Error: failed during request visitor: default auth: cannot configure default credentials

[chuongmep]

Describe the issue

The issues happend when install latest cli issues #5022
I have check all config Oauth is fine

Configuration

Please provide a minimal reproducible configuration for the issue

Steps to reproduce the behavior

Please list the steps required to reproduce the issue, for example:

1. Setup azure devops pipeline to deploy bundle
2. Setup set update databricks cli

stages:
  - stage: DeployBundle
    dependsOn: []
    jobs:
      - job: Setup
        steps:
          - bash: |
              set -euxo pipefail
              
              # Remove existing Databricks CLI if present
              sudo rm -f /usr/local/bin/databricks
              
              # Install latest Databricks CLI (fixes expired key issue)
              curl -fsSL https://raw.githubusercontent.com/databricks/setup-cli/main/install.sh | sudo sh
              databricks version
            displayName: Setup CLI

4. Run job validate ```databricks bundle validate -t stg

4. See error
### Expected Behavior

It's should pass validate step, this is no issue before update into latest patch databricks-cli

### Actual Behavior
Clear and concise description of what actually happened

### OS and CLI version
Please provide the version of the CLI (eg: v0.1.2) and the operating system (eg: windows). You can run databricks --version to get the version of your Databricks CLI

### Is this a regression?
Did this work in a previous version of the CLI? If so, which versions did you try?

### Debug Logs

```bash
2026-04-21T02:04:11.6513419Z ##[section]Starting: validate bundle
2026-04-21T02:04:11.6531094Z ==============================================================================
2026-04-21T02:04:11.6531618Z Task         : Bash
2026-04-21T02:04:11.6531919Z Description  : Run a Bash script on macOS, Linux, or Windows
2026-04-21T02:04:11.6532295Z Version      : 3.268.1
2026-04-21T02:04:11.6532565Z Author       : Microsoft Corporation
2026-04-21T02:04:11.6533013Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
2026-04-21T02:04:11.6533346Z ==============================================================================
2026-04-21T02:04:11.8491088Z Generating script.
2026-04-21T02:04:11.8515396Z ========================== Starting Command Output ===========================
2026-04-21T02:04:11.8516919Z [command]/usr/bin/bash /home/azureuser/azdo-agent/_work/_temp/d765e29f-d519-4911-b967-a0dce5f81738.sh
2026-04-21T02:04:11.8596250Z + databricks bundle validate -t stg
2026-04-21T02:04:11.8599371Z + tee validate.log
2026-04-21T02:04:14.4868129Z Error: failed during request visitor: default auth: cannot configure default credentials, please check https://docs.databricks.com/en/dev-tools/auth.html#databricks-client-unified-authentication to configure credentials for your preferred authentication method. Config: host=h*****, account_id=****, workspace_id=****, azure_tenant_id=****, client_id=****, client_secret=***. Env: DATABRICKS_HOST, DATABRICKS_CLIENT_ID, DATABRICKS_CLIENT_SECRET
2026-04-21T02:04:14.4893419Z 
2026-04-21T02:04:14.4894082Z Name: neptune-app_bundle
2026-04-21T02:04:14.4894359Z Target: stg
2026-04-21T02:04:14.4894662Z Workspace:
2026-04-21T02:04:14.4895029Z   Host: https://adb-2882069107202698.18.azuredatabricks.net
2026-04-21T02:04:14.4895498Z   Path: ${var.deployment_root}/${bundle.name}/${bundle.target}
2026-04-21T02:04:14.4895661Z 
2026-04-21T02:04:14.4914096Z Found 1 error
2026-04-21T02:04:14.4930801Z 
2026-04-21T02:04:14.4966057Z ##[error]Bash exited with code '1'.
2026-04-21T02:04:14.5011040Z ##[section]Finishing: validate bundle

[andrewnester]

@chuongmep which CLI version did you use before?

[simonfaltum]

The azure_tenant_id in that error output is a red herring. Here's what I think is happening:

Your host is Azure (adb-*.azuredatabricks.net), so the azure-cli auth strategy is relevant to the auth chain. When the chain reaches it, it unconditionally hits your Databricks host's /aad/auth endpoint and extracts the tenant ID from the redirect URL, populating azure_tenant_id on the config. This is a side effect that fires even when Azure CLI isn't installed or logged in, and even when you never intended to use Azure CLI auth. The strategy itself then fails and moves on, but the tenant stays on the config.

So by the time the chain has tried every strategy and falls through to cannot configure default credentials, the debug output prints the current config, which by then has a stale tenant ID on it. account_id and workspace_id get populated for a different reason (the SDK auto-fetches /.well-known/databricks-config during config resolution) but they're not causing the failure either.

The real question is why the oauth-m2m strategy (which matches your DATABRICKS_CLIENT_ID/DATABRICKS_CLIENT_SECRET) isn't succeeding when it was before. That's not visible from the error above. Could you share:

1. The CLI version you were running before the upgrade ?
2. Debug logs: databricks bundle validate -t stg --log-level=debug 2>&1 | head -300
3. Whether pinning to v0.295.1 reproduces the issue ?

- uses: databricks/setup-cli@main
  with:
    version: 0.295.1

v0.295.1 has the TF key fix from #5022 but is on an older SDK. If it works there and fails on v0.296+, that narrows it to changes in the SDK bump.

[chuongmep]

Hi @andrewnester
v0.297.1 | v0.297.2
This is version I'm upgraded, but just for you information, we have fixed by configuration with databricks apps
Thank you for your help. the issues resolved .