[Issue] Can't complete azd deploy on ai agent (get_foundry_project error)

[pamelafox]

• Make sure you've installed the latest version using instructions

Output from azd version

azd version 1.24.0-beta.1-pr.6069275 (commit 2ef20fb) (stable)

Describe the bug

I ran "azd up" on seattle-hotel-agent, then closed my laptop during deployment, came back to see the deployment had finished in the portal successfully. then I ran azd up, and it errors, as shown below:

seattle-hotel-agent % azd up

Packaging services (azd package)

  (✓) Done: Packaging service seattle-hotel-agent
  - No artifacts were found


Provisioning Azure resources (azd provision)
Provisioning Azure resources can take some time.

Subscription: python (8077d4f9-d1b7-4c80-b6c2-cf9a2ec2d604)
Location: West US

  (-) Skipped: Didn't find new changes.

Deploying services (azd deploy)

  (x) Failed: Deploying service seattle-hotel-agent

ERROR: error executing step command 'deploy --all': getting target resource: resolving target resource via external service target: get_foundry_project: AzureDeveloperCLICredential: signal: killed

Additional context
Add any other context about the problem here.

[vhvb1989]

auth related again @pamelafox 🥲

AzureDeveloperCLICredential: signal: killed

Are you able to run azd deploy ??

@JeffreyCA , do we get more info from the extension call stack + azd stack running with --debug ? or would that only give us to azd's stack?

Looks like the extension trying to get a token to query foundry, but I've never seen azd killing signals before 😆

[JeffreyCA]

do we get more info from the extension call stack + azd stack running with --debug ?

Not to stderr. For the agents extension --debug creates a .log file for extension logs, but unsure if it'll include details about the azd credential. May be worth a try

[pamelafox]

azd deploy did just work on its own:

seattle-hotel-agent % azd deploy

Deploying services (azd deploy)

  (✓) Done: Deploying service seattle-hotel-agent
  - Agent playground (portal): https://ai.azure.com/nextgen/r/gHfU-dG3TIC2ws-aLsLWBA,rg-seattle-hotel-agent-dev,,ai-account-vcrxjtdoibg4e,ai-project-seattle-hotel-agent-dev/build/agents/seattle-hotel-agent/build?version=1 
  - Agent endpoint: https://ai-account-vcrxjtdoibg4e.services.ai.azure.com/api/projects/ai-project-seattle-hotel-agent-dev/agents/seattle-hotel-agent/versions/1 
    For information on invoking the agent, see https://aka.ms/azd-agents-invoke


SUCCESS: Your application was deployed to Azure in 1 minute 30 seconds.
You can view the resources created under the resource group rg-seattle-hotel-agent-dev in Azure Portal:
https://portal.azure.com/#@/resource/subscriptions/8077d4f9-d1b7-4c80-b6c2-cf9a2ec2d604/resourceGroups/rg-seattle-hotel-agent-dev/overview

[pamelafox]

This URL does not work for me, however:
https://ai.azure.com/nextgen/r/gHfU-dG3TIC2ws-aLsLWBA,rg-seattle-hotel-agent-dev,,ai-account-vcrxjtdoibg4e,ai-project-seattle-hotel-agent-dev/build/agents/seattle-hotel-agent/build?version=1

It gives me this error:

Sorry, it looks like the page you're trying to access isn't available right now. You can try reloading the page, or come back later to see if the issue persists.
All error details are logged and triaged when possible.
x-ms-client-error-id: --
timestamp: Sun, 29 Mar 2026 06:15:50 GMT

[pamelafox]

I got the original error twice in a row just now:

foundry-hostedagentframework-demo % azd deploy                                         

Deploying services (azd deploy)

  (x) Failed: Deploying service seattle-hotel-agent

ERROR: getting target resource: resolving target resource via external service target: get_foundry_project: AzureDeveloperCLICredential: signal: killed
foundry-hostedagentframework-demo % azd deploy

Deploying services (azd deploy)

  (x) Failed: Deploying service seattle-hotel-agent

ERROR: getting target resource: resolving target resource via external service target: get_foundry_project: AzureDeveloperCLICredential: signal: killed

[JeffreyCA]

I got the original error twice in a row just now:

foundry-hostedagentframework-demo % azd deploy                                         

Deploying services (azd deploy)

  (x) Failed: Deploying service seattle-hotel-agent

ERROR: getting target resource: resolving target resource via external service target: get_foundry_project: AzureDeveloperCLICredential: signal: killed
foundry-hostedagentframework-demo % azd deploy

Deploying services (azd deploy)

  (x) Failed: Deploying service seattle-hotel-agent

ERROR: getting target resource: resolving target resource via external service target: get_foundry_project: AzureDeveloperCLICredential: signal: killed

Could it be some kind of a timeout issue @vhvb1989? AzureDeveloperCLICredential seems to have a timeout of 10s:

https://github.com/Azure/azure-sdk-for-go/blob/7e6148dfa8bca05a28a8d0a7f244ecaaecb0a05e/sdk/azidentity/developer_credential_util.go#L17-L19

Can you try running this a few times, does it reliably return a token in a short time?

azd auth token -o json --no-prompt --tenant-id <tenant-id> --scope https://management.azure.com/.default

[vhvb1989]

Root Cause Analysis

cc @JeffreyCA

After investigation, the signal: killed error is not caused by azd auth token being slow. The token itself is computed almost instantly (read from MSAL cache). The real culprit is the background update check blocking process exit in main.go.

How it happens

When the azure.ai.agents extension needs an Azure token, it uses azidentity.AzureDeveloperCLICredential, which spawns a subprocess:

/bin/sh -c "azd auth token -o json --no-prompt --scope ... --tenant-id ..."

The Go SDK gives this subprocess a 10-second timeout (hardcoded cliTimeout in azidentity). Here is what happens inside that subprocess:

1. main.go:65 — A fetchLatestVersion goroutine launches an HTTP call to check for azd updates (with a 60-second timeout context)
2. main.go:76 — The actual auth token command runs, reads from MSAL cache, writes the JSON token to stdout — completes in milliseconds
3. main.go:86 — versionInfo, ok := <-latest — BLOCKS the process from exiting until the update check HTTP call finishes or times out

The credential code (cmd.Output()) waits for the process to exit before returning the token. The process cannot exit because it is stuck on <-latest. After 10 seconds, the credential context deadline expires, Go sends SIGKILL → signal: killed.

The token data was already written to stdout but gets discarded because the error takes precedence.

Why it triggers after laptop sleep / intermittently

After a laptop wakes from sleep, DNS resolution and network connections can be stale. The update check HTTP call (to fetch latest version info) can take >10 seconds to resolve/connect/timeout, which exceeds the credential’s 10-second process timeout.

Telemetry impact

This is likely contributing to a high number of errors in telemetry coming from azd auth token invocations. Every time the update check is slow (network hiccup, DNS stall, corporate proxy delays), the extension’s credential call fails with signal: killed, which surfaces as a deploy failure.

Current workaround

Users hitting this frequently can set:

export AZD_SKIP_UPDATE_CHECK=true

This env var (checked in main.go:159) skips the fetchLatestVersion goroutine entirely, allowing azd auth token to exit immediately after producing the token.

Proposed fix

A fix is needed to allow azd to define a list of commands/operations in which the update check should not run. At a minimum, azd auth token (a hidden command used programmatically by SDK credentials) should skip the update check, since blocking process exit for a background network call defeats the purpose of a fast token retrieval.

I will start working on a proposal fix for this.