Azure / Azure/azure-powershell
Get-AzTenant and Get-AzContext not returning tenant name when connecting with a serviceprincipal
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
### Description
Get-AzTenant and Get-AzContext does not return tenant name when connecting with a serviceprincipal. This is similar to those reported on [#10767](https://github.com/Azure/azure-powershell/issues/10767), [#20075](https://github.com/Azure/azure-powershell/issues/20075), and [#22887](https://github.com/Azure/azure-powershell/issues/22887).
I am logging this separately as #22887 has this listed as a feature request, but I believe this to be a bug for three reasons:
1. When connecting use other methods (e.g. interactive logon) with the same permissions applied then the tenant information is returned as expected.
2. Get-AzContext is also not returning the tenant name
3. There isn't a way that I can see to retrieve the tenant name
### Issue script & Debug output
```PowerShell
PS C:\Users\ChrisV> Get-AzTenant -TenantId $tenantId -Debug | Out-File C:\Users\ChrisV\Downloads\aztenant.txt
DEBUG: 17:47:08 - GetAzureRMTenantCommand begin processing with ParameterSet '__AllParameterSets'.
DEBUG: 17:47:08 - using account id 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'...
DEBUG: 17:47:08 - [ConfigManager] Got [False] from [DisplayBreakingChangeWarning], Module = [], Cmdlet = [].
DEBUG: 17:47:08 - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 17:47:08 - [ServicePrincipalAuthenticator] Calling ClientSecretCredential.GetTokenAsync - ApplicationId:'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', TenantId:'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/'
DEBUG: ClientSecretCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] MSAL MSAL.CoreCLR with assembly version '4.56.0.0'. CorrelationId(ccccccc-cccc-cccc-cccc-cccccccccccc)
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] === AcquireTokenForClientParameters ===
SendX5C: False
ForceRefresh: False
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenForClient
IsConfidentialClient - True
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - ccccccc-cccc-cccc-cccc-cccccccccccc
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] === Token Acquisition (ClientCredentialRequest) started:
Scopes: https://management.core.windows.net//.default
Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [Instance Discovery] Instance discovery is enabled and will be performed
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [Region discovery] Not using a regional authority.
DEBUG: Request [dddddddd-dddd-dddd-dddd-dddddddddddd] POST https://login.microsoftonline.com/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/oauth2/v2.0/token
x-client-SKU:REDACTED
x-client-Ver:REDACTED
x-client-CPU:REDACTED
x-client-OS:REDACTED
x-client-current-telemetry:REDACTED
x-client-last-telemetry:REDACTED
x-ms-lib-capability:REDACTED
client-request-id:REDACTED
return-client-request-id:REDACTED
x-app-name:REDACTED
x-app-ver:REDACTED
Content-Type:application/x-www-form-urlencoded
x-ms-client-request-id:dddddddd-dddd-dddd-dddd-dddddddddddd
x-ms-return-client-request-id:true
User-Agent:azsdk-net-Identity/1.10.3 (.NET 8.0.4; Microsoft Windows 10.0.22631)
client assembly: Azure.Identity
DEBUG: Response [dddddddd-dddd-dddd-dddd-dddddddddddd] 200 OK (00.8s)
Cache-Control:no-store, no-cache
Pragma:no-cache
Strict-Transport-Security:REDACTED
X-Content-Type-Options:REDACTED
P3P:REDACTED
client-request-id:REDACTED
x-ms-request-id:eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
x-ms-ests-server:REDACTED
x-ms-clitelem:REDACTED
x-ms-srs:REDACTED
X-XSS-Protection:REDACTED
Set-Cookie:REDACTED
Date:Tue, 23 Apr 2024 15:47:09 GMT
Content-Type:application/json; charset=utf-8
Expires:-1
Content-Length:1473
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] ScopeSet was missing from the token response, so using developer provided scopes in the result.
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Checking client info returned from the server..
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Saving token response to cache..
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [SaveTokenResponseAsync] ID Token not present in response.
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Cannot determine home account id - or id token or no client info and no subject
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [SaveTokenResponseAsync] Saving AT in cache and removing overlapping ATs...
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Looking for scopes for the authority in the cache which intersect with https://management.core.windows.net//.default
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Intersecting scope entries count - 0
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc]
=== Token Acquisition finished successfully:
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] AT expiration time: 2024/04/23 16:47:08 +00:00, scopes: https://management.core.windows.net//.default. source: IdentityProvider
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Fetched access token from host login.microsoftonline.com.
DEBUG: ClientSecretCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId: ExpiresOn: 2024-04-23T16:47:08.7446605+00:00
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
GET
Absolute Uri:
https://management.azure.com/tenants?api-version=2021-01-01
Headers:
Accept-Language : en-US
x-ms-client-request-id : ffffffff-ffff-ffff-ffff-ffffffffffff
Body:
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
OK
Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-ratelimit-remaining-tenant-reads: 11999
x-ms-request-id : gggggggg-gggg-gggg-gggg-gggggggggggg
x-ms-correlation-request-id : gggggggg-gggg-gggg-gggg-gggggggggggg
x-ms-routing-request-id : SOUTHAFRICAWEST:20240423T154713Z:gggggggg-gggg-gggg-gggg-gggggggggggg
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
X-Cache : CONFIG_NOCACHE
X-MSEdge-Ref : Ref A: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH Ref B: IIIIIIIIIIIIIII Ref C: 2024-04-23T15:47:13Z
Date : Tue, 23 Apr 2024 15:47:12 GMT
Body:
{
"value": [
{
"id": "/tenants/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
"tenantId": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
"tenantCategory": "Home"
}
]
}
DEBUG: 17:47:13 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 17:47:13 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 17:47:13 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.Accounts:2.17.0; CommandName: Get-AzTenant; PSVersion: 7.4.2; IsSuccess: True; Duration: 00:00:04.5390424
DEBUG: 17:47:13 - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = [].
DEBUG: 17:47:13 - GetAzureRMTenantCommand end processing.
PS C:\Users\ChrisV> Get-AzContext -Debug
DEBUG: 18:05:32 - GetAzureRMContextCommand begin processing with ParameterSet 'GetSingleContext'.
DEBUG: 18:05:32 - [ConfigManager] Got [False] from [DisplayBreakingChangeWarning], Module = [], Cmdlet = [].
DEBUG: 18:05:32 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 18:05:32 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 18:05:32 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.Accounts:2.17.0; CommandName: Get-AzContext; PSVersion: 7.4.2; IsSuccess: True; Duration: 00:00:00.0037242
DEBUG: 18:05:32 - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = [].
DEBUG: 18:05:32 - GetAzureRMContextCommand end processing.
Tenant: bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
SubscriptionName SubscriptionId Account Environment
---------------- -------------- ------- -----------
jjjjjjjj-jjjj-jjjj-jjjj-jjjjjjjjjjjj AzureCloud
```
### Environment data
```PowerShell
PS C:\Users\ChrisV> $PSVersionTable
Name Value
---- -----
PSVersion 7.4.2
PSEdition Core
GitCommitId 7.4.2
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
PS C:\Users\ChrisV> Get-Module Az.Accounts
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.17.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
```
### Error output
```PowerShell
No error
```
Contributor guide
Research direction
Start by reproducing the service-principal behavior with Get-AzTenant -TenantId and Get-AzContext, using the supplied debug output as a reference. Trace the Az.Accounts cmdlet entry points and ServicePrincipalAuthenticator path; done means both commands return the tenant name consistently with interactive login, with tests covering the reported case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, powershell
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100