Upgrade fails when using AAD

[yarinm]

Is this a request for help?:
Yes

Is this an ISSUE or FEATURE REQUEST? (choose one):
Issue

What version of aks-engine?: 0.31.3

---

Kubernetes version: 1.11.6 upgrading to 1.12.6

What happened:
I've tried to upgrade my existing aks-engine cluster from kubernetes 1.11.6 to 1.12.6 and I got:
INFO[0468] Error validating upgraded master VM: k8s-master-59342023-0
FATA[0468] Error upgrading cluster: No Auth Provider found for name "azure"

The cluster is using AAD authentication

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know:
This also happened when I tried to upgrade from 1.10 to 1.11
Only solution was to teardown the entire cluster and redeploy it from scratch.

The JSON I'm using to generate the cluster:

{
  "apiVersion": "vlabs",
  "properties": {
    "aadProfile": {
      "serverAppID": "eaa4adb6-aa2e-4496-bfc0-27a0293a5a03",
      "clientAppID": "3fe5cebe-8b2e-4d03-97c7-1b11a14785b5",
      "tenantID": "72f988bf-86f1-41af-91ab-2d7cd011db47"
    },
    "orchestratorProfile": {
      "orchestratorType": "Kubernetes",
      "orchestratorVersion": "1.12.6"
    },
    "masterProfile": {
      "count": 1,
      "dnsPrefix": "rs2aksmaster",
      "vmSize": "Standard_D2_v2"
    },
    "agentPoolProfiles": [
      {
        "name": "rs2aksagent",
        "count": 4,
        "vmSize": "Standard_D8s_v3"
      }
    ],
    "linuxProfile": {
      "adminUsername": "azureuser",
      "ssh": {
        "publicKeys": [
          {
            "keyData": "XXX"
          }
        ]
      }
    },
    "servicePrincipalProfile": {
      "clientId": "fc41171e-2753-46f4-a27d-7987f6c1c0f6",
      "secret": "XXX"
    }
  }
}

[welcome]

👋 Thanks for opening your first issue here! If you're reporting a 🐞 bug, please make sure you include steps to reproduce it.

[mboersma]

@yarinm this was finally fixed by PR #1273. If you try AKS Engine v0.36.x or later, you shouldn't see this issue any longer.

[yarinm]

Thanks @mboersma . Do you know you still have the limitation for fetching only 30 groups for AAD users?
At the moment I'm using guard instead of enabling this because of this limitation.

[mboersma]

@yarinm I wasn't aware of that limitation—is that an azure-sdk-for-go problem? Could you open a new issue against v0.36.4 or later to help us reproduce it?