Skip to content

Azure local regression for az acr login #33674

Open
#33675
Open
Azure local regression for az acr login#33674
#33675
Assignees
a0x1abcopilot-swe-agent
Labels
AADAuto-AssignAuto assign by botContainer Registryaz acrService AttentionThis issue is responsible by Azure service team.act-identity-squadact-observability-squadbugThis issue requires a change to an existing behavior in the product in order to be resolved.needs-team-attentionThis issue needs attention from Azure service team or SDK team

Description

@TheOnlyWei
Wei Shi (TheOnlyWei)
opened on Jun 30, 2026

Describe the bug

Azure local regression for az acr login. az acr login tries to access https://containerregistry.azure.net/.default.

Related command

az acr login --name $localRegistry --expose-token --output tsv --query accessToken --debug

Errors

msal.application: Refresh failed. invalid_resource: AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access. Requested resource: 'https://containerregistry.azure.net'
Trace ID: 125f8d78-e78c-429d-a581-60a3f49b92dc
Correlation ID: 574acaac-2d2c-43c8-a36d-b4a18709481a
Timestamp: 2026-06-29 22:47:08Z
cli.azure.cli.core.auth.util: MSAL error: {'error': 'invalid_resource', 'error_description': "AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access. Requested resource: 'https://containerregistry.azure.net'\r\nTrace ID: 125f8d78-e78c-429d-a581-60a3f49b92dc\r\nCorrelation ID: 574acaac-2d2c-43c8-a36d-b4a18709481a\r\nTimestamp: 2026-06-29 22:47:08Z", 'error_codes': [50001], 'trace_id': '125f8d78-e78c-429d-a581-60a3f49b92dc', 'correlation_id': '574acaac-2d2c-43c8-a36d-b4a18709481a', 'timestamp': '2026-06-29 22:47:08Z'}
cli.azure.cli.command_modules.acr._docker_utils: Unable to get AAD authorization tokens with message: AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access. Requested resource: 'https://containerregistry.azure.net'
Trace ID: 125f8d78-e78c-429d-a581-60a3f49b92dc
Correlation ID: 574acaac-2d2c-43c8-a36d-b4a18709481a
Timestamp: 2026-06-29 22:47:08Z

Issue script & Debug output

PS C:\Users\Administrator> az acr login --name $localRegistry  --expose-token --output tsv --query accessToken --debug
cli.knack.cli: Command arguments: ['acr', 'login', '--name', 'edgeartifacts.edgeacr.autonomous.aldo.private', '--expose-token', '--output', 'tsv', '--query', 'accessToken', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
Enable VT mode.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x00000202EB831C60>, <function OutputProducer.on_global_arguments at 0x00000202EB9C1D00>, <function CLIQuery.on_global_arguments at 0x00000202EBA13D80>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Using packaged command index for profile 'latest'.
cli.azure.cli.core: Modules found from index for 'acr': ['azure.cli.command_modules.acr']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Loaded command modules in parallel:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: acr                       0.135        36       150
cli.azure.cli.core: Total (1)                 0.152        36       150
cli.azure.cli.core: Loaded 36 groups, 150 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : acr login
cli.azure.cli.core: Command table: acr login
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x00000202EC017420>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\Administrator\.azure\commands\2026-06-30.00-17-07.acr_login.7644.log'.
az_command_data_logger: command args: acr login --name {} --expose-token --output {} --query {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x00000202EC06CB80>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x00000202EC06CAE0>, <function register_global_policy_argument.<locals>.add_global_policy_argument at 0x00000202EC06CCC0>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x00000202EC06CD60>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x00000202EC06CE00>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x00000202EB9C1DA0>, <function CLIQuery.handle_query_parameter at 0x00000202EBA13E20>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x00000202EC06CC20>]
cli.azure.cli.command_modules.acr._validators: Registry name is 'edgeartifacts'. The following suffix '.edgeacr.autonomous.aldo.private' is automatically omitted.
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\\Users\\Administrator\\.azure\\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\Administrator\.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? False
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.autonomous.aldo.private/.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.autonomous.aldo.private/.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 006b9f3d-d0b1-48ff-8654-3c7e558f4159
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.autonomous.aldo.private/subscriptions/ff25c669-1285-ae07-3003-fc4165d05ca4/resources?$filter=resourceType%20eq%20%27Microsoft.ContainerRegistry%2Fregistries%27&api-version=2024-11-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
cli.azure.cli.core.sdk.policies:     'x-ms-client-request-id': '078d0ac0-7419-11f1-a7f0-00155d463119'
cli.azure.cli.core.sdk.policies:     'CommandName': 'acr login'
cli.azure.cli.core.sdk.policies:     'ParameterSetName': '--name --expose-token --output --query --debug'
cli.azure.cli.core.sdk.policies:     'User-Agent': 'AZURECLI/2.87.0 (MSI) azsdk-python-core/1.39.0 Python/3.13.13 (Windows-2022Server-10.0.20348-SP0)'
cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.autonomous.aldo.private:443
urllib3.connectionpool: https://management.autonomous.aldo.private:443 "GET /subscriptions/ff25c669-1285-ae07-3003-fc4165d05ca4/resources?$filter=resourceType%20eq%20%27Microsoft.ContainerRegistry%2Fregistries%27&api-version=2024-11-01 HTTP/1.1" 200 12
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies:     'Content-Length': '12'
cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies:     'Date': 'Tue, 30 Jun 2026 00:17:08 GMT'
cli.azure.cli.core.sdk.policies:     'Server': 'Microsoft-HTTPAPI/2.0'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-reads': '31991'
cli.azure.cli.core.sdk.policies:     'x-ms-request-id': 'cfd31c10-a168-445c-a0fa-be2507d63d4a'
cli.azure.cli.core.sdk.policies:     'x-ms-correlation-request-id': 'cfd31c10-a168-445c-a0fa-be2507d63d4a'
cli.azure.cli.core.sdk.policies:     'x-ms-routing-request-id': 'AUTONOMOUS:20260630T001708Z:cfd31c10-a168-445c-a0fa-be2507d63d4a'
cli.azure.cli.core.sdk.policies:     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies:     'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"value":[]}
cli.azure.cli.command_modules.acr._docker_utils: Could not get registry from service. Exception: The resource with name 'edgeartifacts' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'Starter Subscription (ff25c669-1285-ae07-3003-fc4165d05ca4)'.
cli.azure.cli.command_modules.acr._docker_utils: 2026-06-30 00:17:08.652883 Sending a HTTP Get request to https://edgeartifacts.edgeacr.autonomous.aldo.private/v2/
urllib3.connectionpool: Starting new HTTPS connection (1): edgeartifacts.edgeacr.autonomous.aldo.private:443
urllib3.connectionpool: https://edgeartifacts.edgeacr.autonomous.aldo.private:443 "GET /v2/ HTTP/1.1" 401 149
cli.azure.cli.command_modules.acr._docker_utils: Attempting to retrieve AAD refresh token...
cli.azure.cli.command_modules.acr._docker_utils: 2026-06-30 00:17:08.948903 Sending a HTTP Get request to https://edgeartifacts.edgeacr.autonomous.aldo.private/v2/
urllib3.connectionpool: Starting new HTTPS connection (1): edgeartifacts.edgeacr.autonomous.aldo.private:443
urllib3.connectionpool: https://edgeartifacts.edgeacr.autonomous.aldo.private:443 "GET /v2/ HTTP/1.1" 401 149
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? False
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://containerregistry.azure.net/.default'], claims_challenge=None, kwargs={}
msal.application: Found 1 RTs matching {'environment': 'login.autonomous.aldo.private', 'home_account_id': '********', 'client_id': '04b07795-8ddb-461a-bbee-02f9e1bf7b46'}
msal.telemetry: Generate or reuse correlation_id: b0a8a0e7-f893-4ead-bc77-6a36d50e5d4f
msal.application: Cache attempts an RT
cli.azure.cli.core.auth.binary_cache: save: C:\Users\Administrator\.azure\msal_http_cache.bin
cli.azure.cli.core.auth.binary_cache: save: C:\Users\Administrator\.azure\msal_http_cache.bin
urllib3.connectionpool: Starting new HTTPS connection (1): login.autonomous.aldo.private:443
urllib3.connectionpool: https://login.autonomous.aldo.private:443 "POST /adfs/oauth2/token/ HTTP/1.1" 400 None
cli.azure.cli.core.auth.binary_cache: save: C:\Users\Administrator\.azure\msal_http_cache.bin
cli.azure.cli.core.auth.binary_cache: save: C:\Users\Administrator\.azure\msal_http_cache.bin
msal.application: Refresh failed. invalid_resource: AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access. Requested resource: 'https://containerregistry.azure.net'
Trace ID: 79707523-893e-41d4-acc0-cd0d9cec5af2
Correlation ID: b0a8a0e7-f893-4ead-bc77-6a36d50e5d4f
Timestamp: 2026-06-30 00:17:09Z
cli.azure.cli.core.auth.util: MSAL error: {'error': 'invalid_resource', 'error_description': "AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access. Requested resource: 'https://containerregistry.azure.net'\r\nTrace ID: 79707523-893e-41d4-acc0-cd0d9cec5af2\r\nCorrelation ID: b0a8a0e7-f893-4ead-bc77-6a36d50e5d4f\r\nTimestamp: 2026-06-30 00:17:09Z", 'error_codes': [50001], 'trace_id': '79707523-893e-41d4-acc0-cd0d9cec5af2', 'correlation_id': 'b0a8a0e7-f893-4ead-bc77-6a36d50e5d4f', 'timestamp': '2026-06-30 00:17:09Z'}
cli.azure.cli.command_modules.acr._docker_utils: Unable to get AAD authorization tokens with message: AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access. Requested resource: 'https://containerregistry.azure.net'
Trace ID: 79707523-893e-41d4-acc0-cd0d9cec5af2
Correlation ID: b0a8a0e7-f893-4ead-bc77-6a36d50e5d4f
Timestamp: 2026-06-30 00:17:09Z
cli.azure.cli.command_modules.acr._docker_utils: Unable to get admin user credentials with message: The resource with name 'edgeartifacts' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'Starter Subscription (ff25c669-1285-ae07-3003-fc4165d05ca4)'.

Expected behavior

Should not try to access public Azure container registry:

cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://containerregistry.azure.net/.default'], claims_challenge=None, kwargs={}

Environment Summary

azure-cli                         2.87.0

core                              2.87.0
telemetry                          1.1.0

Dependencies:
msal                              1.36.0
azure-mgmt-resource               24.0.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\Administrator\.azure'
Extensions directory 'C:\Users\Administrator\.azure\cliextensions'

Python (Windows) 3.13.13 (tags/v3.13.13:01104ce, Apr  7 2026, 19:25:48) [MSC v.1944 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal


Your CLI is up-to-date.

Additional context

No response

Activity

  1. Wei Shi (TheOnlyWei)
    added
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Jun 30, 2026

  2. yonzhan commented on Jun 30, 2026

    @yonzhan
    Yong Zhang (yonzhan)
    on Jun 30, 2026
    Collaborator

    Thank you for opening this issue, we will look into it.

  3. microsoft-github-policy-service
    added
    Auto-AssignAuto assign by bot
    Service AttentionThis issue is responsible by Azure service team.
    Container Registryaz acr
    act-observability-squad
    AAD
    act-identity-squad
    on Jun 30, 2026
  4. Aditya Pujara (a0x1ab)
    assigned
    Copilot
    and
    Aditya Pujara (a0x1ab)
    on Jun 30, 2026

  5. azclibot commented on Jun 30, 2026

    @azclibot
    Azure CLI Bot (azclibot)
    on Jun 30, 2026
    Collaborator

    Bug Analysis

    Issue: az acr login is trying to acquire an AAD token using https://containerregistry.azure.net as the resource URL, but this resource is disabled/non-existent in local/private Azure environments (e.g., Azure Stack Edge, air-gapped deployments).

    Root cause: The ACR login code hardcodes or unconditionally resolves https://containerregistry.azure.net as the resource endpoint for token acquisition, instead of deriving the correct resource URL from the registry's login server or cloud metadata for the active cloud environment.

    Debug trace confirms:

    • The registry hostname is edgeartifacts.edgeacr.autonomous.aldo.private (a local/private registry)
    • The MSAL token request fails with AADSTS50001: The resource is disabled or does not exist. Requested resource: 'https://containerregistry.azure.net'
    • This is a regression — the command was previously working in this environment

    Fix needed: In azure/cli/command_modules/acr/_docker_utils.py (or related auth helpers), ensure that the resource URL used for AAD token acquisition is derived from the registry's actual cloud environment or login server, not unconditionally set to https://containerregistry.azure.net. For sovereign/private clouds, the correct container registry resource URL must come from the cloud endpoints configuration.

    Use this EXACT PR title (copy verbatim, do not reword):

    [ACR] Fix #33674: `az acr login`: Fix incorrect resource URL used for local/private registry token acquisition

    PR title & description format (required)

    This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

    Use this EXACT PR title (copy verbatim, do not reword):

    [ACR] Fix #33674: `az acr login`: Fix incorrect resource URL used for local/private registry token acquisition

    Keep the backticks around the command and the Fix #33674: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [ACR] prefix, issue link, and backticked command must stay.

    Description — follow the PR template and fill in:

    • Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #33674.
    • Related command — az acr login
    • Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
    • Testing Guide — example command(s) showing the fix works.
    • History Notes — e.g. [ACR] `az acr login`: Fix incorrect resource URL used for local/private registry token acquisition
    • Keep the template checklist and tick the items you've satisfied.

    Posted by agent-assist (autonomous bug-fix pipeline).

  6. Copilot
    linked a pull request that will close this issue[ACR] Fix Azure/azure-cli#33674: `az acr login`: Fix incorrect resource URL used for local/private registry token acquisition #33675on Jun 30, 2026
  7. Copilot
    added a commit that references this issue on Jun 30, 2026

    [ACR] Fix #33674: derive ACR audience from login_server for private c…

    1485349

  8. johnsonshi commented on Jul 5, 2026

    @johnsonshi
    Johnson Shi (johnsonshi)
    on Jul 5, 2026
    Contributor

    Zoey Li (@lizMSFT) can you take a look?

  9. notyashhh commented on Jul 7, 2026

    @notyashhh
    Yash (notyashhh)
    on Jul 7, 2026
    Member

    Thanks for the report, and for the detailed debug output.

    az acr login acquires an AAD token for the audience https://containerregistry.azure.net,
    which isn't recognized by the local/private IDP in your disconnected environment — hence the
    AADSTS50001: The resource is disabled or does not exist error.

    As a workaround, you can pin the audience your local IDP recognizes:

    az config set acr.audience_resource=<audience-your-local-idp-knows>

    (A value beginning with https:// is used verbatim; otherwise it's expanded to
    https://<value>.azure.net.)

    Could you confirm whether setting acr.audience_resource to the audience registered with your
    local Entra/IDP resolves the login? That will help us confirm the fix path for disconnected
    Azure Local registries.

  10. Yash (notyashhh)
    added
    needs-author-feedbackMore information is needed from author to address the issue.
    on Jul 7, 2026
  11. microsoft-github-policy-service
    added
    no-recent-activityThere has been no recent activity on this issue.
    on Sep 9, 2026

  12. microsoft-github-policy-service commented on Sep 9, 2026

    @microsoft-github-policy-service
    microsoft-github-policy-servicebot
    on Sep 9, 2026 – with Microsoft GitHub Policy Service
    Contributor

    Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

  13. TheOnlyWei commented on Sep 9, 2026

    @TheOnlyWei
    Wei Shi (TheOnlyWei)
    on Sep 9, 2026
    Author

    Thanks for the report, and for the detailed debug output.

    az acr login acquires an AAD token for the audience https://containerregistry.azure.net, which isn't recognized by the local/private IDP in your disconnected environment — hence the AADSTS50001: The resource is disabled or does not exist error.

    As a workaround, you can pin the audience your local IDP recognizes:

    az config set acr.audience_resource=<audience-your-local-idp-knows>

    (A value beginning with https:// is used verbatim; otherwise it's expanded to https://<value>.azure.net.)

    Could you confirm whether setting acr.audience_resource to the audience registered with your local Entra/IDP resolves the login? That will help us confirm the fix path for disconnected Azure Local registries.

    This worked in 2.89.1, but does not work on 2.85.0 that I tested.

  14. microsoft-github-policy-service
    added
    needs-team-attentionThis issue needs attention from Azure service team or SDK team
    and removed
    needs-author-feedbackMore information is needed from author to address the issue.
    no-recent-activityThere has been no recent activity on this issue.
    on Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

AADAuto-AssignAuto assign by botContainer Registryaz acrService AttentionThis issue is responsible by Azure service team.act-identity-squadact-observability-squadbugThis issue requires a change to an existing behavior in the product in order to be resolved.needs-team-attentionThis issue needs attention from Azure service team or SDK team

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions