az login opens explorer.exe instead of browser since 2.85.0 #34203

Activity

1. gerhard-strauss-jambit

   added

   bugThis issue requires a change to an existing behavior in the product in order to be resolved.This issue requires a change to an existing behavior in the product in order to be resolved.

   on Oct 9, 2026
2. microsoft-github-policy-service

   added

   customer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.

   Auto-AssignAuto assign by botAuto assign by bot

   Accountaz login/accountaz login/account

   Azure CLI TeamThe command of the issue is owned by Azure CLI teamThe command of the issue is owned by Azure CLI team

   questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as thatThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

   act-identity-squad

   on Oct 9, 2026
3. yonzhan commented on Oct 9, 2026

   

   Yong Zhang (yonzhan)

   on Oct 9, 2026

   Collaborator

   More actions

   Thank you for opening this issue, we will look into it.

   👍React with 👍1Reacted by gerhard-strauss-jambit
4. x-engineering-agent commented on Oct 9, 2026

   

   x-engineering-agentBot

   on Oct 9, 2026 – with X Engineering Agent

   Contributor

   More actions

   Bug Analysis

   The report provides enough information for an implementation attempt; no additional reporter details are required before investigation.

   Reported behavior: On Windows 11 with WSL2 Ubuntu 24.04.5, az login opens File Explorer instead of the authentication page. The reporter identifies 2.85.0 and later as affected and 2.84.0 and earlier as working. The supplied current environment is CLI/core 2.91.0, bundled Linux Python 3.14.7, and MSAL 1.39.0. BROWSER is normally unset, and setting it reportedly does not resolve the issue. These are reported observations, not an independently reproduced cause.

   Expected behavior: Open the interactive sign-in URL in the user's browser, with existing device-code behavior preserved.

   Affected area: The handwritten profile login command and shared core authentication/browser integration in Azure/azure-cli, targeting dev; this is not an extension-routing issue.

   Source evidence and limits

   At inspected dev revision cc010d2104b3ab0089c33fb7eac8816c260a11ac, src/azure-cli-core/azure/cli/core/_profile.py selects the interactive/device-code path and auth/identity.py delegates interactive login to MSAL. Its browser-opening message precedes the launch and is not evidence that a browser opened successfully.

   The separate WSL-aware opener in src/azure-cli-core/azure/cli/core/util.py uses PowerShell with single-quoted, apostrophe-escaped URLs, then falls back to Python's browser opener on OSError. No connection from that utility opener to the inspected MSAL login path was identified. A utility-only change therefore must not be assumed to repair az login.

   The 2.85.0 utility quoting change belongs to security hardening in #32885. Do not revert that protection or assume it caused this symptom. Both inspected 2.84.0 and 2.85.0 Debian build scripts pin Python 3.13.11; the reported release boundary is not proof of a Python 3.14 cause. The exact component that launches Explorer remains to be established. No later CLI-source fix was identified in the inspected login/opener methods. Similarity lookup was unavailable, so no duplicate classification was made.

   Implementation requirements

   • Establish the actual login-to-browser launch boundary and reproduce the faulty selection with deterministic, login-connected regression coverage before changing behavior. Fix that boundary rather than adding an unconnected helper or speculative version-specific workaround.
   • Cover WSL2 with BROWSER unset and set, browser executable paths containing spaces, and complete synthetic OAuth URLs with query parameters, apostrophes, and shell metacharacters. Preserve URL arguments without shell interpolation or command injection; do not log real authorization URLs, tokens, or credentials.
   • Cover unavailable launchers, exceptions, false/nonzero outcomes, and result normalization if the existing utility is reused: its PowerShell path returns an exit status while the generic browser path returns a boolean.
   • Preserve explicit device-code login and native Linux, macOS, and Windows behavior. Avoid a process-global browser override or unrelated authentication changes.
   • Extend the appropriate existing coverage under src/azure-cli-core/azure/cli/core/tests/test_util.py, tests/test_profile.py, and/or auth/tests/test_identity.py. Existing profile tests mock identity, so they alone cannot establish a working launch path. Use the repository's focused core/authentication unit suites and document any real WSL/browser prerequisite that remains unverified.
   • Keep changes scoped to handwritten login/core code unless concrete evidence establishes a packaging or dependency cause. No AAZ model change is presently indicated; do not hand-edit generated artifacts.

   PR title & description format (required)

   This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

   Use this EXACT PR title (copy verbatim, do not reword):

   [Profile] Fix #34203: `az login`: Restore browser-based sign-in on WSL2
   

   Keep the backticks around the command and the Fix #34203: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Profile] prefix, issue link, and backticked command must stay.

   Description — follow the PR template and fill in:

   • Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #34203.
   • Related command — the az ... command this affects.
   • Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
   • Testing Guide — example command(s) showing the fix works.
   • History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Profile] `az <command>`: <note>.
   • Keep the template checklist and tick the items you've satisfied.

   Automation

   A durable Foundry implementation job has been queued with this scope. The exact cause and a working correction remain to be established; this analysis does not claim the issue is fixed.

   Posted by x-engineering-agent (Fixer)
5. Yong Zhang (yonzhan)

   assigned

   Yeming Liu (isra-fel)

   on Oct 9, 2026
6. Yong Zhang (yonzhan)

   removed

   questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as thatThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

   on Oct 9, 2026
7. Yong Zhang (yonzhan)

   added this to the Backlog milestone on Oct 9, 2026
8. isra-fel commented on Oct 13, 2026

   

   Yeming Liu (isra-fel)

   on Oct 13, 2026

   Member

   More actions

   I couldn't reproduce the issue but here's how MSAL (the library used by Azure CLI for auth) opens up the browser:

   1. Try Python's  webbrowser.open(auth_uri)  (respects  $BROWSER ).
   2. If that returns  False  and it detects WSL → try  wslview  (from  wslu ).
   3. If  wslview  is missing/fails → fall back to  explorer.exe  

   I suggest playing with these options to narrow down the problem. For me both $BROWSER and wslview weren't there, but "explorer.exe https://www.bing.com/" did bring up the browser.
9. Yeming Liu (isra-fel)

   added

   questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as thatThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

   and removed

   bugThis issue requires a change to an existing behavior in the product in order to be resolved.This issue requires a change to an existing behavior in the product in order to be resolved.

   on Oct 13, 2026
10. microsoft-github-policy-service commented on Oct 13, 2026

    

    microsoft-github-policy-serviceBot

    on Oct 13, 2026 – with Microsoft GitHub Policy Service

    Contributor

    More actions

    🔔 Routing this issue to @Azure/act-identity-squad.
11. gerhard-strauss-jambit commented on Oct 13, 2026

    

    gerhard-strauss-jambit

    on Oct 13, 2026

    Author

    More actions

    Hi Yeming Liu (@isra-fel)
    i´m not a programmer, but CoPilot provided the following script:

    /opt/az/bin/python3 - <<'PY'
    import subprocess
    import webbrowser
    from unittest.mock import patch
    from msal.oauth2cli import authcode
    
    original_open = webbrowser.open
    original_call = subprocess.call
    
    def trace_open(*args, **kwargs):
        result = original_open(*args, **kwargs)
        print("webbrowser.open returned:", result, flush=True)
        return result
    
    def trace_call(*args, **kwargs):
        print("Launching:", args[0], flush=True)
        try:
            result = original_call(*args, **kwargs)
        except OSError as error:
            print("Launch error:", error, flush=True)
            raise
        print("Process exit code:", result, flush=True)
        return result
    
    with patch.object(webbrowser, "open", trace_open), \
         patch.object(subprocess, "call", trace_call):
        print("MSAL result:", authcode._browse("https://www.bing.com/?a=1&b=2"))
    PY
    

    with 2.84.0 installed, i get this output and bing.com is opend in my browser:

    webbrowser.open returned: False
    Launching: ['powershell.exe', '-NoProfile', '-Command', 'Start-Process "https://www.bing.com/?a=1&b=2"']
    Process exit code: 0
    MSAL result: True
    

    with the current az-cli installed, the explorer.exe opens:

    webbrowser.open returned: False
    Launching: ['wslview', 'https://www.bing.com/?a=1&b=2']
    Launch error: [Errno 2] No such file or directory: 'wslview'
    Launching: ['explorer.exe', 'https://www.bing.com/?a=1&b=2']
    Process exit code: 1
    MSAL result: True
    

    i dont have wslview installed and i dont think i want to because this Projekt is inactive for 2 years (and the Repo is archieved since march 2025). which also makes me question why the msla lib would do that

    this change happend between msal 1.35.0b1 and 1.35.1 and it should be this PR

    but "explorer.exe https://www.bing.com/" did bring up the browser.

    so does for me, but only if the Url does not contain an equal sign
    explorer.exe https://www.bing.com/=
    this opens the explorer