How to replicate `az login -identity` with pwsh from within a VM assigned a Service Principal

Question

From within a VM with a System Assigned Identity (Not a User Assigned Managed Identity).

I am able to authenticate via the az cli by typing az login -identity and can perform operations based on the RoleAssignments to the VM's Service Principal.

However when I try to do the same using pwsh: Connect-AzAccount -Identity I get an error:

WARNING: Unable to acquire token for tenant 'organizations' with error 'ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found.'
Connect-AzAccount: ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found.

However if I run Connect-AzAccount -Identity a second time immediately after it seems to work:

PS /root> Connect-AzAccount -Identity

Account   SubscriptionName     TenantId                             Environment
-------   ----------------     --------                             -----------
MSI@XXXXX <subscriptionName>   <tenantId>                           AzureCloud

Is there something I can do to avoid having this warning displayed?

Answer 1

I tried to repro in my local within VM using Connect-AzAccount -Identity and it works fine for me in first time.

> WARNING: Unable to acquire token for tenant 'organizations' with error
> 'ManagedIdentityCredential authentication unavailable. No Managed
> Identity endpoint found.' Connect-AzAccount: ManagedIdentityCredential
> authentication unavailable. No Managed Identity endpoint found. ```

For the above error , If MFA is enabled for that tenant or identity, then such prompts occurs. It could be the reason that the id through which you have logged on to the device is enabled with MFA and until they point the token in the device for user gets verified, it gives out this error.

Or , it could be a network connection lag or delay due to which the first time you might be encountering this warning.

For more information please refer the below links:

. Unable to acquire token for tenant 'organizations'|GitHub.

. Powershell Connect-AzAccount error| MS Q&A