Azure / Azure/azure-powershell

Connect-AzAccount interactive login fails on macOS (Apple Silicon): "Interactive requests with mac broker enabled must be executed on the main thread"

Open
#29,941 3 comments 3 reactions 0 assignees View on GitHub
customer-reported Similar-Issue
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

`Connect-AzAccount` (interactive browser flow) fails on macOS with the following error, starting in Az.Accounts 5.5.1:

WARNING: Unable to acquire token for tenant 'organizations' with error
'InteractiveBrowserCredential authentication failed: Interactive requests
with mac broker enabled must be executed on the main thread on macOS.'
Connect-AzAccount: InteractiveBrowserCredential authentication failed:
Interactive requests with mac broker enabled must be executed on the main
thread on macOS.

### Environment
- Az.Accounts version (broken): 5.5.1
- Az.Accounts version (last known good): 5.2.0
- OS: macOS (Apple Silicon)
- PowerShell: 7.6.4 (pwsh)
- Shell/terminal: zsh, running inside Ghostty

### Steps to reproduce
1. Install Az.Accounts 5.5.1 (via `Install-Module -Name Az -Repository PSGallery`)
2. Run `Connect-AzAccount`
3. Observe the error above instead of a browser window opening

### Expected behavior
Interactive browser login opens as it did on 5.2.0.

### Workaround found
Downgrading fixes it:

Uninstall-Module Az.Accounts -AllVersions -Force
Install-Module -Name Az.Accounts -RequiredVersion 5.2.0 -Repository PSGallery -Force -AllowClobber

`Connect-AzAccount -UseDeviceAuthentication` also works around it without downgrading, but the standard interactive flow should not require this.

### Additional notes
This appears to be caused by the MSAL mac-broker interactive auth path requiring main-thread execution, which isn't guaranteed when pwsh is run from a non-default terminal host.

---
Duplicate of #29940 (filed from a different account by mistake; leaving that one open too so a maintainer can dedupe).

Contributor guide

Open the contributing guide

Research direction

Start by reproducing Connect-AzAccount on macOS Apple Silicon with Az.Accounts 5.5.1, then compare it with 5.2.0 and the -UseDeviceAuthentication workaround. Trace the interactive browser flow and its MSAL mac-broker path; done means the standard command opens a browser without the main-thread error.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, powershell
Domain
authentication, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.