Azure CLI commands fail for newly granted subscriptions
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Symptom
Azure CLI commands fail for newly granted subscriptions.
Steps to repro:
1. Run `az login` with a user account or service principal. Azure CLI caches the result of ARM REST API [Subscriptions - List](https://learn.microsoft.com/en-us/rest/api/resources/subscriptions/list?tabs=HTTP) which doesn't contain the new subscription. The cache is saved to `~/.azure/azureProfile.json`.
2. The user account or service principal is granted an RBAC role assignment on a new subscription to which the user account or service principal previously doesn't have access. The subscription can be newly created.
3. Because `az account set/show` and `--subscription` only use subscription information from the local cache, they won't be able to work with that new subscription and show errors.
Different error messages can be shown:
- `az account set --subscription`: https://github.com/Azure/azure-cli/blob/060b414d8ac5e4d8f4fc17cc2e23c2154c762226/src/azure-cli-core/azure/cli/core/_profile.py#L516-L518
- `az account show --subscription`: https://github.com/Azure/azure-cli/blob/060b414d8ac5e4d8f4fc17cc2e23c2154c762226/src/azure-cli-core/azure/cli/core/_profile.py#L552-L554
- `az group show --subscription`: https://github.com/Azure/azure-cli/blob/ce3a1f1ddea0b59f0a5803bb427c55862ccae72b/src/azure-cli-core/azure/cli/core/commands/arm.py#L365-L366
`az account subscription list` is not affected because this command gets the result from ARM API [Subscriptions - List](https://learn.microsoft.com/en-us/rest/api/resources/subscriptions/list?tabs=HTTP), instead of the local cache.
## Solution
The best practice is to have subscriptions' RBAC role assignments granted _before_ running `az login`.
If you have already run `az login`, you may refresh the local cache:
- Option 1: Run `az login` again
- Option 2: Run `az account list --refresh`, but we don't recommend using `--refresh` argument as it is known to be buggy in some edge cases: https://github.com/Azure/azure-cli/issues/20429
## Additional Context
Email: _Regarding issue during Azure ClI_
Contributor guide
Assessment
This issue has not been assessed yet.