Azure CLI 'asm' mode only works with co-admins

[irwinwilliams]

CLI Version: 0.10.13 (node: 6.10.2)
OS Type: Win 10
Installation via: npm

Mode: ASM

Environment: AzureCloud

Description:
I have an app service in azure that I made a user in AD to manage. The user was granted owner on the app service.
When I used the azure cli to login with the user and run, "azure site log tail [sitename]", I got this error:

The server failed to authenticate the request. Verify that the
certificate is valid and is associated with this subscription

Only after I make the user a co-admin

Steps to reproduce:
0) Make an app service [appservicename]

1. Make a user in Azure AD
2. Make the user an owner of the resource in 0)
3. run this command in azure cli: azure site log tail [appservicename]
   Observe this error:

The server failed to authenticate the request. Verify that the certificate is valid and is associated with this subscription.

After I made the user a co-admin the error stopped happening.

[balajikris]

tagging @yugangw-msft, @amarzavery - could one of you comment on this (if this is by-design or a bug and who should look at this if this is a bug). I do not have context on ASM to make a decision here.

[yugangw-msft]

I have an app service in azure that I made a user in AD to manage. The user was granted owner on the app service.

For role based access control, you have to do it under ARM mode. It is, by design, not working for ASM.
Suggest you try out CLI 2.0 which supports the log tail command.