Repository navigation
az login says "Can't find token from MSAL cache" #32931
Description
Describe the bug
PS C:\Users\kuojianlu> az login
Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136
Retrieving tenants and subscriptions for the selection...
Authentication failed against tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft': Can't find token from MSAL cache.
Authentication failed against tenant 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin': Can't find token from MSAL cache.
If you need to access subscriptions in the following tenants, please use `az login --tenant TENANT_ID`.
72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft'
1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'
No subscriptions found for [REDACTED:email_address].
When I try az login --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47, then it works.
And when I try az login from my Dev Box, if works.
I do not know what happens on my local machine. Can anyone help?
Related command
az login
Errors
Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136
Retrieving tenants and subscriptions for the selection...
Authentication failed against tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft': Can't find token from MSAL cache.
Authentication failed against tenant 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin': Can't find token from MSAL cache.
If you need to access subscriptions in the following tenants, please use az login --tenant TENANT_ID.
72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft'
1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'
No subscriptions found for [REDACTED:email_address].
Issue script & Debug output
cli.knack.cli: Command arguments: ['login', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x000001A7B2A6C5E0>, <function OutputProducer.on_global_arguments at 0x000001A7B2FF59E0>, <function CLIQuery.on_global_arguments at 0x000001A7B304F920>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'login': ['azure.cli.command_modules.profile']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: profile 0.011 2 8
cli.azure.cli.core: Total (1) 0.011 2 8
cli.azure.cli.core: Loaded 2 groups, 8 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : login
cli.azure.cli.core: Command table: login
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x000001A7B5865620>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\kuojianlu.azure\commands\2026-03-06.15-43-36.login.14792.log'.
az_command_data_logger: command args: login --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x000001A7B58AECA0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x000001A7B58F4FE0>, <function register_cache_arguments..add_cache_arguments at 0x000001A7B58F51C0>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x000001A7B58F5260>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x000001A7B2FF5A80>, <function CLIQuery.handle_query_parameter at 0x000001A7B304F9C0>, <function register_ids_argument..parse_ids_arguments at 0x000001A7B58F5080>]
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\Users\kuojianlu\.azure\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\kuojianlu.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/organizations
msal.authority: openid_config("https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/organizations/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/organizations/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/organizations/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': None, 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
msal.application: Falls back to broker._signin_interactively()
cli.azure.cli.core.auth.identity: Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136
msal.broker: [MSAL:0001] INFO SetAuthorityUri:78 Initializing authority from URI 'https://login.microsoftonline.com/organizations' without authority type, defaulting to MsSts
msal.broker: [MSAL:0002] INFO SetCorrelationId:239 Set correlation ID: cc12a77b-e8db-4457-b85d-3b779b739d93
msal.broker: [MSAL:0002] INFO ExecuteInteractiveRequest:1195 The original authority is 'https://login.microsoftonline.com/organizations'
msal.broker: [MSAL:0002] WARNING TryNormalizeRealm:2497 No HomeAccountId provided to normalize the realm
msal.broker: [MSAL:0002] INFO ExecuteInteractiveRequest:1206 The normalized realm is ''
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:214 Additional query parameter added successfully. Key: 'msal_client_sku' Value: 'MSAL.Python'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:214 Additional query parameter added successfully. Key: 'msal_client_ver' Value: '1.35.0b1'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:214 Additional query parameter added successfully. Key: 'msal_gui_thread' Value: 'true'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:214 Additional query parameter added successfully. Key: 'msal_request_type' Value: 'consumer_passthrough'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:237 Authority Realm: organizations
msal.broker: [MSAL:0002] WARNING TryEnqueueMsaDeviceCredentialAcquisitionAndContinue:1090 MsaDeviceOperationProvider is not available. Not attempting to register the device.
msal.broker: [MSAL:0003] WARNING ReturnResponseDueToMissingParameter:698 Attempted to read cache with a non-normalized realm, access token and ID token reads will fail
msal.broker: [MSAL:0003] WARNING ReturnResponseDueToMissingParameter:724 Missing Required parameters, but found no account to return.
msal.broker: [MSAL:0003] WARNING ReadAccountById:601 Account id is empty - account not found
msal.broker: [MSAL:0003] INFO GetCurrentWindowHandleForUIFlow:495 Specified brokerWindowHandle is valid.
msal.broker: [MSAL:0004] INFO CreateRequestForProviderWithProperties:868 Client-xtra-sku: MSAL.Python|1.35.0b1,|0.20.2,|,|,|9.0.0
msal.broker: [MSAL:0004] INFO AddClientSystemInfoToRequest:1241 Client-xtra-sku: MSAL.Python|1.35.0b1,|0.20.2,|,|,|9.0.0
msal.broker: [MSAL:0003] INFO SetCanonicalRealm:1225 Normalize realm to: '72f988bf-86f1-41af-91ab-2d7cd011db47'
msal.broker: [MSAL:0003] WARNING ClearForcePromptFlagForAccount:3221 Unable to find any accounts for the HAID just wrote on disk to clear force prompt flag.
msal.broker: [MSAL:0003] INFO LogTelemetryData:464 Printing Telemetry for Correlation ID: cc12a77b-e8db-4457-b85d-3b779b739d93
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: start_time, Value: 2026-03-06T07:43:37.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: api_name, Value: SignInInteractively
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: was_request_throttled, Value: false
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: authority_type, Value: AAD
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: access_token_expiry_time, Value: 2026-03-06T09:01:00.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: msal_version, Value: 9.0.0
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: client_id, Value: 04b07795-8ddb-461a-bbee-02f9e1bf7b46
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: correlation_id, Value: cc12a77b-e8db-4457-b85d-3b779b739d93
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: broker_app_used, Value: true
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: stop_time, Value: 2026-03-06T07:43:40.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: msalruntime_version, Value: 0.20.2
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: original_authority, Value: https://login.microsoftonline.com/organizations
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: additional_query_parameters_count, Value: 4
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: read_token_last_error, Value: missing required parameter
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: request_eligible_for_broker, Value: true
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: auth_flow, Value: Broker
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: ui_event_count, Value: 1
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: wam_telemetry, Value: {"x_ms_clitelem":"1,0,0,49727.6506,","ui_visible":false,"tenant_id":"72f988bf-86f1-41af-91ab-2d7cd011db47","scope":"https://management.core.windows.net//.default offline_access openid profile","redirect_uri":"ms-appx-web://Microsoft.AAD.BrokerPlugin/04b07795-8ddb-461a-bbee-02f9e1bf7b46","provider_id":"https://login.windows.net","is_guest_user_logon_token_request":false,"is_guest_user_logon_session":false,"is_guest_resource_scenario":false,"http_status":200,"http_event_count":1,"http_content_type":"application/jose; charset=utf-8","http_content_size":14094,"device_join":"aadj","correlation_id":"{8f6af8a9-b223-4fcf-89a1-8594272e7c4c}","client_id":"04b07795-8ddb-461a-bbee-02f9e1bf7b46","ccs_failover_v2":"1.P","cache_event_count":0,"broker_version":"10.0.26100.7462","authority":"https://login.microsoftonline.com/organizations","api_error_code":0,"account_join_on_start":"primary","account_join_on_end":"primary","account_id":"2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db","silent_code":0,"silent_bi_sub_code":0,"silent_message":"","silent_mats":{"x_ms_clitelem":"1,0,0,49727.6506,","ui_visible":false,"tenant_id":"72f988bf-86f1-41af-91ab-2d7cd011db47","scope":"https://management.core.windows.net//.default offline_access openid profile","redirect_uri":"ms-appx-web://Microsoft.AAD.BrokerPlugin/04b07795-8ddb-461a-bbee-02f9e1bf7b46","provider_id":"https://login.windows.net","is_guest_user_logon_token_request":false,"is_guest_user_logon_session":false,"is_guest_resource_scenario":false,"http_status":200,"http_event_count":1,"http_content_type":"application/jose; charset=utf-8","http_content_size":14094,"device_join":"aadj","correlation_id":"{8f6af8a9-b223-4fcf-89a1-8594272e7c4c}","client_id":"04b07795-8ddb-461a-bbee-02f9e1bf7b46","ccs_failover_v2":"1.P","cache_event_count":0,"broker_version":"10.0.26100.7462","authority":"https://login.microsoftonline.com/organizations","api_error_code":0,"account_join_on_start":"primary","account_join_on_end":"primary","account_id":"2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db"},"silent_status":0,"is_cached":1}
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: tenant_id, Value: 72f988bf-86f1-41af-91ab-2d7cd011db47
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: normalized_realm, Value: 72f988bf-86f1-41af-91ab-2d7cd011db47
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: write_token, Value: AT|ID
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: storage_write, Value: DAT|DID|DAC
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: storage_read, Value: DAC|DAC
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: is_successful, Value: true
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: authorization_type, Value: Interactive
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: api_error_context, Value: PII logging enabled on client.
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: transfer_token_error, Value: PII logging enabled on client.
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: server_suberror_code, Value: PII logging enabled on client.
msal.broker: [MSAL:0003] INFO LogTelemetryData:472 Key: request_duration, Value: 2627
msal.broker: [MSAL:0003] INFO LogTelemetryData:477 Printing Execution Flow:
msal.broker: [MSAL:0003] INFO LogTelemetryData:485 {"t":"646u1","tid":2,"ts":0,"l":2},{"t":"4s7ub","tid":2,"ts":5,"l":2},{"t":"4sufd","tid":2,"ts":5,"s":2,"l":2},{"t":"4swgg","tid":2,"ts":5,"s":1,"l":2},{"t":"4swgf","tid":2,"ts":5,"s":1,"l":2},{"t":"4swgi","tid":3,"ts":7,"s":1,"l":2},{"t":"8dqim","tid":3,"ts":7,"l":2},{"t":"8dqkl","tid":3,"ts":9,"l":2,"a":9,"ie":0},{"t":"4ly8o","tid":3,"ts":10,"l":2},{"t":"54uxe","tid":2,"ts":10,"l":2},{"t":"4wqm9","tid":4,"ts":2508,"l":2},{"t":"4o9ak","tid":4,"ts":2509,"l":2},{"t":"4o9ai","tid":4,"ts":2513,"l":2},{"t":"8dql1","tid":4,"ts":2536,"l":2},{"t":"4qopb","tid":4,"ts":2536,"l":2},{"t":"8dqkn","tid":4,"ts":2536,"l":2,"a":5,"ie":1},{"t":"8dqko","tid":4,"ts":2536,"l":2,"a":9,"ie":1},{"t":"8dqkr","tid":4,"ts":2536,"l":2},{"t":"4sufd","tid":4,"ts":2536,"s":2,"l":2},{"t":"4swgg","tid":4,"ts":2536,"s":2,"l":2},{"t":"4swgf","tid":4,"ts":2536,"s":1,"l":2},{"t":"4swgi","tid":3,"ts":2536,"s":2,"l":2},{"t":"8b2yn","tid":3,"ts":2536,"l":2},{"t":"8dqlh","tid":3,"ts":2537,"l":2},{"t":"8dqli","tid":3,"ts":2537,"l":2},{"t":"8dqln","tid":3,"ts":2537,"l":2},{"t":"4qnnm","tid":3,"ts":2537,"l":2,"a":3,"ie":0},{"t":"4myjh","tid":3,"ts":2567,"l":2},{"t":"4myjg","tid":3,"ts":2572,"l":2},{"t":"4myjf","tid":3,"ts":2573,"l":2},{"t":"4myjh","tid":3,"ts":2588,"l":2},{"t":"4myjg","tid":3,"ts":2589,"l":2},{"t":"4myjf","tid":3,"ts":2590,"l":2},{"t":"4qnnl","tid":3,"ts":2590,"l":2,"a":3,"ie":1},{"t":"4qnng","tid":3,"ts":2590,"l":2,"a":2,"ie":0},{"t":"4qnnf","tid":3,"ts":2609,"l":2,"a":2,"ie":1},{"t":"4gom3","tid":3,"ts":2609,"l":2},{"t":"4gf3z","tid":3,"ts":2609,"l":2},{"t":"4qnng","tid":3,"ts":2610,"l":2,"a":2,"ie":0},{"t":"4qnnf","tid":3,"ts":2612,"l":2,"a":2,"ie":1},{"t":"4qnne","tid":3,"ts":2612,"l":2,"a":3,"ie":0},{"t":"4myjh","tid":3,"ts":2612,"l":2},{"t":"4myjg","tid":3,"ts":2614,"l":2},{"t":"4myjf","tid":3,"ts":2614,"l":2},{"t":"4qnnd","tid":3,"ts":2614,"l":2,"a":3,"ie":1},{"t":"6xuag","tid":3,"ts":2614,"l":2},{"t":"4waym","tid":3,"ts":2614,"l":2},{"t":"6oeqy","tid":3,"ts":2623,"l":2}
msal.token_cache: event={
"_account_id": "2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db",
"client_id": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"data": {},
"environment": "login.microsoftonline.com",
"grant_type": "broker",
"response": {
"_account_id": "2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db",
"_msalruntime_telemetry": {
"DATA LIMITED": "Full MSALRuntime telemetry not yet implemented",
"api_error_context": "Error context redacted, value may be written to log.",
"api_name": "SignInInteractively",
"broker_app_used": "true",
"client_id": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"correlation_id": "cc12a77b-e8db-4457-b85d-3b779b739d93",
"is_successful": "true",
"msal_version": "9.0.0",
"msalruntime_version": "0.20.2"
},
"access_token": "",
"client_info": "eyJ1aWQiOiIyZTc0ZGZlNC1iZDlhLTRjMjktOGZiZC1iMzBiZjlmYjczZGIiLCJ1dGlkIjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjQ3IiwiY2xvdWRfaW5zdGFuY2VfbmFtZSI6Im1pY3Jvc29mdG9ubGluZS5jb20iLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJrdW9qaWFubHVAbWljcm9zb2Z0LmNvbSJ9",
"expires_in": 4640,
"id_token": "",
"id_token_claims": "********",
"scope": "https://management.core.windows.net//user_impersonation https://management.core.windows.net//.default",
"token_type": "bearer"
},
"scope": [
"https://management.core.windows.net//user_impersonation",
"https://management.core.windows.net//.default"
],
"token_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/token"
}
Retrieving tenants and subscriptions for the selection...
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/organizations
msal.authority: openid_config("https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/organizations/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/organizations/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/organizations/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/organizations/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': None, 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 1a4c442a-6cce-4800-9959-5a1c33a64bff
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/tenants?api-version=2022-12-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '2f626788-1930-11f1-b5f9-b047e9feece0'
cli.azure.cli.core.sdk.policies: 'CommandName': 'login'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.83.0 (MSI) azsdk-python-core/1.38.0 Python/3.13.11 (Windows-11-10.0.26200-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /tenants?api-version=2022-12-01 HTTP/1.1" 200 7877
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '7877'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-tenant-reads': '2199'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'dfa50153-3b79-4463-9ffe-fb0d098771cb'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'dfa50153-3b79-4463-9ffe-fb0d098771cb'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'JAPANEAST:20260306T074344Z:dfa50153-3b79-4463-9ffe-fb0d098771cb'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: EF436C9D3A6940F3AA1D39737E58C5BF Ref B: TYO201100117045 Ref C: 2026-03-06T07:43:43Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Fri, 06 Mar 2026 07:43:44 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"value":[{"id":"/tenants/72f988bf-86f1-41af-91ab-2d7cd011db47","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","countryCode":"US","displayName":"Microsoft","domains":["drawbridge.com","expresslogic.com","euevents.microsoft.com","nonprofits.microsoft.com","benefits.microsoft.com","forzaesports.com","bons.ai","azmosa.io","fslogix.com","Howdy.ai","Xoxco.com","Botkit.ai","glintinc.com","maquette.ms","tibazdev.microsoft.com","mail.appcenter.ms","Hexadite.com","lobe.ai","appcenter.ms","github.com","gearspop.com","messages.microsoft.com","flipgrid.com","semanticmachines.com","video2brain.com","averesystems.com","initiativegaming.com","mail1.averesystems.com","seaofthieves.com","Intentional.com","m12.vc","email.bing.com","playfab.com","itsm.microsoft.com","Windows.mail.microsoft.com","smtphost.microsoft.com","exmail.microsoft.com","altvr.com","altspacevr.com","corp.microsoft.com","cyclecomputing.com","cloudyn.com","nuget.org","microsoftsmarthq.com.au","lockbox.microsoft.com","acompli.com","domains.microsoft","service.linkedin.com","microsoft.com","eventscommunication.microsoft.com","deis.com","Lynda.com","Newsle.com","linkedin.com","myemailing.microsoft.com","maluuba.com","internal.linkedin.cn","linkedin.biz","microsoftcan.onmicrosoft.com","educatorcommunity.microsoft.com","simplygon.com","MicrosoftAPC.onmicrosoft.com","messages2.microsoft.com","MicrosoftEur.onmicrosoft.com","security.microsoft.com","robovm.com","solaircorporate.com","azureemail.microsoft.com","genee.me","microsoftstudios.com","bing.com","corp.webtv.net","HaloWaypoint.com","musiwave.com","ntdev.corp.microsoft.com","redmond.corp.microsoft.com","europe.corp.microsoft.com","middleeast.corp.microsoft.com","exchange.corp.microsoft.com","southamerica.corp.microsoft.com","fareast.corp.microsoft.com","winse.corp.microsoft.com","mslpa.corp.microsoft.com","africa.corp.microsoft.com","ntdev.microsoft.com","wingroup.windeploy.ntdev.microsoft.com","southpacific.corp.microsoft.com","segroup.winse.corp.microsoft.com","northamerica.corp.microsoft.com","service.microsoft.com","exchange.microsoft.com","xbox.com","zune.net","msg.microsoft.com","titanium.microsoft.com","microsoft.mail.onmicrosoft.com","filtering.exchange.microsoft.com","skype.net","hybrid.microsoft.com","fbt.microsoft.com","ageofempiresonline.com","yammer-inc.com","service.fbt.microsoft.com","service.exchange.microsoft.com","office365.microsoft.com","crm.microsoft.com","mssales.microsoft.com","mssupport.microsoft.com","smc.microsoft.com","sharepointjournaling.exchange.microsoft.com","wingroup.microsoft.com","managed.microsoft.com","serivce.exchange.microsoft.com","primary.exchange.microsoft.com","filtering.service.exchange.microsoft.com","pioneer.exchange.microsoft.com","wmislabcon01.redmond.corp.microsoft.com","winfarmmail.ntdev.corp.microsoft.com","WOSTIX-TEST.NTDEV.corp.microsoft.com","SPSDOG4-27.redmond.corp.microsoft.com","SPSDOG4-34.redmond.corp.microsoft.com","spsdog4-16.redmond.corp.microsoft.com","cyrusb-z400.redmond.corp.microsoft.com","MOSSDOG2982.redmond.corp.microsoft.com","osgwebindex.redmond.corp.microsoft.com","wostcktiis01.redmond.corp.microsoft.com","osgemail.redmond.corp.microsoft.com","extranettest.microsoft.com","pssupport.microsoft.com","extranet.microsoft.com","munich.microsoft.com","news.microsoft.com","mpsd.microsoft.com","gmo.microsoft.com","ims.microsoft.com","partners.extranet.microsoft.com","parttest.extranettest.microsoft.com","placeware.com","nokia.microsoft.com","winse.microsoft.com","surface.com","rare.co.uk","mds.microsoft.com","mail.microsoft.com","mailflowtest.mail.microsoft.com","aspproject.nl","ageofempires.com","azure.com","fast.no","microsoft.co.nz","live.co.hu","groupme.com","fastsearch.com","microsoft.tm.hu","microsoft.ccsctp.com","perceptivepixel.com","marketingpilot.com","phonefactor.com","lucernepublishing.com","vexcel.co.at","vexscan.com","qik.com","musiwave.net","skype.com","slimbezig.nl","groove.net","008.mgd.microsoft.com","vexcel.at","windowslive.co.hu","xbox360.co.hu","xbox.co.hu","microsoft.eu","Storesimple.com","Phonefactor.net","microsoft.onmicrosoft.com","zone.com","view012.de","css.one.microsoft.com","proclarity.com","rareware.com","mgd.microsoft.com","064d.mgd.microsoft.com","bingnews.microsoft.com","api.yammer.com","email.microsoft.com","officelabs.microsoft.com","Codenauts.com","codenauts.de","Hockeyapp.com","qa2.parature.net","componentart.com","datazen.com","nuvolarosa.eu","bayiportali.mmdservice.com","inside-r.org","incentgames.com","doublelabs.com","Fantasysalesteam.com","clickdimensions.Microsoft.com","volometrix.com","bluestripe.com","time.microsoft.com","revolutionanalytics.com","inside-r.com","revolution-computing.com","fieldone.com","Pioneerinteractive.com","msitsupp.microsoft.com","adxstudio.com","Havok.com","Trinigy.net","Projectanarchy.com","Rocketbox.de","cloudappsecurity.com","email-2.microsoft.com","Swiftkey.com","Swiftkey.net","msfts2.onmicrosoft.com","msfts2.mail.onmicrosoft.com","Xamarin.com","secureislands.com","gears.gg","promoteiq.com","sangamemail.microsoft.com","preonboarding.microsoft.com","microsoftprd.onmicrosoft.com","bluetalon.com","citusdata.com","spotfront.com","dcat.microsoft.com","jclarity.com","msftdomains.microsoft.com","msra.microsoft.com","sales.microsoft.com","askhr.microsoft.com","idwebmail.microsoft.com","movere.io","Unifiedlogic.com","mover.io","msads.microsoft.com","winautomation.com","softomotive.com","wsus.ci-fx.microsoft.com","gta.microsoft.com","email2.microsoft.com","cloudtest.microsoft.com","cyberx-labs.com","elk-vepc-mon.microsoft.com","pgsurvey.microsoft.com","tex.quantum.microsoft.com","healthcheck.microsoft.com","TransportInAzure.microsoft.com","robin-language.org","githubenterprise.microsoft.com","azcis.microsoft.com","microsoft.affirmednetworks.com","msconnectmail.microsoft.com","mojang.com","affirmedNetworks.com","dmarc.microsoft","stock.microsoft.com","groups.metaswitch.com","e-mail.microsoft.com","bounce.e-mail.microsoft.com","themarsdengroup.com","globalmobility.microsoft.com","clearui.com","clearsoftware.com","surveys.microsoft.com","commuteconnection.linkedin.com","sap.microsoft.com","mail.support.microsoft.com","trp.microsoft.com","erpsystem.microsoft.com","p5cdn.com","peer5.com","azns.microsoft.com","vc.linkedin.com","cloudknox.io","aka.ms","communitysift.com","2hatsecurity.com","ezscans.net","bookings.microsoft.com","communities.linkedin.com","xandr.com","contractors.xandr.com","kinvolk.io","clipchamp.com","ally.io","fungible.com","lumenisity.com","transporttest.linkedin.com","arg-int.core.windows.net","cmms.microsoft.com","trafbiz.com","msexperience.microsoft.com","certifications.microsoft.com","give.microsoft.com","cgatemx.linkedin.com","riskiq.microsoft.com","minit.io","glint.microsoft.com","adagencytrainings.microsoft.com","riskiq.net","riskiq.com","msdgovernance.microsoft.com","mlnom.microsoft.com","nu.microsoft.com","npe.itsm.microsoft.com","emc.microsoft.com","silicon.microsoft.com","research-ops.linkedin.com","saprise.microsoft.com","microsoft4-corp-us.tao-globalvoice.com","microsoft4-corp-us2.tao-globalvoice.com","takelessons.com","brinqa.github.com","feedback.github.com","support.github.com","wombat.github.com","github.partners","github.security","githubsupport.com","thegithubshop.com","npm.red","npmjs.com","withpi.ai"],"tenantCategory":"Home","defaultDomain":"microsoft.onmicrosoft.com","tenantType":"AAD","tenantBrandingLogoUrl":"https://aadcdn.msftauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089"},{"id":"/tenants/1a092f68-5741-455a-8057-2acdb897a850","tenantId":"1a092f68-5741-455a-8057-2acdb897a850","countryCode":"US","displayName":"HMGAdmin","domains":["hmgadmin.onmicrosoft.com","hmgadmin.hive.msft.net","expansion.microsoft.com"],"tenantCategory":"Home","defaultDomain":"expansion.microsoft.com","tenantType":"AAD"}]}
cli.azure.cli.core._profile: Finding subscriptions under tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft'
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47
msal.authority: openid_config("https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': 'WW', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.broker: [MSAL:0005] ERROR ErrorInternalImpl:134 Created an error: 5vt4a, StatusInternal::AccountNotFound, InternalEvent::None, Error Code 0, Context 'Account with id '2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db' not found'
msal.broker: [MSAL:0005] INFO LogTelemetryData:464 Printing Telemetry for Correlation ID: ad0ad421-d90b-4035-861f-217a789bc806
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: start_time, Value: 2026-03-06T07:43:42.000Z
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: api_name, Value: ReadAccountById
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: was_request_throttled, Value: false
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: authority_type, Value: Unknown
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: msal_version, Value: 9.0.0
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: correlation_id, Value: ad0ad421-d90b-4035-861f-217a789bc806
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: broker_app_used, Value: false
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: stop_time, Value: 2026-03-06T07:43:42.000Z
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: all_error_tags, Value: 5vt4a
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: msalruntime_version, Value: 0.20.2
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: api_error_code, Value: 0
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: server_suberror_code, Value: PII logging enabled on client.
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: api_error_tag, Value: 5vt4a
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: api_status_code, Value: StatusInternal::AccountNotFound
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: api_error_context, Value: PII logging enabled on client.
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: is_successful, Value: false
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: transfer_token_error, Value: PII logging enabled on client.
msal.broker: [MSAL:0005] INFO LogTelemetryData:472 Key: request_duration, Value: 0
msal.broker: read_account_by_id() error: {'error': 'broker_error', 'error_description': "Account with id '2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db' not found. Status: Response_Status.Status_AccountNotFound, Error code: 0, Tag: 525678464", '_broker_status': <Response_Status.Status_AccountNotFound: 16>, '_broker_error_code': 0, '_broker_tag': 525678464}
msal.application: Found 0 RTs matching {'environment': 'login.microsoftonline.com', 'home_account_id': '.72f988bf-86f1-41af-91ab-2d7cd011db47', 'client_id': '04b07795-8ddb-461a-bbee-02f9e1bf7b46'}
cli.azure.cli.core._profile: Authentication failed against tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft': Can't find token from MSAL cache.
cli.azure.cli.core._profile: Finding subscriptions under tenant 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850
msal.authority: openid_config("https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/1a092f68-5741-455a-8057-2acdb897a850/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/1a092f68-5741-455a-8057-2acdb897a850/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.broker: [MSAL:0006] ERROR ErrorInternalImpl:134 Created an error: 5vt4a, StatusInternal::AccountNotFound, InternalEvent::None, Error Code 0, Context 'Account with id '2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db' not found'
msal.broker: [MSAL:0006] INFO LogTelemetryData:464 Printing Telemetry for Correlation ID: 9a129cf9-3d65-446a-8f9a-464223134f38
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: start_time, Value: 2026-03-06T07:43:42.000Z
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: api_name, Value: ReadAccountById
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: was_request_throttled, Value: false
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: authority_type, Value: Unknown
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: msal_version, Value: 9.0.0
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: correlation_id, Value: 9a129cf9-3d65-446a-8f9a-464223134f38
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: broker_app_used, Value: false
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: stop_time, Value: 2026-03-06T07:43:42.000Z
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: all_error_tags, Value: 5vt4a
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: msalruntime_version, Value: 0.20.2
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: api_error_code, Value: 0
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: server_suberror_code, Value: PII logging enabled on client.
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: api_error_tag, Value: 5vt4a
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: api_status_code, Value: StatusInternal::AccountNotFound
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: api_error_context, Value: PII logging enabled on client.
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: is_successful, Value: false
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: transfer_token_error, Value: PII logging enabled on client.
msal.broker: [MSAL:0006] INFO LogTelemetryData:472 Key: request_duration, Value: 0
msal.broker: read_account_by_id() error: {'error': 'broker_error', 'error_description': "Account with id '2e74dfe4-bd9a-4c29-8fbd-b30bf9fb73db' not found. Status: Response_Status.Status_AccountNotFound, Error code: 0, Tag: 525678464", '_broker_status': <Response_Status.Status_AccountNotFound: 16>, '_broker_error_code': 0, '_broker_tag': 525678464}
msal.application: Found 0 RTs matching {'environment': 'login.microsoftonline.com', 'home_account_id': '*****.72f988bf-86f1-41af-91ab-2d7cd011db47', 'client_id': '04b07795-8ddb-461a-bbee-02f9e1bf7b46'}
cli.azure.cli.core._profile: Authentication failed against tenant 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin': Can't find token from MSAL cache.
cli.azure.cli.core._profile: If you need to access subscriptions in the following tenants, please use az login --tenant TENANT_ID.
cli.azure.cli.core._profile: 72f988bf-86f1-41af-91ab-2d7cd011db47 'Microsoft'
cli.azure.cli.core._profile: 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 669, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 737, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 706, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/profile/custom.py", line 192, in login
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/_profile.py", line 207, in login
knack.util.CLIError: No subscriptions found for [REDACTED:email_address].
cli.azure.cli.core.azclierror: No subscriptions found for [REDACTED:email_address].
az_command_data_logger: No subscriptions found for [REDACTED:email_address].
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x000001A7B58658A0>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 6.438 seconds (init: 0.800, invoke: 5.638)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4519 in cache file under C:\Users\kuojianlu.azure\telemetry\20260306154342702
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry_init_.pyc C:\Users\kuojianlu.azure C:\Users\kuojianlu.azure\telemetry\20260306154342702"
telemetry.process: Return from creating process 32488
telemetry.main: Finish creating telemetry upload process.
Expected behavior
az login should work well.
Environment Summary
azure-cli 2.83.0
core 2.83.0
telemetry 1.1.0
Dependencies:
msal 1.35.0b1
azure-mgmt-resource 23.3.0
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\kuojianlu.azure'
Extensions directory 'C:\Users\kuojianlu.azure\cliextensions'
Python (Windows) 3.13.11 (tags/v3.13.11:6278944, Dec 5 2025, 16:26:58) [MSC v.1944 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
Additional context
No response
Activity
azure-client-tools-bot-prd commentedon Mar 6, 2026
Hi Kuojian Lu (@kuojianlu),
2.83.0 is not the latest Azure CLI(2.84.0).
If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.
yonzhan commentedon Mar 6, 2026
Thank you for opening this issue, we will look into it.
kuojianlu commentedon Mar 6, 2026
I've upgraded to the latest (2.84.0), but it does not solve the problem.
18 remaining items
fpejril commentedon Jun 18, 2026
Not sure who this may help, but I just helped a user in my org troubleshoot the same, and what I found worked for them is to disable the Web Account Manager (WAM) sign-in to fall-back to authenticating in the browser (from the debug logs, the correlates to logs indicating
msal.application: Broker enabled? True).My finding from the debug logs was that the WAM broker was able to retrieve the token and tenant configuration, but not subscriptions -- hitting an error like
Account with id '<USER_UUID>' not found.From Sign in with Web Account Manager (WAM) on Windows | Sign into Azure interactively using the Azure CLI:
teresaritorto commentedon Jun 19, 2026
Thanks for additional information - this will help us troubleshoot further.
Yeming Liu (@isra-fel) - We need to look into Azure CLI account/tenant/realm inputs into MSALcache lookup as scenarios being described here is causing this lookup to fail
microsoft-github-policy-service commentedon Jun 29, 2026
🔔 Routing this issue to @act-identity-squad.
tgrue-openai commentedon Jul 20, 2026
Adding info that I was also seeing this issue, but on Mac (back in May). I haven't seen this issue super recently myself, but I changed my usage pattern of
az loginso I assume I'm just not triggering the conditions that cause a problem recently.foaudkajj commentedon Jul 22, 2026
finally the method that worked for me after days of suffering.
thanks Frank Pejril (@fpejril)
x-engineering-agent commentedon Aug 24, 2026
Automated sensitive-information remediation ran on this issue.
[REDACTED:category]placeholders in: issue descriptionIf a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.
✅ Confirm the finding · ❌ Dispute the finding
GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.
microsoft-github-policy-service commentedon Sep 2, 2026
🔔 Routing this issue to @Azure/act-identity-squad.
sidestepinstructor commentedon Sep 19, 2026
Short version: your local machine’s Azure CLI is holding stale or corrupted MSAL tokens, so it can’t authenticate to those tenants—even though Dev Box works and az login --tenant … works manually. The fix is to reset the local MSAL cache, verify your identity settings, and ensure your Azure CLI is using the correct account.
Below is the exact sequence that reliably fixes this problem.
✅ Why this is happening
Azure CLI stores tokens in a local MSAL cache:
Windows:
%LOCALAPPDATA%.IdentityService\msal.cache
%USERPROFILE%.azure\msal_token_cache.json
If these files contain:
expired tokens
tokens issued for a different identity
tokens tied to a different home tenant
tokens created before an Azure CLI upgrade
…then az account list and tenant discovery will fail with:
Can't find token from MSAL cache
Your Dev Box works because it has a clean, consistent identity environment.
Your local machine does not.
✅ Fix #1 — FULL Azure CLI cache reset
Run these commands in order:
powershell
az account clear
powershell
del %USERPROFILE%.azure\msal_token_cache.json
del %USERPROFILE%.azure\azureProfile.json
powershell
net stop MicrosoftIdentityService
del %LOCALAPPDATA%.IdentityService\msal.cache
net start MicrosoftIdentityService
powershell
az login --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
Then verify:
powershell
az account list --output table
If subscriptions appear → problem solved.
✅ Fix #2 — Force Azure CLI to use the correct tenant
Sometimes Azure CLI defaults to your home tenant, not the one you need.
Set the tenant explicitly:
powershell
az login --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
az account set --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
Then check:
powershell
az account show
✅ Fix #3 — Check if your local machine is using a different identity
Your Dev Box may be logged in with your corporate identity, while your local machine is logged in with a personal Microsoft account.
Check what Azure CLI thinks your identity is:
powershell
az ad signed-in-user show
If this fails or shows the wrong account → you’re logged in with the wrong identity.
Log out fully:
powershell
az logout
az login
Make sure the browser login prompt shows the correct account.
✅ Fix #4 — Remove cached Windows Web Account Manager (WAM) tokens
Azure CLI on Windows uses WAM unless disabled.
Reset WAM tokens:
Windows Settings → Accounts → Email & Accounts
Remove any Microsoft personal accounts
Keep only your work account
Reboot
Run:
powershell
az login
🧪 Diagnostic commands
Run these to see exactly what Azure CLI is doing:
Check tenants Azure CLI sees:
powershell
az account tenant list --output table
Check subscriptions:
powershell
az account list --output table
Check MSAL cache health:
powershell
az account get-access-token --resource https://management.azure.com/
If this fails → MSAL cache is corrupted.
x-engineering-agent commentedon Oct 15, 2026
X Engineering Agent Bug Analysis
Confidence: Low (0.40)
Below is my analysis of this issue:
Summary
az logincompletes interactive sign-in but then fails tenant subscription discovery with "Can't find token from MSAL cache". Some reporters can sign in to an explicit tenant yet cannot obtain tokens for non-ARM scopes. This failure does not establish that their accounts have no subscriptions.Likely root cause
The confirmed boundary is silent token acquisition after account selection. Tenant enumeration builds a credential for each concrete tenant; UserCredential selects an MSAL account by username and requests the given scopes through acquire_token_silent_with_error. check_result maps an empty result to the reported cache error. A tenant/account/realm mismatch or broker cache-state issue is plausible, but which input or MSAL behavior is wrong remains unconfirmed.
Affected code
src/azure-cli-core/azure/cli/core/_profile.py›SubscriptionFinder.find_using_common_tenant(line 821)src/azure-cli-core/azure/cli/core/auth/msal_credentials.py›UserCredential.acquire_token(line 47)src/azure-cli-core/azure/cli/core/auth/util.py›check_resultRuled out
Proposed change
Leave authentication behavior unchanged until the identity owning squad verifies the selected account, authority tenant/realm and scopes passed to MSAL in an affected session. Coordinate with MSAL maintainers without logging token material. Correct only a confirmed credential-input mismatch; otherwise route a verified MSAL/broker defect upstream. No speculative automated fix is queued.
Workaround
Where organizational policy permits, commenters report using
az account clear,az config set core.enable_broker_on_windows=false, thenaz loginto switch to browser authentication. This is not verified for every report.Technical details
Evidence
_profile.py:845-858constructs tenant-specific credentials and catches AuthenticationError while listing subscriptions, matching the reported tenant warning.msal_credentials.py:35-44,76-96selects an account, attempts silent acquisition and propagates ordinary authentication errors. The supplied non-ARM token traceback reaches this path and check_result.Test plan
Once the mechanism is established, add credential and tenant-discovery regressions for organizations-to-concrete-tenant acquisition, ARM/non-ARM scopes, empty silent results, multiple-account rejection and claims/MFA propagation. Verify the original failing scope on affected Windows WAM and browser sessions; mocked tests alone cannot prove broker cache behavior.
Generated code: Handwritten code. The traced CLI boundary is handwritten
_profile.pyandauth/*.py, outside generated AAZ/SDK output. Underlying MSAL/broker ownership remains unresolved.Out of scope: Maintainer-led identity investigation is already present. Do not reopen reporter questions or change account/cache fallbacks without a confirmed mechanism.
Live reproduction (BAMI sandbox) — Inconclusive
Verdict: Inconclusive: the sandbox could not run the reproduction to the end.
Reason: the sandbox identity cannot sign in to or access the resources involved.
The analysis above is based on reading the code only, so its confidence is capped at low.
Commands ran in an isolated Azure sandbox subscription from a validated ReproSpec; output is redacted.
Posted by x-engineering-agent (Fixer)