Azure CLI doesn't return token for scope: ERROR: (pii). Status: Response_Status.Status_IncorrectConfiguration, Error code: 3399614475, Tag: 508634112 #30491
Comments
riosengineer
added
the
bug
|
Thank you for opening this issue, we will look into it. |
microsoft-github-policy-service
bot
added
customer-reported
microsoft-github-policy-service
bot
added
Azure CLI Team
yonzhan
removed
the
bug
|
Hi, is there anyone who could advise? @yonzhan |
Hi, did you solve your issue? |
I have not no. I can get a token from Azure Developer CLI via a scope, but not via Azure CLI still. |
I found the same error code when trying to acquire a token: But using Instead, to obtain the accessToken what I'm doing is fist logging into the Tenant where the scope lives, using the tenantId, then acquiring an accessToken with just the az login --allow-no-subscriptions --tenant "00000000-xxxx-xxxx-xxxx-000000000000"
$token = az account get-access-token --scope "api://00000000-yyyy-yyyy-yyyy-000000000000/Users.Read.All/.default" -o json | ConvertFrom-JsonAlternatively, login with the same scope then get the token: az login --allow-no-subscriptions --scope "api://00000000-yyyy-yyyy-yyyy-000000000000/Users.Read.All/.default"
$token = az account get-access-token --scope "api://00000000-yyyy-yyyy-yyyy-000000000000/Users.Read.All/.default" -o json | ConvertFrom-Json |
That did indeed work! Which is great. Thanks for the pointer there. Although I am unsure why I have to explicitly state the tenant cmdlet syntax, given this particular account is only logging into one tenant, it has access to no other. Feels like I shouldn't have to do that. I understand if the account had access to multiple tenants. |
Sorry, I've edited my message, you can either specify a login via --tenant, or, --scope (2nd snippet). You're right, specifying the tenant doesn't make sense in this context. Using the |
Thanks for this. Strangely, it now seems to work with just I still think the Azure CLI team could improve the debug response on this, as it didn't make much sense to me why it didn't work for me |
jiasli
changed the title
I fully understand the error message
I am not sure if it is due to Entra's propagation latency or WAM. Could you turn off WAM and see if it works: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively#sign-in-with-web-account-manager-wam-on-windows
For |
Thanks. It seems to work both ways, with or without WAM now - I can't seem to replicate that error from prior however it could be a cache thing since running the cmdlets from danmacode. |
Describe the bug
Hi team,
I have an Entra App Registration with an Exposed API Scope and App Role associated with it. I've also associated the
Microsoft Azure CLIEnterprise App with GUID04b07795-8ddb-461a-bbee-02f9e1bf7b46within the 'Authorized client applications` area of my app registration.When trying to obtain an access token using this scope, I receive a strange and obstruse error:
(pii). Status: Response_Status.Status_IncorrectConfiguration, Error code: 3399614475, Tag: 508634112and when inspecting the AZURE CLI debug logs, I see an error about the auth being to the wrong tenant. It is not the wrong tenant, and I am logged in no problems.Either way, the error is pretty unhelpful and doesn't offer much in the way of what is wrong. I am logged into Azure CLI, I am authenticated to the correct tenant, with the correct account.
This call works fine with the
Azure Developer CLIusingInterestingly, AZD only works, if I add the Azure CLI Enterprise App as an Authorized Client application within the App Registrastion.
But it doesn't work for Azure CLI.
Related command
Errors
invalid_resource AADSTS500011: The resource principal named api://SANITISED/API.Access was not found in the tenant named SANITISED. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.Issue script & Debug output
Debug logging from Azure CLI when attempting this:
Expected behavior
I expect a valid JWT token response from my scope. This works with AzD CLI.
Environment Summary
Additional context
Initially raised an issue with the Azure SDK for dotnet team as I spotted this whilst trying to use the
DefaultAzureCredential()class for authentication locally when developing/debugging dotnet Azure PaaS code where we can use az login for local dev, and managed identity when the code runs in the PaaS context. Issue: Azure/azure-sdk-for-net#47412The text was updated successfully, but these errors were encountered: