Rediger

Share via

Sign in interactively with Azure CLI

  • Artikkel

Interactive logins to Azure offer a more intuitive and flexible user experience. Interactive login with Azure CLI allows users to authenticate to Azure directly through the az login command, which is useful for ad-hoc management tasks and for environments that require manual sign-in, such as those customers with multi-factor authentication (MFA). This method simplifies access for script testing, learning, and on-the-fly management without needing to preconfigure service principals or other noninteractive authentication methods.

Prerequisites

Interactive login

To sign in interactively, use the az login command. Beginning with Azure CLI version 2.61.0, Windows systems use Web Account Manager (WAM), and Linux and macOS systems use browser-based login by default.

az login

Subscription selector

Beginning with Azure CLI version 2.61.0, if you have access to multiple subscriptions, you're prompted to select an Azure subscription at time of login, as shown in the following example.

Retrieving subscriptions for the selection...

[Tenant and subscription selection]

No    Subscription name                     Subscription ID                           Tenant name
----  ------------------------------------  ----------------------------------------  --------------
[1]   Facility Services Subscription        00000000-0000-0000-0000-000000000000      Contoso
[2]   Finance Department Subscription       00000000-0000-0000-0000-000000000000      Contoso
[3]   Human Resources Subscription          00000000-0000-0000-0000-000000000000      Contoso
[4] * Information Technology Subscription   00000000-0000-0000-0000-000000000000      Contoso

The default is marked with an *; the default tenant is 'Contoso' and subscription is 'Information Technology Subscription' (00000000-0000-0000-0000-000000000000).

Select a subscription and tenant (Type a number or Enter for no changes): 2

Tenant: Contoso
Subscription: Finance Department Subscription (00000000-0000-0000-0000-000000000000)

[Announcements]
With the new Azure CLI login experience, you can select the subscription you want to use more easily.
Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271236

If you encounter any problem, please open an issue at https://aka.ms/azclibug

The next time you login, the previously selected tenant and subscription is marked as the default with an asterisk (*) next to its number. This allows you to press Enter to select the default subscription.

Commands run against the selected subscription by default. You can still use az account set to change your subscription from a command line at any time. For more information, see How to manage Azure subscriptions with the Azure CLI.

Here are some guidelines about the subscription selector to keep in mind:

  • The subscription selector is only available in 64-bit Windows, Linux, or macOS.
  • The subscription selector is only available when using the az login command.
  • You aren't prompted to select a subscription when you're logging in with a service principal or managed identity.

Sign in with Web Account Manager (WAM) on Windows

Beginning with Azure CLI version 2.61.0, Web Account Manager (WAM) is now the default authentication method on Windows. WAM is a Windows 10+ component that acts as an authentication broker. (An authentication broker is an application that runs on a user’s machine that manages the authentication handshakes and token maintenance for connected accounts.)

Using WAM has several benefits:

If you encounter any issue and want to revert to the previous browser-based authentication method, run the following script:

az account clear
az config set core.enable_broker_on_windows=false
az login

WAM is available on Windows 10 and later, and on Windows Server 2019 and later.

Sign in with a browser

The Azure CLI defaults to a browser-based authentication method when one of the following is true:

  • The operating system (OS) is Mac, or Linux, or the Windows OS is earlier than Windows 10 or Windows Server 2019.
  • The core.enable_broker_on_windows configuration property is set to false.

  1. Run the az login command.

    az login

    If the Azure CLI can open your default browser, it initiates authorization code flow and opens the default browser to load an Azure sign-in page.

    Otherwise, it initiates the device code flow and instructs you to open a browser page at https://aka.ms/devicelogin. Then, enter the code displayed in your terminal.

    If no web browser is available or the web browser fails to open, you may force device code flow with az login --use-device-code.

  2. Sign in with your account credentials in the browser.

Sign in with credentials on the command line

Provide your Azure user credentials on the command line. Only use this authentication method for learning Azure CLI commands. Production-level applications should use a service principal or managed identity.

This approach doesn't work with Microsoft accounts or accounts that have two-factor authentication enabled. You receive an interactive authentication is needed message.

az login --user <username> --password <password>

Important

If you want to avoid displaying your password on console and are using az login interactively, use the read -s command under bash.

read -sp "Azure password: " AZ_PASS && echo && az login -u <username> -p $AZ_PASS

Under PowerShell, use the Get-Credential cmdlet.

$AzCred = Get-Credential -UserName <username>
az login -u $AzCred.UserName -p $AzCred.GetNetworkCredential().Password

Sign in with a different tenant

You can select a tenant to sign in under with the --tenant argument. The value of this argument can either be an .onmicrosoft.com domain or the Azure object ID for the tenant. Both interactive and command-line sign-in methods work with --tenant.

az login --tenant 00000000-0000-0000-0000-000000000000

After signing in, if you want to change your active tenant, see How-to change your active tenant.

Refresh tokens

When you sign in with a user account, Azure CLI generates and stores an authentication refresh token. Because access tokens are valid for only a short period of time, a refresh token is issued at the same time the access token is issued. The client application can then exchange this refresh token for a new access token when needed. For more information on token lifetime and expiration, see Refresh tokens in the Microsoft identity platform.

Use the az account get-access-token command to retrieve the access token:

# get access token for the active subscription
az account get-access-token

# get access token for a specific subscription
az account get-access-token --subscription "<subscription ID or name>"

Here is some additional information about access token expiration dates:

  • Expiration dates are updated in a format that is supported by MSAL-based Azure CLI.
  • Starting from Azure CLI 2.54.0, az account get-access-token returns the expires_on property alongside the expiresOn property for the token expiration time.
  • The expires_on property represents a Portable Operating System Interface (POSIX) timestamp while the expiresOn property represents a local datetime.
  • The expiresOn property doesn't express "fold" when Daylight Saving Time ends. This can cause problems in countries or regions where Daylight Saving Time is adopted. For more information on "fold", see PEP 495 – Local Time Disambiguation.
  • We recommend for downstream applications to use the expires_on property, because it uses the Universal Time Code (UTC).

Example output:

{
  "accessToken": "...",
  "expiresOn": "2023-10-31 21:59:10.000000",
  "expires_on": 1698760750,
  "subscription": "...",
  "tenant": "...",
  "tokenType": "Bearer"
}

Troubleshooting

When your default browser is Microsoft Edge, you might encounter the following error when attempting to sign in to Azure interactively with az login: "The connection for this site isn't secure." To resolve this issue, visit edge://net-internals/#hsts in Microsoft Edge. Add localhost under "Delete domain security policy" and select Delete.

See also