Connect-AzAccount failed on a 'job' (start-job) : "ClientCertificateCredential authentication failed: The system cannot find the file specified."

### Description

I'm running job (start-job) to deployed extension on VM. The first step I do is to connect to the tenant and it failed saying he cannot find the SPN certificate "ClientCertificateCredential authentication failed: The system cannot find the file specified."

``` Powershell
Add-AzEnvironment -Name $PlatformCode -ArmEndpoint $Endpoint -errorAction continue -verbose
Connect-AzAccount -ServicePrincipal -ApplicationId $ApplicationId -Environment $PlatformCode -CertificateThumbprint $Thumbprint -tenant $TenantId -errorAction continue -verbose

```

### Issue script & Debug output

```PowerShell
DEBUG: 11:22:36 - GetAzureRMContextCommand end processing.
VERBOSE: Performing the operation "adding environment" on target "myAZS".
DEBUG: 11:22:36 - Autosave setting from startup session: 'Process'
DEBUG: 11:22:36 - No autosave setting detected in environment variable 'AzContextAutoSave'.
DEBUG: 11:22:36 - Using Autosave scope 'Process'
DEBUG: 11:22:36 - Autosave setting from startup session: 'Process'
DEBUG: 11:22:36 - No autosave setting detected in environment variable 'AzContextAutoSave'.
DEBUG: 11:22:36 - Using Autosave scope 'Process'
DEBUG: 11:22:36 - AddAzureRMEnvironmentCommand end processing.
WARNING: INITIALIZATION: Fail to access profile file and will try to use process ContextAutosaveSetting mode. Detailed error: 'The type initializer for 'Microsoft.Azure.Commands.Common.Authentication.ResourceManager.ProtectedFileProvider' threw an exception.'
DEBUG: Sought all Az modules and got latest version 0.0.0
DEBUG: 11:22:36 - ConnectAzureRmAccountCommand begin processing with ParameterSet 'ServicePrincipalCertificateWithSubscriptionId'.
DEBUG: 11:22:36 - Autosave setting from startup session: 'Process'
DEBUG: 11:22:36 - No autosave setting detected in environment variable 'AzContextAutoSave'.
DEBUG: 11:22:36 - Using Autosave scope 'Process'
VERBOSE: Performing the operation "log in" on target "ServicePrincipal account in environment 'myAZS'".
DEBUG: 11:22:36 - Autosave setting from startup session: 'Process'
DEBUG: 11:22:36 - No autosave setting detected in environment variable 'AzContextAutoSave'.
DEBUG: 11:22:36 - Using Autosave scope 'Process'
DEBUG: 11:22:36 - [ServicePrincipalAuthenticator] Calling ClientCertificateCredential.GetTokenAsync - Thumbprint:'fakeThumbprint', ApplicationId:'fakeApplicationId', TenantId:'fakeTenantId', Scopes:'https://management.mystamp.onmicrosoft.com/fakeGUID/.default', AuthorityHost:'https://login.microsoftonline.com/'
DEBUG: ClientCertificateCredential.GetToken invoked. Scopes: [ https://management.mystamp.onmicrosoft.com/fakeGUID/.default ] ParentRequestId:
DEBUG: Request [4bd7b5f4-9960-4b64-80e3-2ada4eb42ee6] GET https://login.microsoftonline.com/common/discovery/instance?api-version=REDACTED&authorization_endpoint=REDACTED
x-client-SKU:REDACTED
x-client-Ver:REDACTED
x-client-CPU:REDACTED
x-client-OS:REDACTED
client-request-id:REDACTED
return-client-request-id:REDACTED
x-app-name:REDACTED
x-app-ver:REDACTED
x-ms-client-request-id:4bd7b5f4-9960-4b64-80e3-2ada4eb42ee6
x-ms-return-client-request-id:true
User-Agent:azsdk-net-Identity/1.4.0-beta.3 (.NET Framework 4.7.3875.0; Microsoft Windows 10.0.17763 )
client assembly: Azure.Identity
DEBUG: Response [4bd7b5f4-9960-4b64-80e3-2ada4eb42ee6] 200 OK (00.1s)
Strict-Transport-Security:REDACTED
X-Content-Type-Options:REDACTED
Access-Control-Allow-Origin:REDACTED
Access-Control-Allow-Methods:REDACTED
client-request-id:REDACTED
x-ms-request-id:REDACTED
x-ms-ests-server:REDACTED
Cache-Control:max-age=86400, private
Content-Type:application/json; charset=utf-8
P3P:REDACTED
Set-Cookie:REDACTED
Date:Wed, 08 Dec 2021 10:22:37 GMT
Content-Length:980
DEBUG: ClientCertificateCredential.GetToken was unable to retrieve an access token. Scopes: [ https://management.mystamp.onmicrosoft.com/fakeGUID/.default ] ParentRequestId: Exception: Azure.Identity.AuthenticationFailedException (0x80131500): ClientCertificateCredential authentication failed: The system cannot find the file specified.

---> System.Security.Cryptography.CryptographicException (0x80070002): The system cannot find the file specified.
DEBUG: Azure.Identity.AuthenticationFailedException: ClientCertificateCredential authentication failed: The system cannot find the file specified.
---> System.Security.Cryptography.CryptographicException: The system cannot find the file specified.

at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)
at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)
at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair()
at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize)
at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey()
at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
at Microsoft.Identity.Client.Platforms.net45.NetDesktopCryptographyManager.SignWithCertificate(String message, X509Certificate2 certificate)
at Microsoft.Identity.Client.Internal.JsonWebToken.Sign(ClientCredentialWrapper credential, Boolean sendCertificate)
at Microsoft.Identity.Client.Internal.Requests.ClientCredentialHelper.CreateClientCredentialBodyParameters(ICoreLogger logger, ICryptographyManager cryptographyManager, ClientCredentialWrapper clientCredential, String clientId, AuthorityEndpoints endpoints, Boolean sendX5C)
at Microsoft.Identity.Client.OAuth2.TokenClient.AddBodyParamsAndHeaders(IDictionary`2 additionalBodyParameters, String scopes)
at Microsoft.Identity.Client.OAuth2.TokenClient.d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.d__20.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.d__13.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.d__0`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Azure.Identity.MsalConfidentialClient.d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Azure.Identity.ClientCertificateCredential.d__22.MoveNext()
--- End of inner exception stack trace ---
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
at Azure.Identity.ClientCertificateCredential.d__22.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.PowerShell.Authenticators.MsalAccessToken.d__33.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Commands.Common.Authentication.Factories.AuthenticationFactory.Authenticate(IAzureAccount account, IAzureEnvironment environment, String tenant, SecureString password, String promptBehavior, Action`1 promptAction, IAzureTokenCache tokenCache, String resourceId)
at Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient.AcquireAccessToken(IAzureAccount account, IAzureEnvironment environment, String tenantId, SecureString password, String promptBehavior, Action`1 promptAction)
at Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient.Login(IAzureAccount account, IAzureEnvironment environment, String tenantId, String subscriptionId, String subscriptionName, SecureString password, Boolean skipValidation, Action`1 promptAction, String name, Boolean shouldPopulateContextList, Int32 maxContextPopulation)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.<>c__DisplayClass111_2.b__5()
at System.Threading.Tasks.Task`1.InnerInvoke()
at System.Threading.Tasks.Task.Execute()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.<>c__DisplayClass111_0.b__1(AzureRmProfile localProfile, RMProfileClient profileClient, String name)
Connect-AzAccount : ClientCertificateCredential authentication failed: The system cannot find the file specified.
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1.17763.2268
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17763.2268
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 1.10.0 Az
Script 2.2.8 Az.Accounts {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount...}
Script 0.11.0 Az.Billing Get-UsageAggregates
Script 3.3.0 Az.Compute {Add-AzContainerServiceAgentPoolProfile, Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAdditionalUnattendContent...}
Script 1.1.0 Az.DataBoxEdge {Get-AzDataBoxEdgeBandwidthSchedule, Get-AzDataBoxEdgeDevice, Get-AzDataBoxEdgeJob, Get-AzDataBoxEdgeOrder...}
Script 0.11.0 Az.Dns {Add-AzDnsRecordConfig, Get-AzDnsRecordSet, Get-AzDnsZone, New-AzDnsRecordConfig...}
Script 1.4.3 Az.EventHub {Add-AzEventHubIPRule, Add-AzEventHubVirtualNetworkRule, Get-AzEventHub, Get-AzEventHubAuthorizationRule...}
Script 0.11.0 Az.IotHub {Add-AzIotHubCertificate, Add-AzIotHubEventHubConsumerGroup, Add-AzIotHubKey, Add-AzIotHubMessageEnrichment...}
Script 0.11.0 Az.KeyVault {Add-AzKeyVaultCertificate, Add-AzKeyVaultCertificateContact, Add-AzKeyVaultKey, Add-AzKeyVaultManagedStorageAccount...}
Script 1.6.0 Az.Monitor {Add-AzAutoscaleSetting, Add-AzLogProfile, Add-AzMetricAlertRule, Add-AzMetricAlertRuleV2...}
Script 1.2.2 Az.Network {Add-AzApplicationGatewayAuthenticationCertificate, Add-AzApplicationGatewayBackendAddressPool, Add-AzApplicationGatewayBackendHttpSettings, Add-AzApp...
Script 0.11.0 Az.Resources {Add-AzADGroupMember, Export-AzResourceGroup, Get-AzADAppCredential, Get-AzADApplication...}
Script 2.6.2 Az.Storage {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolicyAction, Add-AzStorageAccountNetworkRule, Close-AzStorageFileHandle...}
Script 0.11.0 Az.Websites {Edit-AzWebAppBackupConfiguration, Get-AzAppServicePlan, Get-AzAppServicePlanMetrics, Get-AzWebApp...}
```

### Error output

```PowerShell
DEBUG: AzureQoSEvent: CommandName - Connect-AzAccount; IsSuccess - False; Duration - 00:00:00.9826044; Exception - ClientCertificateCredential authentication failed: The system cannot find the file specified.
;
DEBUG: Finish sending metric.
DEBUG: 11:22:38 - ConnectAzureRmAccountCommand end processing.
```