Azure / Azure/azure-powershell

Connect-AzAccount: "The term 'Connect-AzAccount' is not recognized as a name of a cmdlet" when run as a non-root user in Azure DevOps

Open
#19,177 6 comments 0 reactions 0 assignees View on GitHub
Accounts bug customer-reported needs-team-attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Azure DevOps uses the `vsts_azpcontainer` user which it directly injects into the container at run-time.

This breaks the build as the module seems to have moved from `/usr/local/share/powershell/Modules` to `/root/.local/share/powershell/Modules` which obviously can't be accessed by non-root users.

The container that works:
![image](https://user-images.githubusercontent.com/2286713/183404111-e35665f8-e593-406b-b688-626b79d3ac54.png)

The container that doesn't:
![image](https://user-images.githubusercontent.com/2286713/183404410-674990fd-151a-4f93-b174-9016443436b2.png)

As you'll see the location, of the module has moved which breaks non-root users such as those injected by Azure DevOps:
![image](https://user-images.githubusercontent.com/2286713/183404665-4712d0a3-fb3a-48d7-9118-50a3c09f56ec.png)

This appears similar to #18928 but I'm not sure it it's the same cause.

SHA of an image that worked and didn't:
✅: `sha256:163586739f74a02282a4c2b7f12805b596d6ada983a0ff729196af18ec8c823a`
❌: `sha256:d7da797d627a135b31acb15329c8a949f06caa963e7c99fc04e63b70d839df75`

### Issue script & Debug output

```PowerShell
set-pwsh-az-context.ps1: /__w/_temp/fe2972d1-5061-468f-a7ba-0d58d439707f.ps1:2
Line |
2 | . '/__w/1/pipeline-scripts/Azure/set-pwsh-az-context.ps1' -clientID ' …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| The term 'Connect-AzAccount' is not recognized as a name of a
| cmdlet, function, script file, or executable program. Check
| the spelling of the name, or if a path was included, verify
| that the path is correct and try again.

##[error]PowerShell exited with code '1'.
```

`set-pwsh-az-context.ps1`:
```pwsh
param(
[Parameter(Mandatory = $true)]
[string]
$clientID,

[Parameter(Mandatory = $true)]
[string]
$clientSecret,

[Parameter(Mandatory = $true)]
[string]
$tentantID,

[Parameter(Mandatory = $true)]
[string]
$subscriptionID
)

Import-Module -Name Az

$secureClientSecret = ConvertTo-SecureString -String $clientSecret -AsPlainText -Force
$pscredential = New-Object System.Management.Automation.PSCredential($clientID, $secureClientSecret)
Connect-AzAccount -ServicePrincipal -Credential $pscredential -Tenant $tentantID -Subscription $subscriptionID
```

The `Import-Module -Name Az` was added to see if trying to import it would work, but it doesn't as the user doesn't have access to `/root` where the module now resides.

### Environment data

Tag was `latest` which is how we noticed the problem, the SHA that doesn't work is: `sha256:d7da797d627a135b31acb15329c8a949f06caa963e7c99fc04e63b70d839df75`

### Module versions

```PowerShell
PS /> Import-Module Az
PS /> Get-Module Az*

ModuleType Version PreRelease Name ExportedComman
ds
---------- ------- ---------- ---- --------------
Script 8.2.0 Az
Script 2.9.1 Az.Accounts {Add-AzEnviro…
Script 1.1.2 Az.Advisor {Disable-AzAd…
Script 4.2.1 Az.Aks {Disable-AzAk…
Script 1.1.4 Az.AnalysisServices {Add-AzAnalys…
Script 3.0.0 Az.ApiManagement {Add-AzApiMan…
Script 1.1.0 Az.AppConfiguration {Get-AzAppCon…
Script 2.1.0 Az.ApplicationInsights {Get-AzApplic…
Script 1.0.0 Az.Attestation {Add-AzAttest…
Script 1.7.3 Az.Automation {Export-AzAut…
Script 3.2.0 Az.Batch {Disable-AzBa…
Script 2.0.0 Az.Billing {Get-AzBillin…
Script 2.1.0 Az.Cdn {Clear-AzCdnE…
Script 1.1.0 Az.CloudService {Get-AzCloudS…
Script 1.11.0 Az.CognitiveServices {Add-AzCognit…
Script 4.30.0 Az.Compute {Add-AzImageD…
Script 1.0.0 Az.ConfidentialLedger {Get-AzConfid…
Script 3.1.0 Az.ContainerInstance {Add-AzContai…
Script 3.0.0 Az.ContainerRegistry {Connect-AzCo…
Script 1.8.2 Az.CosmosDB {Get-AzCosmos…
Script 1.1.0 Az.DataBoxEdge {Get-AzDataBo…
Script 1.2.0 Az.Databricks {Get-AzDatabr…
Script 1.16.8 Az.DataFactory {Add-AzDataFa…
Script 1.0.2 Az.DataLakeAnalytics {Add-AzDataLa…
Script 1.3.0 Az.DataLakeStore {Add-AzDataLa…
Script 1.0.1 Az.DataShare {Get-AzDataSh…
Script 1.1.0 Az.DeploymentManager {Get-AzDeploy…
Script 3.1.0 Az.DesktopVirtualization {Disconnect-A…
Script 1.0.2 Az.DevTestLabs {Get-AzDtlAll…
Script 1.1.2 Az.Dns {Add-AzDnsRec…
Script 1.3.0 Az.EventGrid {Get-AzEventG…
Script 2.2.0 Az.EventHub {Add-AzEventH…
Script 1.9.0 Az.FrontDoor {Disable-AzFr…
Script 4.0.3 Az.Functions {Get-AzFuncti…
Script 5.0.1 Az.HDInsight {Add-AzHDInsi…
Script 2.0.0 Az.HealthcareApis {Get-AzHealth…
Script 2.7.4 Az.IotHub {Add-AzIotHub…
Script 4.6.1 Az.KeyVault {Add-AzKeyVau…
Script 2.1.0 Az.Kusto {Add-AzKustoC…
Script 1.5.0 Az.LogicApp {Get-AzIntegr…
Script 1.1.3 Az.MachineLearning {Add-AzMlWebS…
Script 1.2.0 Az.Maintenance {Get-AzApplyU…
Script 1.0.0 Az.ManagedServiceIdentity {Get-AzSystem…
Script 3.0.0 Az.ManagedServices {Get-AzManage…
Script 1.0.2 Az.MarketplaceOrdering {Get-AzMarket…
Script 1.1.1 Az.Media {Get-AzMediaS…
Script 1.1.3 Az.Migrate {Get-AzMigrat…
Script 3.0.1 Az.Monitor {Add-AzAutosc…
Script 1.0.0 Az.MySql {Get-AzMySqlC…
Script 4.19.0 Az.Network {Add-AzApplic…
Script 1.1.1 Az.NotificationHubs {Get-AzNotifi…
Script 3.1.0 Az.OperationalInsights {Disable-AzOp…
Script 1.5.0 Az.PolicyInsights {Get-AzPolicy…
Script 1.1.0 Az.PostgreSql {Get-AzPostgr…
Script 1.2.0 Az.PowerBIEmbedded {Get-AzPowerB…
Script 1.0.3 Az.PrivateDns {Add-AzPrivat…
Script 5.4.1 Az.RecoveryServices {Add-AzRecove…
Script 1.6.0 Az.RedisCache {Export-AzRed…
Script 1.1.0 Az.RedisEnterpriseCache {Export-AzRed…
Script 1.0.3 Az.Relay {Get-AzRelayA…
Script 1.1.0 Az.ResourceMover {Add-AzResour…
Script 6.1.0 Az.Resources {Export-AzRes…
Script 1.3.0 Az.Security {Add-AzSecuri…
Script 1.1.0 Az.SecurityInsights {Get-AzSentin…
Script 1.10.0 Az.ServiceBus {Add-AzServic…
Script 3.1.0 Az.ServiceFabric {Add-AzServic…
Script 1.4.1 Az.SignalR {Get-AzSignal…
Script 3.11.0 Az.Sql {Add-AzSqlDat…
Script 1.1.0 Az.SqlVirtualMachine {Get-AzAvaila…
Script 1.3.0 Az.StackHCI {Add-AzStackH…
Script 4.8.0 Az.Storage {Add-AzRmStor…
Script 1.7.0 Az.StorageSync {Get-AzStorag…
Script 2.0.0 Az.StreamAnalytics {Get-AzStream…
Script 1.0.0 Az.Support {Get-AzSuppor…
Script 1.5.0 Az.Synapse {Add-AzSynaps…
Script 1.1.0 Az.TrafficManager {Add-AzTraffi…
Script 2.11.3 Az.Websites {Add-AzWebApp…
```

### Error output

```PowerShell
set-pwsh-az-context.ps1: /__w/_temp/fe2972d1-5061-468f-a7ba-0d58d439707f.ps1:2
Line |
2 | . '/__w/1/pipeline-scripts/Azure/set-pwsh-az-context.ps1' -clientID ' …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| The term 'Connect-AzAccount' is not recognized as a name of a
| cmdlet, function, script file, or executable program. Check
| the spelling of the name, or if a path was included, verify
| that the path is correct and try again.

##[error]PowerShell exited with code '1'.
```

Contributor guide

Open the contributing guide

Research direction

Start with the reported set-pwsh-az-context.ps1 script and its Import-Module Az and Connect-AzAccount entry points. Compare the working and failing image SHAs, module locations, and non-root Azure DevOps container behavior. Done means a non-root user can import Az and run Connect-AzAccount successfully in the affected image.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, docker, powershell
Domain
devops, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.