Azure / Azure/azure-powershell
Connect-AzAccount interactive login fails on macOS (Apple Silicon): "Interactive requests with mac broker enabled must be executed on the main thread"
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
`Connect-AzAccount` (interactive browser flow) fails on macOS with the following error, starting in Az.Accounts 5.5.1:
WARNING: Unable to acquire token for tenant 'organizations' with error
'InteractiveBrowserCredential authentication failed: Interactive requests
with mac broker enabled must be executed on the main thread on macOS.'
Connect-AzAccount: InteractiveBrowserCredential authentication failed:
Interactive requests with mac broker enabled must be executed on the main
thread on macOS.
### Environment
- Az.Accounts version (broken): 5.5.1
- Az.Accounts version (last known good): 5.2.0
- OS: macOS (Apple Silicon)
- PowerShell: 7.6.4 (pwsh)
- Shell/terminal: zsh, running inside Ghostty
### Steps to reproduce
1. Install Az.Accounts 5.5.1 (via `Install-Module -Name Az -Repository PSGallery`)
2. Run `Connect-AzAccount`
3. Observe the error above instead of a browser window opening
### Expected behavior
Interactive browser login opens as it did on 5.2.0.
### Workaround found
Downgrading fixes it:
Uninstall-Module Az.Accounts -AllVersions -Force
Install-Module -Name Az.Accounts -RequiredVersion 5.2.0 -Repository PSGallery -Force -AllowClobber
`Connect-AzAccount -UseDeviceAuthentication` also works around it without downgrading, but the standard interactive flow should not require this.
### Additional notes
This appears to be caused by the MSAL mac-broker interactive auth path requiring main-thread execution, which isn't guaranteed when pwsh is run from a non-default terminal host.
---
Duplicate of #29940 (filed from a different account by mistake; leaving that one open too so a maintainer can dedupe).
Contributor guide
Research direction
Start by reproducing Connect-AzAccount on macOS Apple Silicon with Az.Accounts 5.5.1, then compare it with 5.2.0 and the -UseDeviceAuthentication workaround. Trace the interactive browser flow and its MSAL mac-broker path; done means the standard command opens a browser without the main-thread error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, powershell
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100