Fix error message for failed domain login to include the correct credential type

[slavizh]

Description

When you want to be asked for credentials interactively the Connect-AzureRmAccount with domain provided does not work.

Script/Steps for Reproduction

Connect-AzureRmAccount -TenantId contoso.onmicrosoft.com

Connect-AzureRmAccount : Value cannot be null.
Parameter name: Could not find tenant id for provided tenant domain 'contoso.onmicrosoft.com. Please ensure that
 the provided service principal is found in the provided tenant domain.
At line:1 char:1
+ Connect-AzureRmAccount -TenantId contoso.onmicrosoft.com
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Connect-AzureRmAccount], ArgumentNullException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand

Doing something like this works:

Connect-AzureRmAccount -TenantId contoso.onmicrosoft.com -Credential (Get-Credential)

Module Version

PS C:\WINDOWS\system32> Get-Module -Name AzureRM -ListAvailable


    Directory: C:\Program Files\WindowsPowerShell\Modules


ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     6.7.0      AzureRM

Environment Data

$PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.17134.228
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17134.228
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Debug Output

This is easily reproducible so no debug is needed.

[markcowl]

@slavizh Can you verify which actual domain name you used for this, and whether you were using an msa account, or a work or school account?

[slavizh]

@markcowl I cannot specify the exact domain as I do not want to reveal information for a customer. I do not think the actual domain matters as long as the scenario described above is achieved. I've used Azure AD account (work). I haven't tried if the above scenario appears for MSA as well. Make sure that command Clear-AzureRmContext is executed before trying this scenario as if previous contexts are present you will not see the error.

[markcowl]

@slavizh The reason I ask is to determine if this is a real domain name with Azure assets that the user has access to. The actual domain name doesn't matter.

[slavizh]

@markcowl Yes, it is a real domain.

[markcowl]

@maddieclayton This looks like a logic error when determining the paramneter set - these parameters shoudl result in an interactive login, but instead are resulting in an attempt at SPN login.

[markcowl]

Description

The message returned when domain lookup fails should look at the accoutn type, rether than assuming it is an SPN

• Change the message to make the account type variable

Cost: 1

[cormacpayne]

This has been fixed and will be available in the upcoming release (2018-11-06)

[shellby1]

Hi,
Have the same issue with CMDLet

Connect-AzAccount -Credential $ServicePrincipal -Tenant $configurationData.azureTenant
Parameter 'Could not find tenant id for provided tenant domain 'PD*********'. Please ensure that the provided service principal '************-****-****-****-**************' is found in the provided tenant domain.'