Azure / Azure/azure-cli

[Enhancement Proposal] User and tenant isolation

Open
#15,005 5 comments 7 reactions 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad Feature Candidate feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Issue

Currently, Azure CLI uses `subscriptionId` as the primary key to distinguish between accounts (stored in `~/.azure/azureProfile.json`).

https://github.com/Azure/azure-cli/blob/58c9f78be2db3b7097558cbe76bc8d1ca1d304d6/src/azure-cli-core/azure/cli/core/_profile.py#L399-L405

This causes problem when

1. `az login` is run twice with different accounts that have access to the same subscriptions. The subscriptions listed during the second `az login` will _overwrite_ subscriptions from the first `az login`.
2. A subscription can be accessed in multiple tenants. Only the first occurrence is preserved and all subsequent occurrences are discarded. (#11886)
https://github.com/Azure/azure-cli/blob/58c9f78be2db3b7097558cbe76bc8d1ca1d304d6/src/azure-cli-core/azure/cli/core/_profile.py#L924-L935

## Proposal

1. CLI should use a **combined primary key** or **3-layer structure** which consists of `username + tenant_id + subscription_id`.
2. CLI should support switching users with `az account set --username`.
2. CLI should support switching tenants with `az account set --tenant`.
3. The selected subscription should be saved for each user and each tenant, so that after switching users/tenants, the selected subscription is restored.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.