Azure / Azure/azure-powershell

Get-AzTenant and Get-AzContext not returning tenant name when connecting with a serviceprincipal

Open
#24,729 5 comments 2 reactions 0 assignees View on GitHub
Azure PS Team bug customer-reported
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

Get-AzTenant and Get-AzContext does not return tenant name when connecting with a serviceprincipal. This is similar to those reported on [#10767](https://github.com/Azure/azure-powershell/issues/10767), [#20075](https://github.com/Azure/azure-powershell/issues/20075), and [#22887](https://github.com/Azure/azure-powershell/issues/22887).

I am logging this separately as #22887 has this listed as a feature request, but I believe this to be a bug for three reasons:
1. When connecting use other methods (e.g. interactive logon) with the same permissions applied then the tenant information is returned as expected.
2. Get-AzContext is also not returning the tenant name
3. There isn't a way that I can see to retrieve the tenant name

### Issue script & Debug output

```PowerShell
PS C:\Users\ChrisV> Get-AzTenant -TenantId $tenantId -Debug | Out-File C:\Users\ChrisV\Downloads\aztenant.txt
DEBUG: 17:47:08 - GetAzureRMTenantCommand begin processing with ParameterSet '__AllParameterSets'.
DEBUG: 17:47:08 - using account id 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'...
DEBUG: 17:47:08 - [ConfigManager] Got [False] from [DisplayBreakingChangeWarning], Module = [], Cmdlet = [].
DEBUG: 17:47:08 - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 17:47:08 - [ServicePrincipalAuthenticator] Calling ClientSecretCredential.GetTokenAsync - ApplicationId:'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', TenantId:'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/'
DEBUG: ClientSecretCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] MSAL MSAL.CoreCLR with assembly version '4.56.0.0'. CorrelationId(ccccccc-cccc-cccc-cccc-cccccccccccc)
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] === AcquireTokenForClientParameters ===
SendX5C: False
ForceRefresh: False

DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenForClient
IsConfidentialClient - True
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - ccccccc-cccc-cccc-cccc-cccccccccccc
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:

DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] === Token Acquisition (ClientCredentialRequest) started:
Scopes: https://management.core.windows.net//.default
Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [Instance Discovery] Instance discovery is enabled and will be performed
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:08Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [Region discovery] Not using a regional authority.
DEBUG: Request [dddddddd-dddd-dddd-dddd-dddddddddddd] POST https://login.microsoftonline.com/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/oauth2/v2.0/token
x-client-SKU:REDACTED
x-client-Ver:REDACTED
x-client-CPU:REDACTED
x-client-OS:REDACTED
x-client-current-telemetry:REDACTED
x-client-last-telemetry:REDACTED
x-ms-lib-capability:REDACTED
client-request-id:REDACTED
return-client-request-id:REDACTED
x-app-name:REDACTED
x-app-ver:REDACTED
Content-Type:application/x-www-form-urlencoded
x-ms-client-request-id:dddddddd-dddd-dddd-dddd-dddddddddddd
x-ms-return-client-request-id:true
User-Agent:azsdk-net-Identity/1.10.3 (.NET 8.0.4; Microsoft Windows 10.0.22631)
client assembly: Azure.Identity
DEBUG: Response [dddddddd-dddd-dddd-dddd-dddddddddddd] 200 OK (00.8s)
Cache-Control:no-store, no-cache
Pragma:no-cache
Strict-Transport-Security:REDACTED
X-Content-Type-Options:REDACTED
P3P:REDACTED
client-request-id:REDACTED
x-ms-request-id:eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
x-ms-ests-server:REDACTED
x-ms-clitelem:REDACTED
x-ms-srs:REDACTED
X-XSS-Protection:REDACTED
Set-Cookie:REDACTED
Date:Tue, 23 Apr 2024 15:47:09 GMT
Content-Type:application/json; charset=utf-8
Expires:-1
Content-Length:1473

DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] ScopeSet was missing from the token response, so using developer provided scopes in the result.
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Checking client info returned from the server..
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Saving token response to cache..
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [SaveTokenResponseAsync] ID Token not present in response.
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Cannot determine home account id - or id token or no client info and no subject
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] [SaveTokenResponseAsync] Saving AT in cache and removing overlapping ATs...
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Looking for scopes for the authority in the cache which intersect with https://management.core.windows.net//.default
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Intersecting scope entries count - 0
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc]
=== Token Acquisition finished successfully:
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] AT expiration time: 2024/04/23 16:47:08 +00:00, scopes: https://management.core.windows.net//.default. source: IdentityProvider
DEBUG: False MSAL 4.56.0.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-04-23 15:47:09Z - ccccccc-cccc-cccc-cccc-cccccccccccc] Fetched access token from host login.microsoftonline.com.
DEBUG: ClientSecretCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId: ExpiresOn: 2024-04-23T16:47:08.7446605+00:00
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/tenants?api-version=2021-01-01

Headers:
Accept-Language : en-US
x-ms-client-request-id : ffffffff-ffff-ffff-ffff-ffffffffffff

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-ratelimit-remaining-tenant-reads: 11999
x-ms-request-id : gggggggg-gggg-gggg-gggg-gggggggggggg
x-ms-correlation-request-id : gggggggg-gggg-gggg-gggg-gggggggggggg
x-ms-routing-request-id : SOUTHAFRICAWEST:20240423T154713Z:gggggggg-gggg-gggg-gggg-gggggggggggg
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
X-Cache : CONFIG_NOCACHE
X-MSEdge-Ref : Ref A: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH Ref B: IIIIIIIIIIIIIII Ref C: 2024-04-23T15:47:13Z
Date : Tue, 23 Apr 2024 15:47:12 GMT

Body:
{
"value": [
{
"id": "/tenants/bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
"tenantId": "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
"tenantCategory": "Home"
}
]
}

DEBUG: 17:47:13 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 17:47:13 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 17:47:13 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.Accounts:2.17.0; CommandName: Get-AzTenant; PSVersion: 7.4.2; IsSuccess: True; Duration: 00:00:04.5390424
DEBUG: 17:47:13 - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = [].
DEBUG: 17:47:13 - GetAzureRMTenantCommand end processing.

PS C:\Users\ChrisV> Get-AzContext -Debug
DEBUG: 18:05:32 - GetAzureRMContextCommand begin processing with ParameterSet 'GetSingleContext'.
DEBUG: 18:05:32 - [ConfigManager] Got [False] from [DisplayBreakingChangeWarning], Module = [], Cmdlet = [].
DEBUG: 18:05:32 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [False].

DEBUG: 18:05:32 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 18:05:32 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.Accounts:2.17.0; CommandName: Get-AzContext; PSVersion: 7.4.2; IsSuccess: True; Duration: 00:00:00.0037242
DEBUG: 18:05:32 - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = [].
DEBUG: 18:05:32 - GetAzureRMContextCommand end processing.
Tenant: bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb

SubscriptionName SubscriptionId Account Environment
---------------- -------------- ------- -----------
jjjjjjjj-jjjj-jjjj-jjjj-jjjjjjjjjjjj AzureCloud
```

### Environment data

```PowerShell
PS C:\Users\ChrisV> $PSVersionTable

Name Value
---- -----
PSVersion 7.4.2
PSEdition Core
GitCommitId 7.4.2
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
PS C:\Users\ChrisV> Get-Module Az.Accounts

ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.17.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
```

### Error output

```PowerShell
No error
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the service-principal behavior with Get-AzTenant -TenantId and Get-AzContext, using the supplied debug output as a reference. Trace the Az.Accounts cmdlet entry points and ServicePrincipalAuthenticator path; done means both commands return the tenant name consistently with interactive login, with tests covering the reported case.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
authentication, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.