az login not working for Dogfood: AADSTS50011

[shivamkm07]

Describe the bug

I have created an Azure PPE tenant and I am able to login to Azure Dogfood portal(https://df.onecloud.azure-test.net/) with it. I am also able to login to Visual ARM with same tenant and call APIs etc. But when trying to login using az cli, I am getting below error. I have followed this document to setup az cli: https://armwiki.azurewebsites.net/rp_onboarding/testing/dogfood.html#azcli

Related command

az login

Errors

Issue script & Debug output

Command ran: az login
Error: Mentioned above

Expected behavior

az login works successfully for dogfood

Environment Summary

azure-cli 2.67.0

core 2.67.0
telemetry 1.1.0

Extensions:
k8s-extension 1.6.2

Dependencies:
msal 1.31.0
azure-mgmt-resource 23.1.1

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\shivamkumar.azure\cliextensions'

Python (Windows) 3.12.7 (tags/v3.12.7:0b05ead, Oct 1 2024, 02:44:45) [MSC v.1941 32 bit (Intel)]

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az login failed #13389

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Check if there are any special settings in your environment that might be causing the issue, such as an incorrect endpoint. The endpoint in the log should not be api-dogfood.resources.windows-int.net. Please verify your environment settings.

Reference:

• az login failed #13389 (comment)

[jiasli]

With WAM turned on (az config set core.enable_broker_on_windows=true), az login --allow-no-subscriptions gives me another error AADSTS5000224 (#29082 (comment)):

@shivamkm07, did you provide --tenant {tenant_id} while running az login?

[jiasli]

@shivamkm07, Please directly reach me on Teams.

[jiasli]

The error is because ms-appx-web://Microsoft.AAD.BrokerPlugin/04b07795-8ddb-461a-bbee-02f9e1bf7b46 is not registered as one of Azure CLI's redirect URIs in Dogfood/PPE environment.

Workaround
For now, you may follow https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively#sign-in-with-web-account-manager-wam-on-windows to turn off WAM.