Find-PSResource: Response returned status code: Unauthorized - when cli auth to another tenant

[jpomfret]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.

Steps to reproduce

I have connected with Azure PowerShell module to the correct tenant, but the az cli is authenticated to a different tenant, then when I search for resources I get unauthorized errors.

Find-PSResource: Response returned status code: Unauthorized

Context

# This shows I'm connected to the tenant where the ACR lives
Get-AzContext

# This shows I'm connected to a separate client tenant that is totally unrelated
az account show 

Set up the acr as repository

$acr = Get-AzContainerRegistry -Name acrName -ResourceGroupName rg-name
$acrUrl = "https://$($Acr.LoginServer)"
Register-PSResourceRepository -Name acrName-Uri $acrUrl
Get-PSResourceRepository

I can see the repository is registered:

Search for the resource

Find-PSResource -Name resourceName -Repository acrName -Prerelease

Fails with the following

Current workaround

If I logout of az cli then I can successfully see the resource

az logout
Find-PSResource -Name resourceName -Repository acrName -Prerelease

And it now works, I can also install the resource at this point.

Expected behavior

Authentication should look for the token from Connect-AzAccount and ignore az cli tokens.
Also the error message could be more helpful, no indication of what it's trying to authenticate to.

Actual behavior

Looking for resource while authenticated to the correct tenant with Azure PowerShell but the wrong tenant with az cli I cannot find resources

> Find-PSResource: Response returned status code: Unauthorized

Error details

get-error                                                                                       in pwsh at 08:14:54

Exception             :
    Type       : Microsoft.PowerShell.PSResourceGet.UtilClasses.UnauthorizedException
    TargetSite :
        Name          : MoveNext
        DeclaringType : [Microsoft.PowerShell.PSResourceGet.ContainerRegistryServerAPICalls+<SendRequestAsync>d__62]
        MemberType    : Method
        Module        : Microsoft.PowerShell.PSResourceGet.dll
    Message    : Response returned status code: Unauthorized.
    Source     : Microsoft.PowerShell.PSResourceGet
    HResult    : -2146233088
    StackTrace :
   at Microsoft.PowerShell.PSResourceGet.ContainerRegistryServerAPICalls.SendRequestAsync(HttpRequestMessage message) in
C:\__w\1\s\PSResourceGet\src\code\ContainerRegistryServerAPICalls.cs:line 1143
   at Microsoft.PowerShell.PSResourceGet.ContainerRegistryServerAPICalls.GetHttpResponseJObjectUsingContentHeaders(String url, HttpMethod
method, String content, Collection`1 contentHeaders, ErrorRecord& errRecord) in
C:\__w\1\s\PSResourceGet\src\code\ContainerRegistryServerAPICalls.cs:line 1024
TargetObject          : Microsoft.PowerShell.PSResourceGet.Cmdlets.FindPSResource
CategoryInfo          : InvalidResult: (Microsoft.PowerShel…lets.FindPSResource:FindPSResource) [Find-PSResource], UnauthorizedException
FullyQualifiedErrorId : UnauthorizedRequest,Microsoft.PowerShell.PSResourceGet.Cmdlets.FindPSResource
InvocationInfo        :
    MyCommand        : Find-PSResource
    ScriptLineNumber : 1
    OffsetInLine     : 1
    HistoryId        : 22
    Line             : Find-PSResource -Name resourceName -Repository acrName -Prerelease
    Statement        : Find-PSResource -Name resourceName -Repository acrName -Prerelease
    PositionMessage  : At line:1 char:1
                       + Find-PSResource -Name resourceName -Repository acrName -Prerel …
                       + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    InvocationName   : Find-PSResource
    CommandOrigin    : Internal
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo :
      0

Environment data

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Binary     1.2.0      preview2   Microsoft.PowerShell.PSResourceGet  {Compress-PSResource, Find-PSResource, Get-InstalledPSResource, Get-PSRes…



Name                           Value
----                           -----
PSVersion                      7.4.11
PSEdition                      Core
GitCommitId                    7.4.11
OS                             Microsoft Windows 10.0.26100
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

No response

[anamnavi]

Hi @jpomfret thanks for reaching out about this and my apologies for the delay in triaging this! We use the Azure.Identity DefaultCredentialOptions class in our code and per their docs this is expected behavior as DefaultCredentialOptions will check AzureCliCredential before AzurePowerShellCredential and stop if the first provides the token.

To choose which token you want to use you can use SecretManagement to store your token and tenantID and that will be prioritized over getting a token with AzureIdentity (which has the default ordering mentioned above).