Cannot process Subscriptions due to Multi-Factor authentication

Hello everyone,

For my Azure lab I have created a user account that is a member of a group called "Subscription Reader". I have granted this group Read permissions on my Azure Subscription.
There is also a VM under that Subscription and I have confirmed in its Access Management that the Read rights get inherited for it from the Subscription.

However when I run AzureHound (I have tried v2.12.1, as well as the rolling release (13th May 2026)) the resulting file will not contain the name of the aforementioned virtual machine.

.\azurehound.exe -r "{Refresh Token of the Subscription Readers Member}" list --tenant "{My Tenant}.onmicrosoft.com" -o azurehound.json

Checking the azurehound output I come across this:

ERR unable to continue processing subscriptions error="map[correlation_id:{removed} error:invalid_grant error_codes:[50076] error_description:AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '{removed}'. Trace ID: {removed} Correlation ID: {removed} Timestamp: 2026-05-17 19:29:03Z error_uri:https://login.microsoftonline.com/error?code=50076 suberror:basic_action timestamp:2026-05-17 19:29:03Z trace_id:{removed}>]"

Can anyone please explain, why AzureHound might fail to properly enumerate the objects?

Start by reproducing the AzureHound list command with the supplied refresh-token flow and tenant option, then inspect the reported invalid_grant error with code 50076. The issue names no source files or tests, so the first task is to locate subscription processing and determine whether MFA-related authentication prevents VM enumeration.