There is a command group 'az_webapp_auth'. This group of commands could 'manage webapp authentication and authorization  to use v2 auth commands  run  az extension add   name authv2  to add the authv2 cli extension'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_webapp_auth_update'.The syntax is: az webapp auth update [--aad-allowed-token-audiences]
                      [--aad-client-id]
                      [--aad-client-secret]
                      [--aad-client-secret-certificate-thumbprint]
                      [--aad-token-issuer-url]
                      [--action {allowanonymous, loginwithazureactivedirectory, loginwithfacebook, loginwithgoogle, loginwithmicrosoftaccount, loginwithtwitter}]
                      [--allowed-external-redirect-urls]
                      [--enabled {false, true}]
                      [--facebook-app-id]
                      [--facebook-app-secret]
                      [--facebook-oauth-scopes]
                      [--google-client-id]
                      [--google-client-secret]
                      [--google-oauth-scopes]
                      [--ids]
                      [--microsoft-account-client-id]
                      [--microsoft-account-client-secret]
                      [--microsoft-account-oauth-scopes]
                      [--name]
                      [--resource-group]
                      [--runtime-version]
                      [--slot]
                      [--subscription]
                      [--token-refresh-extension-hours]
                      [--token-store {false, true}]
                      [--twitter-consumer-key]
                      [--twitter-consumer-secret]. The 1th example of the child command would be to use it to 'enable aad by enabling authentication and setting aad associated parameters  default provider is set to aad  must have created a aad service principal beforehand', the syntax is: az webapp auth update  -g myResourceGroup -n myUniqueApp --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-allowed-token-audiences https://webapp_name.azurewebsites.net/.auth/login/aad/callback \
  --aad-client-id ecbacb08-df8b-450d-82b3-3fced03f2b27 --aad-client-secret very_secret_password \
  --aad-token-issuer-url https://sts.windows.net/54826b22-38d6-4fb2-bad9-b7983a3e9c5a/. The 2th example of the child command would be to use it to 'allow facebook authentication by setting fb associated parameters and turning on public profile and email scopes  allow anonymous users', the syntax is: az webapp auth update -g myResourceGroup -n myUniqueApp --action AllowAnonymous \
  --facebook-app-id my_fb_id --facebook-app-secret my_fb_secret \
  --facebook-oauth-scopes public_profile email. The parameter '--aad-allowed-token-audiences' is optional. one or more token audiences (comma-delimited).. The parameter '--aad-client-id' is optional. application id to integrate aad organization account sign-in into your web app.. The parameter '--aad-client-secret' is optional. aad application secret.. The parameter '--aad-client-secret-certificate-thumbprint --thumbprint' is optional. alternative to aad client secret, thumbprint of a certificate used for signing purposes.. The parameter '--aad-token-issuer-url' is optional. this url can be found in the json output returned from your active directory endpoint using your tenantid. the endpoint can be queried from `az cloud show` at "endpoints.activedirectory". the tenantid can be found using `az account show`. get the "issuer" from the json at <active directory endpoint>/<tenantid>/.well-known/openid-configuration.. 