Repository navigation
I am unable to login via Azure CLI #32544
Description
Describe the bug
In Windows Azure SDK environment, I have typed "az login", command
That is asking me to select a tenant and then after selecting the default tenant the login is failing.
Related command
az login
Errors
Authentication failed against tenant 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin': SubError: message_only V2Error: invalid_grant AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. Trace ID: 5f11e3a3-90c5-4465-a60f-4ea7f8bb3a00 Correlation ID: dfd11e0b-beac-486c-8f5b-4051560eb531 Timestamp: 2025-12-15 15:16:48Z. Status: Response_Status.Status_InteractionRequired, Error code: 3399614476, Tag: 557973645
If you need to access subscriptions in the following tenants, please use az login --tenant TENANT_ID.
1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'
Issue script & Debug output
Select a subscription and tenant (Type a number or Enter for no changes): az login --debug
Invalid selection.
Select a subscription and tenant (Type a number or Enter for no changes):
Tenant: Microsoft
Subscription: Service 360 Test (8cff5c8a-98f3-44ad-b300-2d44716c802c)
[Announcements]
With the new Azure CLI login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271236
If you encounter any problem, please open an issue at https://aka.ms/azclibug
[Warning] The login output has been updated. Please be aware that it no longer displays the full list of available subscriptions by default.
Expected behavior
I should be able to login
Environment Summary
C:\Program Files\Microsoft SDKs\Azure.NET SDK\v2.9>
Additional context
No response
Activity
yonzhan commentedon Dec 15, 2025
Thank you for opening this issue, we will look into it.
jiasli commentedon Dec 16, 2025
The error message is clear. Azure CLI cannot get an access token for
1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'tenant with silent authentication.You need to directly log into
1a092f68-5741-455a-8057-2acdb897a850: