[Question]: Issue with the Federate Credential login on Azure Cli task

[jasidhu]

Task name

Azure CLI

Task version

2.239.3

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

Azure DevOps Server (Please specify exact version in the textbox below)

Azure DevOps Server Version (if applicable)

No response

Operation system

Windows

Question

We are getting following error when trying to run az login using the service principal and Federate Credential.

[command]C:\Windows\system32\cmd.exe /D /S /C ""C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" login --service-principal -u *** --tenant {OurTenantId} --allow-no-subscriptions --federated-token ***"

2024-05-15T20:47:16.2950443Z Error: Error building ARM Config: Authenticating using the Azure CLI is only supported as a User (not a Service Principal).
2024-05-15T20:47:16.2950869Z 
2024-05-15T20:47:16.2951508Z To authenticate to Azure using a Service Principal, you can use the separate 'Authenticate using a Service Principal'
2024-05-15T20:47:16.2952047Z auth method - instructions for which can be found here: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_client_secret
2024-05-15T20:47:16.2952264Z 
2024-05-15T20:47:16.2952449Z Alternatively you can authenticate using the Azure CLI by using a User Account.

Can you please provide some guidance how to resolve this issue?

[v-bsanthanak]

@jasidhu Please share the complete debug logs for further investigation.

[jasidhu]

@v-bsanthanak I have attached the log file below.

tasklog_28.log

[v-bsanthanak]

@jasidhu Attached logs are not the debug logs. Please set system.debug - true and share the complete logs.

[jasidhu]

@v-bsanthanak Attaching the debug logs.

tasklog.log

@jasidhu Attached logs are not the debug logs. Please set system.debug - true and share the complete logs.

[v-schhabra]

@jasidhu We are checking on the issue above and will share the updates soon.

[v-schhabra]

Hi @jasidhu Please follow this doc to create WIF service connection in AzureCLI task with Terraform
https://devblogs.microsoft.com/devops/introduction-to-azure-devops-workload-identity-federation-oidc-with-terraform/#:~:text=We%E2%80%99ll%20cover%3A%201%20Why%20use%20Workload%20identity%20federation,an%20Azure%20DevOps%20Pipeline%20with%20the%20Terraform%20task