Clarify error messages for Azure CLI auth delegation mode - #6654
Merged
Conversation
- Add empty lines before and after warning for better visibility - Add helpful text instructing users to run 'az login' directly - Clarify the prompt about switching back to azd authentication - Improve error message when user declines to switch back Co-authored-by: vhvb1989 <24213737+vhvb1989@users.noreply.github.com>
Change "say Yes to the next question" to "select Yes in the following prompt" for more precise CLI-appropriate language Co-authored-by: vhvb1989 <24213737+vhvb1989@users.noreply.github.com>
Co-authored-by: vhvb1989 <24213737+vhvb1989@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix Azure CLI auth delegation issue
Clarify error messages for Azure CLI auth delegation mode
Jan 30, 2026
vhvb1989
reviewed
Jan 30, 2026
vhvb1989
marked this pull request as ready for review
January 30, 2026 04:22
vhvb1989
requested review from
JeffreyCA,
ZubaeyrMSFT,
achauhan-scc,
hemarina,
kingernupur,
rabollin,
rajeshkamal5050,
saanikaguptamicrosoft,
tg-msft,
trangevi,
wbreza and
weikanglim
as code owners
January 30, 2026 04:22
Remove go.mod and go.sum changes from extensions that were accidentally included Co-authored-by: vhvb1989 <24213737+vhvb1989@users.noreply.github.com>
Collaborator
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
scottaddie
reviewed
Jan 30, 2026
Change text to "To use azd to authenticate instead, select 'y' in the following prompt." for better clarity and conciseness Co-authored-by: scottaddie <10702007+scottaddie@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Wrap 'az login' and 'azd auth login' in single quotes to make them stand out in the instruction text Co-authored-by: scottaddie <10702007+scottaddie@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
scottaddie
reviewed
Jan 30, 2026
Wrap 'azd auth login' in single quotes in the error message to match the style of other messages in the flow Co-authored-by: scottaddie <10702007+scottaddie@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
scottaddie
approved these changes
Jan 30, 2026
JeffreyCA
reviewed
Jan 30, 2026
Conditionally display the 'az login' instruction only when loginMode is auth.AzDelegated, not for other modes like ExternalRequest Co-authored-by: vhvb1989 <24213737+vhvb1989@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
vhvb1989
approved these changes
Jan 30, 2026
Member
|
/check-enforcer override |
scottaddie
approved these changes
Jan 30, 2026
JeffreyCA
approved these changes
Jan 30, 2026
This was referenced Feb 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Original prompt
This section details on the original issue you should resolve
<issue_title>[Issue] Azure CLI auth delegation not working</issue_title>
<issue_description>Output from
azd versionazd version 1.23.2 (commit 83096ae)
What I hoped to accomplish
To set context, I'm hoping to delegate auth responsibilities to Azure CLI to gain access to the broker on Windows (WAM). Azure CLI supports this type of auth by default. See below for steps and thoughts as I attempted to accomplish this task.
To Reproduce
Ensure the latest version of Azure CLI is installed. I'm using v2.82.0.
Log out of Azure CLI via
az logout. Then runaz account showto ensure this message appears:Log out of azd via
azd auth logout.Configure auth delegation to Azure CLI by running the following command:
Run
azd config showto ensure the setting was saved. Notice the following snippet in the JSON:{ "auth": { "useAzCliAuth": "true" },Run
azd auth loginand answer "N" to the question "Do you want to switch back to azd built-in authentication?" Notice the following error appears:At this point, I'm confused for 2 reasons:
auth.useAzCliAuthsetting exist?auth.useAzCliAuthhas been set totrue, I wouldn't expect to be prompted to switch back to azd built-in authN. My expectation was that azd would runaz loginon my behalf. That obviously didn't happen.Run
azd auth statusfor kicks. The following output appears:Now I'm confused again because the error asks me to run
az login. Why can't azd run that command for me if I've setauth.useAzCliAuthtotrue? It's clearly aware of the command that needs to be run.Additional notes
With Azure CLI auth delegation enabled, my expectation is that running
azd auth loginorazd auth logoutwould callaz loginoraz logouton my behalf, respectively. Things don't appear to work that way today. If that's not the vision, some docs should be added to better explain the feature./cc: @kristenwomack @puicchan </issue_description>
<agent_instructions>To fix this issue, we just need to improve the message we are displaying when the auth mode is set to use az.
We are currently showing something like
This is not helping users to understand what is happening.
Make the warning more visible by adding one empty line above and below the warning.
Also, after the line:
(!) Warning: azd is not using the built-in authentication mode, but rather 'az cli'add another line below it that says:Run az login directly instead of azd auth login when using this mode.THen change this text "If you want to use 'azd auth login', you need to disable the current auth mode." for something like
"If you are trying to use switch back to use azd to authenticate. Say Yes to the next question"
Then if they say
No, instead of showing this error: "ERROR: log in is not supported on current mode: az cli" make the error to say, "azd auth login is disabled when the auth mode is delegated. Used the delegated identity to authenticate instead. Current mode: az cli"</agent_instructions>Comments on the Issue (you are @copilot in this section)
@vhvb1989 Hi @scottaddie, The mechanics behind az auth-delegation mode is that the user is managing `az` directly and they have (or will) run `az login` in any way the need. It could be using a principal, or something specific that is not only `az login`. That's why azd would not run `az login`, bc we don't know if that's what the user wants or if az is already logged in. @scottaddie @vhvb1989 I appreciate that explanation. I ran `az login`, followed by `azd auth status --debug` and now see that I'm authenticated via Azure CLI.I think some docs will be extremely helpful for demystifying this feature. I won't be the last person to struggle. Thoughts on where such docs can be added? By the way, I noticed the
auth.useAzCliAuthoption doesn't appear in the list returned byazd config options. Any idea why?</comment_new><comment_new>@JeffreyCA
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.