azd auth login with scope does not work - using EAM

[vhvb1989]

auth login returns an error:

debug logs

PS C:\Users\vivazqu> azd auth login --scope https://graph.microsoft.com/.default --debug
2023/05/19 13:41:19 main.go:53: azd version: 0.9.0-beta.3 (commit e564b122af7c1cb92bc54755f32930d661dddda2)
2023/05/19 13:41:20 main.go:203: using cached latest version: 0.9.0-beta.3 (expires on: 2023-05-20T20:38:30Z)
2023/05/19 13:41:20 cobra_builder.go:136: Resolved action 'azd-auth-login-action'
2023/05/19 13:41:20 middleware.go:124: running middleware 'debug'
RESPONSE 400: 400 Bad Request
--------------------------------------------------------------------------------
{
  "error": "invalid_grant",
  "error_description": "AADSTS50158: External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges.\r\nTrace ID: 52f56d8e-6b25-4eab-b90c-c6e4bcacc100\r\nCorrelation ID: a292e891-5d20-49bb-b454-d7cf53013ea0\r\nTimestamp: 2023-05-19 20:41:26Z",
  "error_codes": [
    50158
  ],
  "timestamp": "2023-05-19 20:41:26Z",
  "trace_id": "52f56d8e-6b25-4eab-b90c-c6e4bcacc100",
  "correlation_id": "a292e891-5d20-49bb-b454-d7cf53013ea0",
  "error_uri": "https://login.microsoftonline.com/error?code=50158",
  "suberror": "basic_action"
}
--------------------------------------------------------------------------------


ERROR: reauthentication required, run `azd auth login --scope https://graph.microsoft.com/.default` to log in

[weikanglim]

@vhvb1989 Did the browser pop up for you at all?

From the debug logs, I also don't see where the log is coming from, which is weird.

[weikanglim]

NVM, Victor had sent me details offline

[weikanglim]

This was left open from a while back, but I don't think we found anything interesting from this one. Closing.

[gunsto]

I'm facing this exact same issue for 1-2 weeks now. It seems it came up after last upgrade to azd version 1.19. Since AZ CLI is working just fine, I assume it is something AZD-specific

[vhvb1989]

@gunsto did it work if you run azd auth login ?

[gunsto]

Hi @vhvb1989 , that's where I get the error. The browser opens up properly, I can authenticate and authN request redirects back to terminal or vscode. The error is only visible in the debug log!

azd auth login --tenant-id [REDACTED_TENANT_ID] --debug
2025/09/29 18:40:16 main.go:56: azd version: 1.19.0 (commit b3d68ce)
2025/09/29 18:40:16 telemetry.go:99: telemetry is disabled by user and will not be initialized.
2025/09/29 18:40:16 main.go:214: using cached latest version: 1.19.0 (expires on: 2025-09-30T06:15:33Z)
2025/09/29 18:40:16 middleware.go:111: running middleware 'debug'
2025/09/29 18:40:16 middleware.go:111: running middleware 'ux'
2025/09/29 18:40:16 middleware.go:111: running middleware 'error'
2025/09/29 18:40:16 middleware.go:111: running middleware 'telemetry'
2025/09/29 18:40:16 telemetry.go:46: TraceID: 00000000000000000000000000000000
| | Retrieving subscriptions...2025/09/29 18:40:21 main.go:50: Retry: =====> Try=1 for GET https://management.azure.com/tenants?api-version=2022-12-01
|= | Retrieving subscriptions...2025/09/29 18:40:21 main.go:50: Request: ==> OUTGOING REQUEST (Try=1)
GET https://management.azure.com/tenants?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
|== | Retrieving subscriptions...2025/09/29 18:40:21 main.go:50: Response: ==> REQUEST/RESPONSE (Try=1/350.803042ms, OpTime=350.960125ms) -- RESPONSE RECEIVED
GET https://management.azure.com/tenants?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
RESPONSE Status: 200 OK
Cache-Control: no-cache
Content-Length: 13440
Content-Type: application/json; charset=utf-8
Date: Mon, 29 Sep 2025 16:40:21 GMT
Expires: -1
Pragma: no-cache
Strict-Transport-Security: REDACTED
X-Cache: REDACTED
X-Content-Type-Options: REDACTED
X-Ms-Correlation-Request-Id: [REDACTED_CORRELATION_ID]
X-Ms-Ratelimit-Remaining-Tenant-Reads: REDACTED
X-Ms-Request-Id: [REDACTED_REQUEST_ID]
X-Ms-Routing-Request-Id: REDACTED
X-Msedge-Ref: REDACTED
2025/09/29 18:40:21 main.go:50: Retry: response 200
2025/09/29 18:40:21 main.go:50: Retry: exit due to non-retriable status code
|=== | Retrieving subscriptions...2025/09/29 18:40:21 main.go:50: Retry: =====> Try=1 for GET https://management.azure.com/subscriptions?api-version=2022-12-01
|==== | Retrieving subscriptions...2025/09/29 18:40:22 main.go:50: Retry: =====> Try=1 for GET https://management.azure.com/subscriptions?api-version=2022-12-01
|===== | Retrieving subscriptions...2025/09/29 18:40:22 main.go:50: Request: ==> OUTGOING REQUEST (Try=1)
GET https://management.azure.com/subscriptions?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
2025/09/29 18:40:22 main.go:50: Request: ==> OUTGOING REQUEST (Try=1)
GET https://management.azure.com/subscriptions?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
2025/09/29 18:40:22 main.go:50: Retry: =====> Try=1 for GET https://management.azure.com/subscriptions?api-version=2022-12-01
2025/09/29 18:40:22 azd_credential.go:42: POST https://login.microsoftonline.com/[REDACTED_TENANT_ID]/oauth2/v2.0/token
RESPONSE 400: 400 Bad Request
{
"error": "invalid_grant",
"error_description": "AADSTS50158: External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges. Trace ID: [REDACTED_TRACE_ID] Correlation ID: [REDACTED_CORRELATION_ID] Timestamp: 2025-09-29 16:40:22Z",
"error_codes": [
50158
],
"timestamp": "2025-09-29 16:40:22Z",
"trace_id": "[REDACTED_TRACE_ID]",
"correlation_id": "[REDACTED_CORRELATION_ID]",
"error_uri": "https://login.microsoftonline.com/error?code=50158",
"suberror": "basic_action"
}
2025/09/29 18:40:22 main.go:50: Response: ==> REQUEST/RESPONSE (Try=1/133.72175ms, OpTime=133.814583ms) -- RESPONSE RECEIVED
GET https://management.azure.com/subscriptions?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
RESPONSE Status: 200 OK
Cache-Control: no-cache
Content-Length: 34595
Content-Type: application/json; charset=utf-8
Date: Mon, 29 Sep 2025 16:40:22 GMT
Expires: -1
Pragma: no-cache
Strict-Transport-Security: REDACTED
X-Cache: REDACTED
X-Content-Type-Options: REDACTED
X-Ms-Correlation-Request-Id: [REDACTED_CORRELATION_ID]
X-Ms-Ratelimit-Remaining-Tenant-Reads: REDACTED
X-Ms-Request-Id: [REDACTED_REQUEST_ID]
X-Ms-Routing-Request-Id: REDACTED
X-Msedge-Ref: REDACTED
2025/09/29 18:40:22 main.go:50: Retry: response 200
2025/09/29 18:40:22 main.go:50: Retry: exit due to non-retriable status code
|====== | Retrieving subscriptions...2025/09/29 18:40:22 main.go:50: Response: ==> REQUEST/RESPONSE (Try=1/265.420083ms, OpTime=265.57ms) -- RESPONSE RECEIVED
GET https://management.azure.com/subscriptions?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
RESPONSE Status: 200 OK
Cache-Control: no-cache
Content-Length: 47
Content-Type: application/json; charset=utf-8
Date: Mon, 29 Sep 2025 16:40:22 GMT
Expires: -1
Pragma: no-cache
Strict-Transport-Security: REDACTED
X-Cache: REDACTED
X-Content-Type-Options: REDACTED
X-Ms-Correlation-Request-Id: [REDACTED_CORRELATION_ID]
X-Ms-Ratelimit-Remaining-Tenant-Reads: REDACTED
X-Ms-Request-Id: [REDACTED_REQUEST_ID]
X-Ms-Routing-Request-Id: REDACTED
X-Msedge-Ref: REDACTED
2025/09/29 18:40:22 main.go:50: Retry: response 200
2025/09/29 18:40:22 main.go:50: Retry: exit due to non-retriable status code
| ======| Retrieving subscriptions...2025/09/29 18:40:22 main.go:50: Request: ==> OUTGOING REQUEST (Try=1)
GET https://management.azure.com/subscriptions?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
2025/09/29 18:40:23 main.go:50: Response: ==> REQUEST/RESPONSE (Try=1/78.235ms, OpTime=78.2965ms) -- RESPONSE RECEIVED
GET https://management.azure.com/subscriptions?api-version=2022-12-01
Accept: application/json
Authorization: REDACTED
User-Agent: azsdk-go-armsubscriptions/v1.3.0 (go1.25.0 X:loopvar; darwin),azdev/1.19.0 (Go go1.25.0 X:loopvar; darwin/arm64)
RESPONSE Status: 200 OK
Cache-Control: no-cache
Content-Length: 500
Content-Type: application/json; charset=utf-8
Date: Mon, 29 Sep 2025 16:40:22 GMT
Expires: -1
Pragma: no-cache
Strict-Transport-Security: REDACTED
X-Cache: REDACTED
X-Content-Type-Options: REDACTED
X-Ms-Correlation-Request-Id: [REDACTED_CORRELATION_ID]
X-Ms-Ratelimit-Remaining-Tenant-Reads: REDACTED
X-Ms-Request-Id: [REDACTED_REQUEST_ID]
X-Ms-Routing-Request-Id: REDACTED
X-Msedge-Ref: REDACTED
2025/09/29 18:40:23 main.go:50: Retry: response 200
2025/09/29 18:40:23 main.go:50: Retry: exit due to non-retriable status code
2025/09/29 18:40:23 subscriptions_manager.go:336: failed to load subscriptions from tenant '[REDACTED_TENANT_NAME]' : AADSTS50158: External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges. Trace ID: [REDACTED_TRACE_ID] Correlation ID: [REDACTED_CORRELATION_ID] Timestamp: 2025-09-29 16:40:22Z

[gunsto]

Hi @weikanglim, do you have any updates? This issue completely blocks my AZD CLI setup. It has been working for some time, but now it is blocked again. Hope you can identify the root cause.