--uri", $graphEndpointForAppRoleAssignments, "--headers", "Content-Type=application/json", "--query", "value[].appRoleId", "--output", "tsv")
 
     ForEach($resourcePermission in $resourcePermissions) {
         if($alreadyAssignedPermissions -contains $resourcePermission.appRoleId) {
@@ -42,15 +42,15 @@ function SetManagedIdentityPermissions($principalId, $resourcePermissions, $Grap
         } else {
             Write-Verbose "Assigning new permission (ResourceID $($resourcePermission.resourceId), AppRoleId $($resourcePermission.appRoleId))"
             $bodyToAddPermission = "{'principalId': '$principalId','resourceId': '$($resourcePermission.resourceId)','appRoleId':'$($resourcePermission.appRoleId)'}"
-            $azCommand = "az rest --method post --uri '$graphEndpointForAppRoleAssignments' --body `"$bodyToAddPermission`" --headers 'Content-Type=application/json'"
+            $azCommand = @("rest", "--method", "post", "--uri", $graphEndpointForAppRoleAssignments, "--body", $bodyToAddPermission, "--headers", "Content-Type=application/json")
             if ($SkipAppRoleAssignments) {
-                Write-Warning "Skipping app role assignment (please execute manually): $azCommand"
+                Write-Warning "Skipping app role assignment (please execute manually): az $($azCommand -join ' ')"
                 if ($resourcePermission.permissionLevel -lt $permissionLevelFail) {
                     $permissionLevelFail = $resourcePermission.permissionLevel
                 }
             } else {
                 try {
-                    $null = ExecuteAzCommandRobustly -azCommand $azCommand -principalId $principalId -appRoleId $resourcePermission.appRoleId -GraphBaseUri $GraphBaseUri
+                    $null = ExecuteAzCommandRobustly -callAzNatively -azCommand $azCommand -principalId $principalId -appRoleId $resourcePermission.appRoleId -GraphBaseUri $GraphBaseUri
                     if ($resourcePermission.permissionLevel -gt $permissionLevelReached) {
                         $permissionLevelReached = $resourcePermission.permissionLevel
                     }
@@ -112,22 +112,22 @@ function GetCertMasterResourcePermissions() {
 }
 
 function GetAzureADApp($name) {
-    return Convert-LinesToObject -lines $(az ad app list --filter "displayname eq '$name'" --query "[0]")
+    return Convert-LinesToObject -lines $(Invoke-Az @("ad", "app", "list", "--filter", "displayname eq '$name'", "--query", "[0]"))
 }
 
 function CreateServicePrincipal($appId, [bool]$hideApp) {
-    $azOutput = az ad sp list --filter "appId eq '$appId'" --query "[0]" --only-show-errors
+    $azOutput = Invoke-Az @("ad", "sp", "list", "--filter", "appId eq '$appId'", "--query", "[0]", "--only-show-errors")
     $sp = Convert-LinesToObject -lines $(CheckAzOutput -azOutput $azOutput -fThrowOnError $true)
     if($null -eq $sp) {
         #App Registration SP doesn't exist.
-        $sp = Convert-LinesToObject -lines $(ExecuteAzCommandRobustly -azCommand "az ad sp create --id $appId")
+        $sp = Convert-LinesToObject -lines $(Invoke-Az @("ad", "sp", "create", "--id", $appId))
         if ($hideApp) {
-            $null = ExecuteAzCommandRobustly -azCommand "az ad sp update --id $appId --add tags HideApp"
+            $null = Invoke-Az @("ad", "sp", "update", "--id", $appId, "--add", "tags", "HideApp")
         }
     }
     if ($sp.appRoleAssignmentRequired -eq $false) {
         Write-Verbose "Updating appRoleAssignmentRequired to true for application $appId"
-        $null = ExecuteAzCommandRobustly -azCommand "az ad sp update --id $appId --set appRoleAssignmentRequired=true"
+        $null = Invoke-Az @("ad", "sp", "update", "--id", $appId, "--set", "appRoleAssignmentRequired=true")
     }
 
     if (AzUsesAADGraph) {
@@ -140,7 +140,7 @@ function CreateServicePrincipal($appId, [bool]$hideApp) {
 function AddDelegatedPermissionToCertMasterApp($appId, $SkipAutoGrant) {
     $certMasterPermissions = Convert-LinesToObject -lines $(Invoke-Az @("ad", "app", "permission", "list", "--id", $appId, "--query", "[0]"))
     if($null -eq ($certMasterPermissions.resourceAccess | Where-Object { $_.id -eq $MSGraphUserReadPermission })) {
-        $null = ExecuteAzCommandRobustly -azCommand "az ad app permission add --id $appId --api $MSGraphAppId --api-permissions `"$MSGraphUserReadPermission=Scope`" --only-show-errors"
+        $null = Invoke-Az @("ad", "app", "permission", "add", "--id", $appId, "--api", $MSGraphAppId, "--api-permissions", "$MSGraphUserReadPermission=Scope", "--only-show-errors")
     }
     $certMasterPermissionsGrantsString = Convert-LinesToObject -lines $(Invoke-Az @("ad", "app", "permission", "list-grants", "--id", $appId, "--query", "[0].scope"))
     if ($null -eq $certMasterPermissionsGrantsString) {
@@ -155,19 +155,19 @@ function AddDelegatedPermissionToCertMasterApp($appId, $SkipAutoGrant) {
         }
     }
     if($true -eq $requiresPermissionGrant) {
-        $azGrantPermissionCommand = "az ad app permission grant --id $appId --api $MSGraphAppId --scope `"User.Read`""
+        $azGrantPermissionCommand = @("ad", "app", "permission", "grant", "--id", $appId, "--api", $MSGraphAppId, "--scope", "User.Read")
         if (AzUsesAADGraph) {
-            $azGrantPermissionCommand += ' --expires "never"'
+            $azGrantPermissionCommand += @('--expires', 'never')
         }
         if ($SkipAutoGrant) {
-            Write-Warning "Please execute the following command manually to grant CertMaster the delegated permission User.Read: $azGrantPermissionCommand"
+            Write-Warning "Please execute the following command manually to grant CertMaster the delegated permission User.Read: az $($azGrantPermissionCommand -join ' ')"
         } else {
-            $null = ExecuteAzCommandRobustly -azCommand $azGrantPermissionCommand
+            $null = Invoke-Az -azCommand $azGrantPermissionCommand
         }
     }
 }
 
 function Get-AccessTokenForApp($scope) {
     Write-Warning "Acquiring token for scope $scope. This can expose unencrypted token information in memory or verbose logs. Please use with caution."
-    return ExecuteAzCommandRobustly -callAzNatively -azCommand $('account', 'get-access-token', '--scope', $scope, '--query', 'accessToken', '--output', 'tsv') | ConvertTo-SecureString -AsPlainText -Force
+    return Invoke-Az -azCommand @('account', 'get-access-token', '--scope', $scope, '--query', 'accessToken', '--output', 'tsv') | ConvertTo-SecureString -AsPlainText -Force
 }
\ No newline at end of file
diff --git a/SCEPman/Private/subscriptions.ps1 b/SCEPman/Private/subscriptions.ps1
index 275fb90..ca5f4ce 100644
--- a/SCEPman/Private/subscriptions.ps1
+++ b/SCEPman/Private/subscriptions.ps1
@@ -85,7 +85,7 @@ function GetSubscriptionDetails ([bool]$SearchAllSubscriptions, $SubscriptionId,
         $potentialSubscription = $subscriptions[0]
       }
   }
-  $null = az account set --subscription $($potentialSubscription.id)
+  $null = Invoke-Az @("account", "set", "--subscription", $potentialSubscription.id)
   return $potentialSubscription
 }
 
diff --git a/SCEPman/Public/Sync-IntuneCertificate.ps1 b/SCEPman/Public/Sync-IntuneCertificate.ps1
index 778ba6c..950d909 100644
--- a/SCEPman/Public/Sync-IntuneCertificate.ps1
+++ b/SCEPman/Public/Sync-IntuneCertificate.ps1
@@ -69,7 +69,7 @@ function Sync-IntuneCertificate
     # Expose CertMaster API
     Write-Information "Making sure that Certificate Master exposes its API"
     if ($PSCmdlet.ShouldProcess("Certificate Master App Registration ($CertMasterAppId)", "Expose its API")) {
-      ExecuteAzCommandRobustly -azCommand "az ad app update --id $CertMasterAppId --identifier-uris `"api://$CertMasterAppId`""
+      Invoke-Az -azCommand @("ad", "app", "update", "--id", $CertMasterAppId, "--identifier-uris", "api://$CertMasterAppId")
     }
 
     # Add az as Client Application to SCEPman-CertMaster
diff --git a/Tests/app-service.Tests.ps1 b/Tests/app-service.Tests.ps1
index 9040876..f202275 100644
--- a/Tests/app-service.Tests.ps1
+++ b/Tests/app-service.Tests.ps1
@@ -63,7 +63,7 @@ Describe 'App Service' {
             return Get-Content -Path "./Tests/Data/webapp-deployment-slot-list.json"
         } -ParameterFilter { CheckAzParameters -argsFromCommand $args -azCommandPrefix 'webapp deployment slot list' }
 
-        $slots = GetDeploymentSlots -ResourceGroupName "rg-scepman-test" -AppName "as-scepman"
+        $slots = GetDeploymentSlots -appServiceName "as-scepman" -resourceGroup "rg-scepman-test"
 
         $slots.Count | Should -Be 1
         $slots[0].Name | Should -Be "ds1"
diff --git a/Tests/subscriptions.Tests.ps1 b/Tests/subscriptions.Tests.ps1
index 0483865..4146325 100644
--- a/Tests/subscriptions.Tests.ps1
+++ b/Tests/subscriptions.Tests.ps1
@@ -106,6 +106,11 @@ Describe 'GetSubscriptionDetails' {
                 return Get-Content -Path "./Tests/Data/subscriptions.json"
             }
 
+            if ($azCommand[0] -eq "account" -and $azCommand[1] -eq "set")
+            {
+                return $null
+            }
+
             throw "Unexpected command: $azCommand"
         }
     }