Azure / Azure/azure-powershell

New/Remove/Update-AzTag for Service Bus Namespace fails when mininumTlsValue is 1.3

Open
#30,066 2 comments 1 reaction 2 assignees Claimed by @a0x1ab View on GitHub
act-observability-squad ARM - Tags bug customer-reported Service Attention Service Bus
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

Managing tags (`Update-AzTag`/`New-AzTag`/`Remove-AzTag`) on a Service Bus Namespace fails with error `{\"error\":{\"code\":\"InvalidMinTLSValue\",\"message\":\"The specified minimumTLSVersion 1.3 is unsupported.\"}}` if the Namespace has a `minimumTlsValue` of 1.3

Managing tags fails if:
```bicep
param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource namespace 'Microsoft.ServiceBus/namespaces@2022-01-01-preview' = {
name: resourceName
location: location
sku: {
...
}
properties: {
minimumTlsVersion: '1.3'
}
}
```

Managing the tags does works if `minimumTlsVersion: '1.2'`

### Issue script & Debug output

```PowerShell
PS C:\> update-azTag -ResourceId '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test/providers/Microsoft.ServiceBus/namespaces/test' -Tag @{'test'='example'} -Operation Merge -Debug
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 14:05:56 - UpdateAzureTagCommand begin processing with ParameterSet 'UpdateByResourceIdParameterSet'.
DEBUG: 14:05:56 - using account id 'example@example.com'...
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [Az.Resources], Cmdlet = [Update-AzTag]. Returning default value [True].
DEBUG: [Common.Authentication]: Authenticating using Account: 'example@example.com', environment: 'AzureCloud', tenant: '00000000-0000-0000-0000-000000000000'
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 14:05:56 - [ConfigManager] Got [False] from [EnableLoginByWam], Module = [], Cmdlet = [].
DEBUG: 14:05:56 - [SilentAuthenticator] Calling SharedTokenCacheCredential.GetTokenAsync - TenantId:'00000000-0000-0000-0000-000000000000', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/', UserId:'example@example.com'
DEBUG: SharedTokenCacheCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] ==== GetAccounts started - GetAccounts ====
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] Account id filter: False
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z] [Internal cache] Clearing user token cache accessor.
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z] [Internal cache] Total number of cache partitions found while getting refresh tokens: 1. PartitionKey False
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z] [Internal cache] Total number of cache partitions found while getting accounts: 1. PartitionKey False
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 7b813f3a-a5b6-4ee8-9e8a-0a1ea1a23529] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z] Found 1 cache accounts and 0 broker accounts
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z] Returning 1 accounts
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] MSAL MSAL.CoreCLR with assembly version '4.84.0.0'. CorrelationId(41fcb1af-5133-45c9-aab6-8b46f63fb1b4)
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] === AcquireTokenSilent Parameters ===
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] LoginHint provided: False
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] Account provided: True
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] ForceRefresh: False
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:
FMI Path:
Credential FMI Path:

DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] === Token Acquisition (SilentRequest) started:
Scopes: https://management.core.windows.net//.default
Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z] [Internal cache] Clearing user token cache accessor.
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] [Internal cache] Total number of cache partitions found while getting access tokens: 1
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] [FindAccessTokenAsync] Discovered 3 access tokens in cache using partition key: 439c1855-1f6e-4e56-ac9d-e2877e736b8f.00000000-0000-0000-0000-000000000000
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] Access token is not expired. Returning the found cache entry. [Current time (08/25/2026 12:05:56) - Expiration Time (08/25/2026 12:19:39 +00:00) - Extended Expiration Time (08/25/2026 12:19:39 +00:00)]
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] Returning access token found in cache. RefreshOn exists ? False
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4]
=== Token Acquisition finished successfully:
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] AT expiration time: 25/08/2026 12:19:39 +00:00, scopes: https://management.core.windows.net//.default https://management.core.windows.net//user_impersonation. source: Cache
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4]
[LogMetricsFromAuthResult] Cache Refresh Reason: NotApplicable
[LogMetricsFromAuthResult] DurationInCacheInMs: 0
[LogMetricsFromAuthResult] DurationTotalInMs: 2
[LogMetricsFromAuthResult] DurationInHttpInMs: 0
DEBUG: False MSAL 4.84.0.0 MSAL.CoreCLR .NET 10.0.9 Microsoft Windows 10.0.26200 [2026-08-25 12:05:56Z - 41fcb1af-5133-45c9-aab6-8b46f63fb1b4] TokenEndpoint: ****
DEBUG: SharedTokenCacheCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId: ExpiresOn: 2026-08-25T12:19:39.0000000+00:00
DEBUG: [Common.Authentication]: Received token with LoginType 'User', Tenant: '00000000-0000-0000-0000-000000000000', UserId: 'example@example.com'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PATCH

Absolute Uri:
https://management.azure.com//subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test/providers/Microsoft.ServiceBus/namespaces/test/providers/Microsoft.Resources/tags/default?api-version=2024-11-01

Headers:
Accept-Language : en-US
x-ms-client-request-id : d6f1680c-0978-46df-afd4-4338fb3ea822

Body:
{
"operation": "Merge",
"properties": {
"tags": {
"test": "example"
}
}
}

DEBUG: [AcquirePolicyTokenHandler] Intercept PATCH https://management.azure.com//subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test/providers/Microsoft.ServiceBus/namespaces/test/providers/Microsoft.Resources/tags/default?api-version=2024-11-01
DEBUG: [AcquirePolicyTokenHandler] Skip: user did not request token (no -AcquirePolicyToken).
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-failure-cause :
x-ms-request-id : 410b7125-7093-4076-af21-9399e9b8b720
x-ms-correlation-request-id : 410b7125-7093-4076-af21-9399e9b8b720
x-ms-routing-request-id : NORTHEUROPE:20260825T120558Z:410b7125-7093-4076-af21-9399e9b8b720
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
X-Cache : CONFIG_NOCACHE
X-MSEdge-Ref : Ref A: 90A7F00064AC4AA4BCDED27837BAC070 Ref B: VIEAA3060304023 Ref C: 2026-08-25T12:05:57Z
Date : Tue, 25 Aug 2026 12:05:57 GMT

Body:
{
"error": {
"code": "ProviderError",
"message": "{\"error\":{\"code\":\"InvalidMinTLSValue\",\"message\":\"The specified minimumTLSVersion 1.3 is unsupported.\"}}"
}
}

DEBUG: 14:05:56 - [ConfigManager] Got nothing from [EnableErrorRecordsPersistence], Module = [Az.Resources], Cmdlet = [Update-AzTag]. Returning default value [False].
Update-AzTag: {"error":{"code":"InvalidMinTLSValue","message":"The specified minimumTLSVersion 1.3 is unsupported."}}
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [Az.Resources], Cmdlet = [Update-AzTag]. Returning default value [True].
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 14:05:56 - No authentication telemetry is found for the current cmdlet with Id d6f1680c-0978-46df-afd4-4338fb3ea822.
DEBUG: AzureQoSEvent: Module: Az.Resources:10.1.0; CommandName: Update-AzTag; PSVersion: 7.6.3; IsSuccess: False; Duration: 00:00:00.4170649; SanitizeDuration: 00:00:00; Exception: {"error":{"code":"InvalidMinTLSValue","message":"The specified minimumTLSVersion 1.3 is unsupported."}};
DEBUG: 14:05:56 - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 14:05:56 - UpdateAzureTagCommand end processing.
```

### Environment data

```PowerShell
PS C:\> $PSVersionTable

Name Value
---- -----
PSVersion 7.6.3
PSEdition Core
GitCommitId 7.6.3
OS Microsoft Windows 10.0.26200
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.4
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
PS C:\> get-module az*

ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 5.5.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 10.1.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
```

### Error output

```PowerShell
PS C:\> Resolve-AzError
Resolve-AzError: Input string was not in a correct format. Failure to parse near offset 16. Expected an ASCII digit.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.