Azure and Azure DevOps MCP and CLI authentication not passed through agent

[florianbader]

I am testing an Agentic Workflow that should allow the code review agent to access Azure CLI, Azure DevOps CLI, Azure MCP, and Azure
DevOps MCP.

The workflow logs in to Azure using GitHub Actions OIDC (setup-copilot custom steps), retrieves an Azure DevOps access token, exposes it as
ADO_MCP_AUTH_TOKEN, and configures the Azure DevOps MCP endpoint at https://mcp.dev.azure.com/<org>.
Azure MCP is configured through @azure/mcp.

The workflow has id-token: write permission and allows the relevant Azure and Microsoft domains.

Troubleshooting steps

I tried the following:

1. Checked whether the Azure CLI was installed.
2. Ran az account show.
3. Investigated the Azure CLI configuration directory.
4. Retried using a writable AZURE_CONFIG_DIR.
5. Checked whether ADO_MCP_AUTH_TOKEN was present.
6. Called the Azure DevOps REST API with curl and the bearer token.
7. Checked the Azure DevOps MCP bridge.
8. Checked the Azure MCP bridge.
9. Added *.microsoftonline.com to the network allowlist.
10. Investigated firewall denies for azcliprod.blob.core.windows.net and dc.services.visualstudio.com.

Current workaround

I implemented a proof-of-concept workaround from #18386

• Requests a short-lived OIDC token during runner setup.
• Writes the token to a protected temporary file under /tmp.
• Exposes the file path through COPILOT_AZURE_OIDC_TOKEN_FILE.
• Attempts to authenticate again inside the agent process with az login --federated-token.
• Uses a new writable AZURE_CONFIG_DIR for the agent-side Azure CLI session.

This worked and both the Azure CLI has access as well as the Azure DevOps CLI.
I also tested Azure DevOps directly with the ADO_MCP_AUTH_TOKEN which worked.

Observed results

In the runner, Azure CLI and Azure DevOps CLI is logged in correctly and can access the data.
In the sandbox and MCP is fails.

Azure CLI

The agent initially failed with:

PermissionError: [Errno 13] Permission denied: '/home/runner/.azure/azureProfile.json'

The directory was owned by root:root, while the agent ran as the runner user.

Using a writable AZURE_CONFIG_DIR removed the filesystem error, but Azure CLI then reported:

ERROR: Please run 'az login' to setup account.

This indicates that the Azure login performed during the setup action was not available to the later agent process. The
OIDC-file workaround is intended to address this process boundary.

Azure DevOps token

The logs showed that ADO_MCP_AUTH_TOKEN existed in the agent environment.
Using curl with the token works and has access to the Azure DevOps API.

Azure DevOps MCP

The ado bridge started successfully, but its generated tool manifest was empty:

Showing top-level help (0 tools)
Commands (0):
  (tool list unavailable)

A direct MCP request reached the gateway, but returned:

Error [-32602]: unknown tool "wit_work_item"

This shows that the ado executable is available and the bridge can reach the gateway, but no Azure DevOps tools are
being exposed. The remaining question is whether the upstream MCP server is returning an authentication,
authorization, endpoint, or tool-registration error. The available logs did not include the upstream tools/list
response.

Azure MCP

Azure MCP was added to the workflow and also returned zero tools. This happened even though the initial Azure CLI login
in setup-copilot succeeded and the setup step could access the Azure account.

This separates the Azure MCP issue from the original Azure CLI login issue: the service principal authentication and
Azure account access work during setup, but the Azure MCP server does not expose any tools to the agent. The diagnostic
workflow records the bridge result without printing credentials or response bodies.

Current assessment

There appear to be at least three separate runtime boundaries:

1. Azure authentication created during the setup action is not automatically available to the later agent process. Therefore Azure CLI and Azure DevOps CLI don't work.
2. Azure MCP also exposes zero tools, despite the successful setup-time Azure CLI login and account access.
3. The Azure DevOps MCP bridge starts, but exposes zero tools even though ADO_MCP_AUTH_TOKEN is present.

Agentic Workflow

---
name: 'Code review'
on:
  label_command:
    name: ready-for-review
    events: [pull_request]
  workflow_dispatch:
  reaction: "eyes"
  status-comment: true
permissions:
  contents: read
  issues: read
  pull-requests: read
  id-token: write
environment: copilot
secrets:
  AZURE_CLIENT_ID: ${{ secrets.COPILOT_MCP_AZURE_CLIENT_ID }}
  AZURE_TENANT_ID: ${{ secrets.COPILOT_MCP_AZURE_TENANT_ID }}
strict: true
tools:
  timeout: 120
  github:
    toolsets: [default]
    mode: gh-proxy
  bash:
    - "*"
  web-fetch:
  web-search:
  cli-proxy: true
  cache-memory: true
  repo-memory:
checkout:
  repository: ${{ github.repository }}
engine:
  id: claude
  auth:
    type: github-oidc
    provider: anthropic
    [...]
model: sonnet
models:
  blocked: ["*fable*"]
mcp-servers:
  ado:
    url: "https://mcp.dev.azure.com/<org>"
    headers:
      Authorization: "Bearer ${{ env.ADO_MCP_AUTH_TOKEN }}"
    allowed: ["*"]
  azure:
    command: "npx"
    args: ["-y", "@azure/mcp@latest", "server", "start"]
    allowed: ["*"]
network:
  allowed:
    - defaults
    - "*.microsoft.com"
    - "*.azure.com"
    - "*.windows.net"
    - "*.visualstudio.com"
    - "*.microsoftonline.com"
safe-outputs:
  add-comment:
    max: 20
    target: "*"
steps:
  - name: Setup Copilot
    uses: ./.github/actions/setup-copilot
    with:
      azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
      azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
---

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#6686

Generated by Firewall Issue Dispatcher · sonnet46 · 32.7 AIC · ⊞ 6.4K · ◷