Azure / Azure/azure-cli

Azure CLI commands fail for newly granted subscriptions

Open
#26,887 3 comments 1 reaction 2 assignees Claimed by @jiasli View on GitHub
Account act-identity-squad ARM Auto-Assign Azure CLI Team feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Symptom

Azure CLI commands fail for newly granted subscriptions.

Steps to repro:

1. Run `az login` with a user account or service principal. Azure CLI caches the result of ARM REST API [Subscriptions - List](https://learn.microsoft.com/en-us/rest/api/resources/subscriptions/list?tabs=HTTP) which doesn't contain the new subscription. The cache is saved to `~/.azure/azureProfile.json`.
2. The user account or service principal is granted an RBAC role assignment on a new subscription to which the user account or service principal previously doesn't have access. The subscription can be newly created.
3. Because `az account set/show` and `--subscription` only use subscription information from the local cache, they won't be able to work with that new subscription and show errors.

Different error messages can be shown:

- `az account set --subscription`: https://github.com/Azure/azure-cli/blob/060b414d8ac5e4d8f4fc17cc2e23c2154c762226/src/azure-cli-core/azure/cli/core/_profile.py#L516-L518
- `az account show --subscription`: https://github.com/Azure/azure-cli/blob/060b414d8ac5e4d8f4fc17cc2e23c2154c762226/src/azure-cli-core/azure/cli/core/_profile.py#L552-L554
- `az group show --subscription`: https://github.com/Azure/azure-cli/blob/ce3a1f1ddea0b59f0a5803bb427c55862ccae72b/src/azure-cli-core/azure/cli/core/commands/arm.py#L365-L366

`az account subscription list` is not affected because this command gets the result from ARM API [Subscriptions - List](https://learn.microsoft.com/en-us/rest/api/resources/subscriptions/list?tabs=HTTP), instead of the local cache.

## Solution

The best practice is to have subscriptions' RBAC role assignments granted _before_ running `az login`.

If you have already run `az login`, you may refresh the local cache:

- Option 1: Run `az login` again
- Option 2: Run `az account list --refresh`, but we don't recommend using `--refresh` argument as it is known to be buggy in some edge cases: https://github.com/Azure/azure-cli/issues/20429

## Additional Context

Email: _Regarding issue during Azure ClI_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.