Troubleshoot development environment authentication

This article provides guidance on dealing with issues encountered when authenticating Azure SDK for Java applications running locally on developer machines, through various TokenCredential implementations. For more information, see Azure authentication in Java development environments.

Troubleshoot AzureCliCredential

When you use AzureCliCredential, you can optionally try/catch for CredentialUnavailableException. The following table shows the errors that this exception indicates, and methods of mitigation:

Error message	Description	Mitigation
Azure CLI not installed	The Azure CLI isn't installed or couldn't be found.	- Ensure that you've properly installed the Azure CLI. - Validate that the installation location has been added to the PATH environment variable.
Please run 'az login' to set up account	No account is currently signed into the Azure CLI, or the sign-in has expired.	- Sign in to the Azure CLI using the az login command. For more information, see Sign in with Azure CLI. - Validate that the Azure CLI can obtain tokens. For more information, see the next section.

Verify that the Azure CLI can obtain tokens

You can manually verify that you've properly authenticated the Azure CLI and can obtain tokens. First, use the following command to verify that the account is currently signed in to the Azure CLI:

az account show

After you've verified the Azure CLI is using correct account, use the following command to validate that it's able to obtain tokens for this account:

az account get-access-token \
    --output json \
    --resource https://management.core.windows.net

Warning

The output of this command contains a valid access token. To avoid compromising account security, don't share this access token.

Troubleshoot AzureDeveloperCliCredential

When you use AzureDeveloperCliCredential, you can optionally try/catch for CredentialUnavailableException. The following table shows the errors that this exception indicates, and methods of mitigation:

Error message	Description	Mitigation
Azure Developer CLI not installed	The Azure Developer CLI isn't installed or couldn't be found.	- Ensure that you've properly installed the Azure Developer CLI. - Validate that the installation location has been added to the PATH environment variable.
Please run 'azd auth login' to set up account	No account is currently signed in to the Azure Developer CLI, or the sign-in has expired.	- Sign in to the Azure Developer CLI using the azd auth login command. - Validate that the Azure Developer CLI can obtain tokens. For more information, see the next section.

Verify that the Azure Developer CLI can obtain tokens

You can manually verify that you've properly authenticated the Azure Developer CLI, and can obtain tokens. First, use the following command to verify that the account is currently signed in to the Azure Developer CLI:

azd config list

After you've verified the Azure Developer CLI is using correct account, you can use the following command to validate that it's able to obtain tokens for this account:

azd auth token --output json --scope https://management.core.windows.net/.default

Warning

The output of this command contains a valid access token. To avoid compromising account security, don't share this access token.

Troubleshoot AzurePowerShellCredential

When you use AzurePowerShellCredential, you can optionally try/catch for CredentialUnavailableException. The following table shows the errors that this exception indicates, and methods of mitigation:

Error message	Description	Mitigation
PowerShell isn't installed.	No local installation of PowerShell was found.	Ensure that you've properly installed PowerShell on the machine.
Az.Account module >= 2.2.0 isn't installed.	The Az.Account module needed for authentication in Azure PowerShell isn't installed.	Install the latest Az.Account module. For more information, see How to install Azure PowerShell.
Please run 'Connect-AzAccount' to set up account.	No account is currently signed in to Azure PowerShell.	- Sign in to Azure PowerShell using the Connect-AzAccount command. For more information, see Sign in with Azure PowerShell - Validate that Azure PowerShell can obtain tokens. For more information, see the next section.

Verify that Azure PowerShell can obtain tokens

You can manually verify that you've properly authenticated Azure PowerShell, and can obtain tokens. First, use the following command to verify that the account is currently signed in to the Azure CLI:

Get-AzContext

This command produces output similar to the following example:

Name                                     Account             SubscriptionName    Environment         TenantId
----                                     -------             ----------------    -----------         --------
Subscription1 (xxxxxxxx-xxxx-xxxx-xxx... test@outlook.com    Subscription1       AzureCloud          xxxxxxxx-x...

After you've verified Azure PowerShell is using correct account, you can use the following command to validate that it's able to obtain tokens for this account.

Get-AzAccessToken -ResourceUrl "https://management.core.windows.net"

Warning

The output of this command contains a valid access token. To avoid compromising account security, don't share this access token.

Troubleshoot VisualStudioCodeCredential

Note

It's a known issue that VisualStudioCodeCredential doesn't work with Azure Account extension versions newer than 0.9.11. A long-term fix to this problem is in progress. In the meantime, consider authenticating via the Azure CLI.

When you use VisualStudioCodeCredential, you can optionally try/catch for CredentialUnavailableException. The following table shows the errors that this exception indicates, and methods of mitigation:

Error message	Description	Mitigation
Failed To Read VS Code Credentials</p></p>OR</p>Authenticate via Azure Tools plugin in VS Code	No Azure account information was found in the VS Code configuration.	- Ensure that you've properly installed the Azure Account plugin. - Use View > Command Palette to execute the Azure: Sign In command. This command opens a browser window and displays a page that allows you to sign in to Azure. - If you already have the Azure Account extension installed and have signed in to your account, try logging out and logging in again. This action repopulates the cache and potentially mitigates the error you're getting.
MSAL Interaction Required Exception	VisualStudioCodeCredential was able to read the cached credentials from the cache but the cached token is likely expired.	Sign in to the Azure Account extension via View > Command Palette to execute the Azure: Sign In command in the VS Code IDE.
ADFS tenant not supported	Visual Studio Azure Service Authentication doesn't currently support ADFS tenants.	Use credentials from a supported cloud when authenticating with Visual Studio. For more information about the supported clouds, see National clouds.

Next steps

If the troubleshooting guidance in this article doesn't help to resolve issues when you use the Azure SDK for Java client libraries, we recommended that you file an issue in the Azure SDK for Java GitHub repository.