Azure / Azure/azure-cli

[Feature Request] Show object ID of the signed in account

Open
#22,776 6 comments 1 reaction 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad Auto-Assign feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Context

Currently, in order to get the object ID of the signed in account, we have to query Microsoft Graph API:

- User account: `az ad signed-in-user show`
- Service principal account: `az ad sp show`

However, since some tenant (including Microsoft tenant) has Conditional Access policies that block accessing Microsoft Graph with device code (https://github.com/Azure/azure-cli/issues/22629), querying Microsoft Graph API is no longer possible with device code.

## Proposed solutions

The result of

- `az login`
- `az account show`
- `az account list`

can show the object ID decoded from the access token.

We can also add a `--show-claims` parameter to `az account get-access-token`:

```
az account get-access-token --show-claims
```

to decode the access token and show its claims, but his solution is less intuitive.

## Manual solution

Object ID can be manually retrieved from the access token:

```sh
pip3 install --upgrade pyjwt

az account get-access-token --query accessToken --output tsv |
tr -d '\n' |
python3 -c "import jwt, sys; print(jwt.decode(sys.stdin.read(), algorithms=['RS256'], options={'verify_signature': False})['oid'])"
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.