[ACR] Fix Azure/azure-cli#33698: az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO - #33699
Open
Aditya Pujara (a0x1ab) with Copilot wants to merge 20 commits into
Open
[ACR] Fix Azure/azure-cli#33698: az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO#33699Aditya Pujara (a0x1ab) with Copilot wants to merge 20 commits into
az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO#33699Aditya Pujara (a0x1ab) with Copilot wants to merge 20 commits into
Conversation
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
microsoft-github-policy-service
Bot
requested review from
Bin Du (northtyphoon),
Terence Truong (terencet-dev),
ZelinWang (wangzelin007) and
Yong Zhang (yonzhan)
July 3, 2026 10:47
microsoft-github-policy-service
Bot
added
Auto-Assign
… AzureML MSI/SSO
Copilot
AI
changed the title
[WIP] Fix az acr login regression in Azure CLI 2.87.0
[ACR] Fix Azure/azure-cli#33698: Jul 3, 2026
az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO
Aditya Pujara (a0x1ab)
left a comment
Aditya Pujara (a0x1ab)
left a comment
Member
There was a problem hiding this comment.
CI Review — PR #33699
Live test (Tester): No changed test files were detected in this PR (tests/**/test_*.py), so the azdev test --live step had nothing to run. This is informational only — not a blocker.
CI failure — action required:
- ❌ Test Homebrew Formula — https://github.com/Azure/azure-cli/runs/84989975666 (Azure DevOps build details)
Please investigate why the Homebrew formula test is failing for this change (e.g. formula/checksum generation, packaging metadata, or a dependency pinned incorrectly) and push a fix. Note the companion Build Homebrew Formula step succeeded, so the regression is specific to the formula test step — check the linked Azure DevOps build log for the exact assertion/error before making changes.
All other completed checks are currently passing (71/72 completed checks green); several packaging checks are still in progress and will be re-evaluated on the next pass.
Posted by agent-assist (autonomous bug-fix pipeline).
Member
|
Copilot the automated CI and live-test review on this PR found failures. Please look into the requested changes here: #33699 (review) and push a fix. Posted by agent-assist (autonomous bug-fix pipeline). |
Contributor
Author
Investigated the Root cause analysis:
What I found:
Fix pushed: Added the |
Member
|
Started a Copilot task using Posted by agent-assist (autonomous bug-fix pipeline). |
Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>
Member
|
❌ Redaction disputed by Aditya Pujara (@a0x1ab). Automation is paused for maintainer review. Agent Assist will not restore the suspected value because doing so would publish it again. A maintainer can replace the placeholder with confirmed non-sensitive text after review. Posted by agent-assist (autonomous bug-fix pipeline). |
|
❌ Redaction disputed by Aditya Pujara (@a0x1ab). Automation is paused for maintainer review. Agent Assist will not restore the suspected value because doing so would publish it again. A maintainer can replace the placeholder with confirmed non-sensitive text after review. Posted by agent-assist (autonomous bug-fix pipeline). |
Aditya Pujara (a0x1ab)
added
the
agent-assist
|
Automated sensitive-information remediation ran on this pull request.
If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment. ✅ Keep the redaction · ❌ Dispute the redaction GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices. Posted by agent-assist (autonomous bug-fix pipeline). |
Aditya Pujara (a0x1ab)
added
azure-client-tools-agent
Contributor
|
🔔 Routing this PR to @Azure/act-identity-squad. |
Contributor
|
🔔 Routing this PR to @Azure/act-platform-engineering-squad. |
Live test results —
|
Collaborator
|
ACR |
![azure-client-tools-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
❌ Automated fix attempts exhausted
After 5 automated Copilot attempts, this PR still has 38 failing checks.
Failed checks (38 unique):
- Azure.azure-cli
- Azure.azure-cli (Test Deb Packages Bookworm AMD64)
- Azure.azure-cli (Test Deb Packages Bookworm ARM64)
- Azure.azure-cli (Test Deb Packages Bullseye AMD64)
- Azure.azure-cli (Test Deb Packages Bullseye ARM64)
- Azure.azure-cli (Test Deb Packages Jammy AMD64)
- Azure.azure-cli (Test Deb Packages Jammy ARM64)
- Azure.azure-cli (Test Deb Packages Noble AMD64)
- Azure.azure-cli (Test Deb Packages Noble ARM64)
- Azure.azure-cli (Test Rpm Package Azure Linux 3.0 AMD64)
- Azure.azure-cli (Test Rpm Package Azure Linux 3.0 ARM64)
- Azure.azure-cli (Test Rpm Package Red Hat Universal Base Image 10 AMD64)
- Azure.azure-cli (Test Rpm Package Red Hat Universal Base Image 10 ARM64)
- Azure.azure-cli (Test Rpm Package Red Hat Universal Base Image 8 AMD64)
- Azure.azure-cli (Test Rpm Package Red Hat Universal Base Image 8 ARM64)
- Azure.azure-cli (Test Rpm Package Red Hat Universal Base Image 9 AMD64)
- Azure.azure-cli (Test Rpm Package Red Hat Universal Base Image 9 ARM64)
- Azure.azure-cli (Unit Test for Core Python312)
- Azure.azure-cli (Unit Test for Core Python314)
- Azure.azure-cli (Unit Test for Telemetry Python312)
- Azure.azure-cli (Unit Test for Telemetry Python314)
- Azure.azure-cli Full Test
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance1)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance2)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance3)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance4)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance5)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance6)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance7)
- Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance8)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance1)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance2)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance3)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance4)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance5)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance6)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance7)
- Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance8)
The automated fixer has reached its attempt cap. Handing off to human review — please investigate the remaining failures and continue manually.
Posted by agent-assist (autonomous bug-fix pipeline).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 70d2f3ed-f690-43db-bd50-a88351a6f3f9
|
Automated sensitive-information remediation ran on this pull request.
If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment. ✅ Keep the redaction · ❌ Dispute the redaction GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices. Posted by agent-assist (autonomous bug-fix pipeline). |
Live test results —
|
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 70d2f3ed-f690-43db-bd50-a88351a6f3f9
Live test results —
|
Live test results —
|
Live test results —
|
There was a problem hiding this comment.
Automated Review Summary
PR: #33699 — [ACR] Fix Azure/azure-cli#33698: az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO
- Live test (Tester): ✅ Passed — run 31590610904
- CI checks: ✅ All 92 checks passed (0 failed, 0 pending)
No outstanding issues found. This PR looks good from an automated CI/live-test standpoint.
Posted by agent-assist (autonomous bug-fix pipeline).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
az acr loginDescription
In AzureML Compute Instance environments using
az login --identity(MSI/SSO),az acr loginfails because acquiring an AAD token scoped tohttps://containerregistry.azure.netreturns an SSO error. ACR's/oauth2/exchangeendpoint accepts ARM management tokens (https://management.azure.com/) equally well, and that token is available in these environments — this path worked in 2.81.0.The regression was introduced in #31798, which removed the conditional ARM-token fallback and hardcoded the ACR audience as the only option.
Fix: In
_get_aad_token_after_challenge, catchCLIErrorfromprofile.get_raw_token(resource=<acr-scope>)and retry with no resource (ARM management endpoint). The ACR-specific audience is still preferred; ARM is only used when the scoped request fails.Testing Guide
On an AzureML Compute Instance with MSI login:
Unit test
test_get_docker_credentials_arm_token_fallbackadded: mocksget_raw_tokento raiseCLIErroron the ACR-scope call and verifies login succeeds via the ARM fallback.History Notes
[ACR]
az acr login: Fix ARM token exchange fallback for AzureML MSI/SSO environmentsThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.