Skip to content

[BUG]: Azure Powershell credentials fail to refresh on linux agents when running in parallel #21104

Open
@brianwp3000

Description

@brianwp3000

New issue checklist

Task name

AzurePowershell

Task version

5.257.0

Issue Description

We have a pipeline that runs an AzurePowershell task to interact with several of our Azure resources. We recently added parallelism to the task, but that is now causing our Linux build agents to fail with this error:

Get-AzStorageAccount: ‌
Line |‌
     7 | ‌ … eContext = (‌Get-AzStorageAccount -ResourceGroupName $resourceGroupNam‌ …‌
        | ‌               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~‌
        | ‌Your Azure credentials have not been set up or have expired, please run Connect-AzAccount to set up your Azure credentials.‌
ClientAssertionCredential authentication failed: Persistence check failed. Data was written but it could not be read. Possible cause: on Linux, LibSecret is installed but D-Bus isnt running because it cannot be started over SSH.‌

We are unable to call Connect-AzAccount again, because that was called by the Azure Powershell task using our Service Connection credentials that we don't have access to inside of our script.

When we run this pipeline on a Windows build agent, it succeeds--the credentials are only failing to refresh on Linux build agents.

Environment type (Please select at least one enviroment where you face this issue)

  • Self-Hosted
  • Microsoft Hosted
  • VMSS Pool
  • Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Ubuntu 22.04

Relevant log output

2025-06-23T18:02:39.5849266Z ##[section]Starting: Upload VmAgent
2025-06-23T18:02:39.5854293Z ==============================================================================
2025-06-23T18:02:39.5854397Z Task         : Azure PowerShell
2025-06-23T18:02:39.5854446Z Description  : Run a PowerShell script within an Azure environment
2025-06-23T18:02:39.5854688Z Version      : 5.257.0
2025-06-23T18:02:39.5854745Z Author       : Microsoft Corporation
2025-06-23T18:02:39.5854801Z Help         : https://aka.ms/azurepowershelltroubleshooting
2025-06-23T18:02:39.5854862Z ==============================================================================
2025-06-23T18:02:39.8220956Z AZUREPS_HOST_ENVIRONMENT: ADO/AzurePowerShell@v5_Linux_1es-mps-pme-nonprod 2_MP_VMAgent_984120_MP VM Agent_29161
2025-06-23T18:02:39.8263598Z Generating script.
2025-06-23T18:02:40.7104285Z Formatted command: . '/mnt/vss/_work/r1/a/MP_VMAgent/ReleaseScript-release/BuildReleaseScript.ps1' -buildNumber testingTokenCache-250623-01 -dropLocation /mnt/vss/_work/r1/a\MP_VMAgent -env PmePpe
2025-06-23T18:02:40.7328851Z [command]/usr/bin/pwsh -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command . '/mnt/vss/_work/_temp/d8d6f3a9-7430-4980-84a0-fa1f3ac3ed9b.ps1'
2025-06-23T18:02:40.7329227Z File saved!
2025-06-23T18:02:41.5809226Z ##[command]Import-Module -Name /usr/share/az_12.1.0/Az.Accounts/5.1.0/Az.Accounts.psd1 -Global
2025-06-23T18:02:41.9657245Z ##[command]Clear-AzContext -Scope Process
2025-06-23T18:02:42.1026831Z ##[command]Clear-AzContext -Scope CurrentUser -Force -ErrorAction SilentlyContinue
2025-06-23T18:02:42.1160695Z ##[command] Connect-AzAccount -ServicePrincipal -Tenant 975f013f-7f24-47e8-a7d3-abc4752bf346 -ApplicationId *** -FederatedToken ***** -Environment AzureCloud -Scope Process
2025-06-23T18:02:42.3182802Z ‌WARNING: TenantId 975f013f-7f24-47e8-a7d3-abc4752bf346 contains more than one active subscription. First one will be selected for further use. To select another subscription, use Set-AzContext.‌
2025-06-23T18:02:42.3184189Z ‌WARNING: To override which subscription Connect-AzAccount selects by default, use `Update-AzConfig -DefaultSubscriptionForLogin 00000000-0000-0000-0000-000000000000`. Go to https:go.microsoft.comfwlink?linkid=2200610 for more information.‌
2025-06-23T18:02:42.4039644Z ##[command] Set-AzContext -SubscriptionId 91290f21-f61e-4117-af20-300136ea7083 -TenantId 975f013f-7f24-47e8-a7d3-abc4752bf346
2025-06-23T18:02:43.9127615Z Using environment: PmePpe
2025-06-23T18:02:43.9136896Z Using storageAccountEnv: ppe
2025-06-23T18:02:44.1630445Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentseas).Context)
2025-06-23T18:02:44.1631197Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentsdc).Context)
2025-06-23T18:02:44.1631805Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentaue).Context)
2025-06-23T18:02:44.1635244Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentfrc).Context)
2025-06-23T18:02:44.1688908Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentbrs).Context)
2025-06-23T18:02:44.1706058Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentjaw).Context)
2025-06-23T18:02:44.1802147Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentneu).Context)
2025-06-23T18:02:44.1868911Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagenteus).Context)
2025-06-23T18:02:44.1924408Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentcus).Context)
2025-06-23T18:02:44.3102135Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentcac).Context)
2025-06-23T18:02:44.3300990Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentwus).Context)
2025-06-23T18:02:44.3860401Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentsafn).Context)
2025-06-23T18:02:44.4392356Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentweu).Context)
2025-06-23T18:02:44.4397790Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentwus2).Context)
2025-06-23T18:02:44.4399433Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentjae).Context)
2025-06-23T18:02:44.4866359Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentkoc).Context)
2025-06-23T18:02:44.5226799Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentscus).Context)
2025-06-23T18:02:44.6637169Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentuaen).Context)
2025-06-23T18:02:44.8310827Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentncus).Context)
2025-06-23T18:02:44.9251711Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagenteus2).Context)
2025-06-23T18:02:47.6183759Z ‌WARNING: INITIALIZATION: Token cache encryption is not supported in current environment and token cache will be fallen back as plain text.‌
2025-06-23T18:02:47.8900076Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentncus).Context)
2025-06-23T18:02:47.8903366Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentncus).Context)
2025-06-23T18:02:47.9068295Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentscus).Context)
2025-06-23T18:02:47.9070991Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentscus).Context)
2025-06-23T18:02:47.9186963Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentcac).Context)
2025-06-23T18:02:47.9190285Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentcac).Context)
2025-06-23T18:02:47.9945324Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentwus2).Context)
2025-06-23T18:02:47.9946646Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentwus2).Context)
2025-06-23T18:02:48.0057186Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentjae).Context)
2025-06-23T18:02:48.0066870Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentjae).Context)
2025-06-23T18:02:48.0119174Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentaue).Context)
2025-06-23T18:02:48.0125861Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentaue).Context)
2025-06-23T18:02:48.0537038Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentkoc).Context)
2025-06-23T18:02:48.0551456Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentkoc).Context)
2025-06-23T18:02:48.0613383Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagenteus).Context)
2025-06-23T18:02:48.0621188Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagenteus).Context)
2025-06-23T18:02:48.0666289Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentsdc).Context)
2025-06-23T18:02:48.0671881Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentsdc).Context)
2025-06-23T18:02:48.0672761Z Success! (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentbrs).Context)
2025-06-23T18:02:48.0673628Z Attempting (Get-AzStorageAccount -ResourceGroupName VmAgentStorage -Name pfmpsppevmagentbrs).Context)
2025-06-23T18:03:01.3429646Z ‌Get-AzStorageAccount: ‌
2025-06-23T18:03:01.3430064Z ‌Line |‌
2025-06-23T18:03:01.3430553Z ‌   7 | ‌ … eContext = (‌Get-AzStorageAccount -ResourceGroupName $resourceGroupNam‌ …‌
2025-06-23T18:03:01.3431578Z ‌     |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~‌
2025-06-23T18:03:01.3432492Z ‌     | ‌Your Azure credentials have not been set up or have expired, please run Connect-AzAccount to set up your Azure credentials.‌
2025-06-23T18:03:01.3433561Z ‌ClientAssertionCredential authentication failed: Persistence check failed. Data was written but it could not be read. Possible cause: on Linux, LibSecret is installed but D-Bus isnt running because it cannot be started over SSH.‌
2025-06-23T18:03:01.4218255Z 
2025-06-23T18:03:01.4368869Z ##[error]PowerShell exited with code '1'.
2025-06-23T18:03:01.4379749Z [command]/usr/bin/pwsh -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command . '/mnt/vss/_work/_tasks/AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62/5.257.0/RemoveAzContext.ps1'
2025-06-23T18:03:02.3609548Z ##[command]Disconnect-AzAccount -Scope CurrentUser -ErrorAction Stop
2025-06-23T18:03:02.4364398Z ##[command]Disconnect-AzAccount -Scope Process -ErrorAction Stop
2025-06-23T18:03:02.4620642Z ##[command]Clear-AzContext -Scope Process -ErrorAction Stop
2025-06-23T18:03:02.6106674Z 
2025-06-23T18:03:02.6208553Z ##[section]Finishing: Upload VmAgent

Full task logs with system.debug enabled

 [REPLACE THIS WITH YOUR INFORMATION] 

Repro steps

This is the minimal repro script we're running in an AzurePowershell task:


$storageAccounts = <list of storage account names>
$resourceGroupName = <resource group name that the storage accounts are in>

$storageAccounts | ForEach-Object -Parallel {
    $endTime = (Get-Date).AddMinutes(5);
    $storageAccountName = $_
    $resourceGroupName = $using:resourceGroupName
    while ((Get-Date) -lt $endTime) {
      Start-Sleep 10
      Write-Host "Attempting (Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName).Context)"
      # This works the first few times but eventually throws the ClientAssertionCredential error
      $storageContext = (Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName).Context
      Write-Host "Success! (Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName).Context)"
    }
} -ThrottleLimit 10

Write-Host "DONE"

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions