[Issue] azd env list fails for guest user with remote Blob state: 401 InvalidAuthenticationInfo / Issuer validation failed, while az storage --auth-mode login succeeds

[tuggeluk]

• [x ] Make sure you've installed the latest version using instructions

Output from azd version
azd version 1.23.8 (commit eed9b0b)

Describe the bug
When a guest user in the host tenant authenticates successfully with both az and azd,
azd env list fails against the remote Blob state backend with:

• HTTP 401
• InvalidAuthenticationInfo
• AuthenticationErrorDetail>Issuer validation failed. Issuer did not match.

However, the same user can successfully access the same storage account with Azure CLI using Microsoft Entra auth:

az storage container list --account-name <storage-account-name> --auth-mode login -o table

To Reproduce

1. Configure an azd project to use remote environments backed by Azure Blob Storage.
2. Use a guest user account that has access to the subscription and Blob storage.
3. Sign in explicitly to the correct tenant and subscription:

azd auth logout
az logout

az config set core.login_experience_v2=off
az login --tenant <host-tenant-id> --use-device-code
az account set --subscription <shared-subscription-id>

azd auth login --tenant-id <host-tenant-id> --use-device-code
azd config set defaults.subscription <shared-subscription-id>

4. Run

azd env list --debug

This fails with

ERROR: listing environments: retrieving remote environments, listing blobs: failed getting next page of containers: GET https://<storage-account-name>.blob.core.windows.net

RESPONSE 401: 401 Server failed to authenticate the request. Please refer to the information in the www-authenticate header.
ERROR CODE: InvalidAuthenticationInfo

<AuthenticationErrorDetail>Issuer validation failed. Issuer did not match.</AuthenticationErrorDetail>

5. Check against Az Storage CLI command

az storage container list --account-name <storage-account-name> --auth-mode login -o table

This works as expected with an output simmilar to this:

Name           Lease Status    Last Modified
-------------  --------------  -------------------------
<state-container>              <timestamp>

Expected behavior
Blob access to work and print of existing remote envs

Environment

• OS: Linux
• azd version: 1.23.8
• Azure CLI auth: device code
• azd auth: device code

Additional context
We ruled out:

• incorrect subscription
• incorrect tenant selection in Azure CLI
• incorrect tenant selection in azd auth login
• lack of basic Blob access for the guest user

The strongest signal is that az storage container list --auth-mode login succeeds against the same storage account, while azd env list fails with an issuer mismatch.

[weikanglim]

Hi @tuggeluk can you either set subscriptionId in your remote state config? Depending on whether you've configured it globally or per-project (azure.yaml), here are your options:

azure.yaml

state:
  remote:
    backend: AzureBlobStorage
    config:
      accountName: <accountName>
      subscriptionId: <subscriptionId>

account

azd config set state.remote.config.subscriptionId <subscriptionId>

I do think azd should respect your defaults.subscription setting (it doesn't currently), so I submitted #7072 as a fix.