Account selection window pops up after Connect-AzAccount fails with "user canceled authentication"

[qishengc]

Description

I was on Az.Accounts V2.13.1, and my script is working fine, but today after a latest update to Az.Accounts V3.0.0, Connect-AzAccount always succeeded with warning "WARNING: Unable to acquire token for tenant ..." , and although it looks like it connected successfully, no Az operations such as Get-AzSubscription could execute successfully, it reports the same warning:

Here are details:

1. Way 1: user PSCredential

$Username='foo@test.com' // example
$Password='example'
psCred = New-Object System.Management.Automation.PSCredential -ArgumentList ($Username, (ConvertTo-SecureString -String $Password -AsPlainText -Force)) 
Connect-AzAccount -Credential $psCred 

Result:

Retrieving subscriptions for the selection...

[Announcements]
With the new Azure PowerShell login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271909.

If you encounter any problem, please open an issue at: https://aka.ms/azpsissue

Subscription name                            Tenant
-----------------                            ------
Non-Prod PAYG AS on a830edad9050849paygmsit3 TEST_TEST_E3_SelfServiceHb_202306290544_85XBofcIeP

Even though it shows like connected successfully, run: Get-AzSubscription to test, got no result with below warning (Repeated in console):
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'

1. Way 2: Interactive login

 Connect-AzAccount -TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa

Result:

Please select the account you want to login with.

Connect-AzAccount: InteractiveBrowserCredential authentication failed: User canceled authentication.
Could not find tenant id for provided tenant domain 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'. Please ensure that the provided user is found in the provided tenant domain.

I have no chance to select any thing, the login window appears after the above message.

1. Way 3: Use DeviceCode

Connect-AzAccount -DeviceCode

Result:

Please select the account you want to login with.

[Login to Azure] To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code AJEAZZDUG to authenticate.
Retrieving subscriptions for the selection...
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'

[Announcements]
With the new Azure PowerShell login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271909.

If you encounter any problem, please open an issue at: https://aka.ms/azpsissue

Subscription name                            Tenant
-----------------                            ------
Non-Prod PAYG AS on a830edad9050849paygmsit3 TEST_TEST_E3_SelfServiceHb_202306290544_85XBofcIeP

Even though it shows like connected successfully, run: Get-AzSubscription to test, got no result with below warning (Repeated in console):
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'

Issue script & Debug output

$DebugPreference='Continue'
Get-AzSubscription
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:12 PM - GetAzureRMSubscriptionCommand begin processing with ParameterSet 'ListByIdInTenant'.
DEBUG: 11:36:12 PM - using account id 'automation@***.onmicrosoft.com'...
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [EnableLoginByWam], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:12 PM - [SilentAuthenticator] Calling SharedTokenCacheCredential.GetTokenAsync - TenantId:'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/', UserId:'automation@a830edad9050849paygmsit3.onmicrosoft.com'
DEBUG: SharedTokenCacheCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 002f97b6-87e4-452d-8b47-c4d7b2eef2f8] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 002f97b6-87e4-452d-8b47-c4d7b2eef2f8] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 002f97b6-87e4-452d-8b47-c4d7b2eef2f8] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 002f97b6-87e4-452d-8b47-c4d7b2eef2f8] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 002f97b6-87e4-452d-8b47-c4d7b2eef2f8] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [Runtime] WAM supported OS.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [RuntimeBroker] ListWindowsWorkAndSchoolAccounts option was not enabled.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 197572b7-1a7e-4392-9f9d-fa162e7eefb3] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] Found 1 cache accounts and 0 broker accounts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] Returning 1 accounts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] MSAL MSAL.CoreCLR with assembly version '4.60.3.0'. CorrelationId(a6f4c117-599e-4d30-8000-83ab3cfb3e33)
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] === AcquireTokenSilent Parameters ===
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] LoginHint provided: False
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] Account provided: True
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] ForceRefresh: False
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - True
HomeAccountId - False
CorrelationId - a6f4c117-599e-4d30-8000-83ab3cfb3e33
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:

DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] === Token Acquisition (SilentRequest) started:
         Scopes: https://management.core.windows.net//.default
        Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] Broker is configured and enabled, attempting to use broker instead.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [Runtime] WAM supported OS.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] Can invoke broker. Will attempt to acquire token with broker.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0001]      WARNING SetAuthorityString:98     Initializing authority from string 'https://login.microsoftonline.com/a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa/' without authority type, defaulting to MsSts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      ERROR   ErrorInternalImpl:134     Created an error: 5vt4a, StatusInternal::AccountNotFound, InternalEvent::None, Error Code 0, Context 'Account with id '(pii)' not found'
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:393      Printing Telemetry for Correlation ID: a6f4c117-599e-4d30-8000-83ab3cfb3e33
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: start_time, Value: 2024-05-22T06:36:12.000Z
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: api_name, Value: ReadAccountById
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: was_request_throttled, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: authority_type, Value: Unknown
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: msal_version, Value: 1.1.0+local
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: correlation_id, Value: a6f4c117-599e-4d30-8000-83ab3cfb3e33
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: broker_app_used, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: stop_time, Value: 2024-05-22T06:36:12.000Z
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: all_error_tags, Value: 5vt4a
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: msalruntime_version, Value: 0.16.0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: api_error_code, Value: 0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: api_error_tag, Value: 5vt4a
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: api_status_code, Value: StatusInternal::AccountNotFound
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: api_error_context, Value: Account with id '(pii)' not found
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: is_successful, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0002]      INFO    LogTelemetryData:401      Key: request_duration, Value: 0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [RuntimeBroker] Could not find a WAM account for the selected user. Error: Status: AccountNotFound
Context: Account with id '(pii)' not found
Tag: 0x1f553780
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - a6f4c117-599e-4d30-8000-83ab3cfb3e33] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: wam_no_account_for_id
HTTP StatusCode 0
CorrelationId a6f4c117-599e-4d30-8000-83ab3cfb3e33
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

DEBUG: SharedTokenCacheCredential.GetToken was unable to retrieve an access token. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:  Exception: Azure.Identity.CredentialUnavailableException (0x80131500): SharedTokenCacheCredential authentication unavailable. Token acquisition failed for user automation@a830edad9050849paygmsit3.onmicrosoft.com. Ensure that you have authenticated with a developer tool that supports Azure single sign on.
 ---> Microsoft.Identity.Client.MsalUiRequiredException (0x80131500): Could not find a WAM account for the selected user. Error: Status: AccountNotFound
Context: Account with id '(pii)' not found
Tag: 0x1f553780
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [EnableLoginByWam], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:12 PM - [SilentAuthenticator] Calling SharedTokenCacheCredential.GetTokenAsync - TenantId:'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/', UserId:'automation@a830edad9050849paygmsit3.onmicrosoft.com'
DEBUG: SharedTokenCacheCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 92c130e5-19e2-413b-ab5c-6109629873bc] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 92c130e5-19e2-413b-ab5c-6109629873bc] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 92c130e5-19e2-413b-ab5c-6109629873bc] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 92c130e5-19e2-413b-ab5c-6109629873bc] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 92c130e5-19e2-413b-ab5c-6109629873bc] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [Runtime] WAM supported OS.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [RuntimeBroker] ListWindowsWorkAndSchoolAccounts option was not enabled.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - bd4ad8a7-d588-4a61-9921-8eb04f00724e] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] Found 1 cache accounts and 0 broker accounts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] Returning 1 accounts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] MSAL MSAL.CoreCLR with assembly version '4.60.3.0'. CorrelationId(455ca45e-0cc8-495f-9bfa-e8904288fd25)
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] === AcquireTokenSilent Parameters ===
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] LoginHint provided: False
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] Account provided: True
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] ForceRefresh: False
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - True
HomeAccountId - False
CorrelationId - 455ca45e-0cc8-495f-9bfa-e8904288fd25
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:

DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] === Token Acquisition (SilentRequest) started:
         Scopes: https://management.core.windows.net//.default
        Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] Broker is configured and enabled, attempting to use broker instead.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [Runtime] WAM supported OS.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] Can invoke broker. Will attempt to acquire token with broker.
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0001]      WARNING SetAuthorityString:98     Initializing authority from string 'https://login.microsoftonline.com/a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa/' without authority type, defaulting to MsSts
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      ERROR   ErrorInternalImpl:134     Created an error: 5vt4a, StatusInternal::AccountNotFound, InternalEvent::None, Error Code 0, Context 'Account with id '(pii)' not found'
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:393      Printing Telemetry for Correlation ID: 455ca45e-0cc8-495f-9bfa-e8904288fd25
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: start_time, Value: 2024-05-22T06:36:12.000Z
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: api_name, Value: ReadAccountById
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: was_request_throttled, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: authority_type, Value: Unknown
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: msal_version, Value: 1.1.0+local
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: correlation_id, Value: 455ca45e-0cc8-495f-9bfa-e8904288fd25
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: broker_app_used, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: stop_time, Value: 2024-05-22T06:36:12.000Z
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: all_error_tags, Value: 5vt4a
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: msalruntime_version, Value: 0.16.0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: api_error_code, Value: 0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: api_error_tag, Value: 5vt4a
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: api_status_code, Value: StatusInternal::AccountNotFound
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: api_error_context, Value: Account with id '(pii)' not found
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: is_successful, Value: false
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [MSAL:0003]      INFO    LogTelemetryData:401      Key: request_duration, Value: 0
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z] [RuntimeBroker] Could not find a WAM account for the selected user. Error: Status: AccountNotFound
Context: Account with id '(pii)' not found
Tag: 0x1f553780
DEBUG: False MSAL 4.60.3.0 MSAL.CoreCLR .NET 8.0.4 Microsoft Windows 10.0.22631 [2024-05-22 06:36:12Z - 455ca45e-0cc8-495f-9bfa-e8904288fd25] Exception type: Microsoft.Identity.Client.MsalUiRequiredException
, ErrorCode: wam_no_account_for_id
HTTP StatusCode 0
CorrelationId 455ca45e-0cc8-495f-9bfa-e8904288fd25
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

DEBUG: SharedTokenCacheCredential.GetToken was unable to retrieve an access token. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:  Exception: Azure.Identity.CredentialUnavailableException (0x80131500): SharedTokenCacheCredential authentication unavailable. Token acquisition failed for user automation@a830edad9050849paygmsit3.onmicrosoft.com. Ensure that you have authenticated with a developer tool that supports Azure single sign on.
 ---> Microsoft.Identity.Client.MsalUiRequiredException (0x80131500): Could not find a WAM account for the selected user. Error: Status: AccountNotFound
Context: Account with id '(pii)' not found
Tag: 0x1f553780
WARNING: Unable to acquire token for tenant 'a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa' with error 'Authentication failed against tenant a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId a065c5e1-13a0-4485-8bc7-0eeca4ebb4aa'.'
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent:  Module: Az.Accounts:3.0.0; CommandName: Get-AzSubscription; PSVersion: 7.4.2; IsSuccess: True; Duration: 00:00:00.0749216; SanitizeDuration: 00:00:00
DEBUG: 11:36:12 PM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:12 PM -

Environment data

Name                           Value
----                           -----
PSVersion                      7.4.2
PSEdition                      Core
GitCommitId                    7.4.2
OS                             Microsoft Windows 10.0.22631
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     3.0.0                 Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefaul…
Script     0.3.2                 Az.CostManagement                   {Get-AzCostManagementExport, Get-AzCostManagementExportExecutionHis…
Script     7.1.0                 Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignmen…
Script     7.0.0                 Az.Storage                          {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementP…

Error output

DEBUG: 11:36:46 PM - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:46 PM - ResolveError begin processing with ParameterSet 'AnyErrorParameterSet'.
DEBUG: 11:36:46 PM - using account id 'automation@a830edad9050849paygmsit3.onmicrosoft.com'...
DEBUG: 11:36:46 PM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].


DEBUG: 11:36:46 PM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:46 PM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent:  Module: Az.Accounts:3.0.0; CommandName: Resolve-AzError; PSVersion: 7.4.2; IsSuccess: True; Duration: 00:00:00.0019185; SanitizeDuration: 00:00:00
DEBUG: 11:36:46 PM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 11:36:46 PM - ResolveError end processing.

[msqishengc]

Confirmed that the exact same command, with the exact same Entra ID account and tenant works as expected with Az.Accounts v2.19.0.

[bbz94]

I'm having the same issue.

[msqishengc]

Run this before Connect Az account resolved my issue:
Update-AzConfig -EnableLoginByWam $false

Got it from #24962 #24962

[bbz94]

Run this before Connect Az account resolved my issue: Update-AzConfig -EnableLoginByWam $false

Got it from #24962 #24962

Helped to solve the problem.

[isra-fel]

Way 1 and Way 3 are reported by #24963 and can be workarounded by disabling WAM for login Update-AzConfig -EnableLoginByWam $false.

Way 2 is new to us, could you share more about your environment?

1. By "I have no chance to select any thing, the login window appears after the above message.", was the window a browser window or a windows native window (not your browser)?
2. Does this happen all the time?
3. Did it happen before or after you applied the workaround?

Thanks a lot

[msqishengc]

Way 1 and Way 3 are reported by #24963 and can be workarounded by disabling WAM for login Update-AzConfig -EnableLoginByWam $false.

Way 2 is new to us, could you share more about your environment?

1. By "I have no chance to select any thing, the login window appears after the above message.", was the window a browser window or a windows native window (not your browser)?
2. Does this happen all the time?
3. Did it happen before or after you applied the workaround?

Thanks a lot

I would simply repro on a new VM or Sandbox on Windows 11.

1. Install PowerShell 7 with installer (according to https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.4)
2. Open Powershell console, install the module: Install-Module -Name Az.Accounts -Force -Verbose -Scope CurrentUser -ErrorAction Stop -AllowClobber -SkipPublisherCheck -Repository PSGallery
3. Run Connect-AzAccount or Connect-AzAccount with -TenantId **** parameter, both failed immediately with Sign in modal dialog opened, and if I dismiss the Sign in dialog, The console could not be focused anymore that I need to kill it by task manager.

[isra-fel]

For the record: the window pop-up-too-late issue was also reported by users of Azure CLI - Azure/azure-cli#28997