[AzureStack] az keyvault create fails with error "the endpoint 'microsoft_graph_resource_id' for this cloud is not set but is used". azure-cli version 2.37.0

[rakku-ms]

Related command

az keyvault

Describe the bug

Starting az cli version 2.37.0, creation of keyvault in Azure Stack is failing with error "The endpoint 'microsoft_graph_resource_id' for this cloud is not set but is used"
The same command works with version 2.36.0

To Reproduce

• az login # login to any Azure Stack Environment
• az keyvault create --name {} --resource-group {} --location {}

Environment summary

Windows-10-10.0.22000-SP0
Python 3.10.4
Installer: MSI

azure-cli 2.37.0

Additional context
Error Log

cli.azure.cli.core.azclierror: The endpoint 'microsoft_graph_resource_id' for this cloud is not set but is used.
C:\Users\<user>\.azure\clouds.config may be corrupt or invalid.
Resolve the error or delete this file and try again.

[evelyn-ys]

Hi @rakku-ms, keyvault creation would query Graph API to auto assign access policies. Along with our migration from AAD Graph to MS Graph, azure stack will be influenced because there's no MS Graph support in Azure Stack. See Azure CLI MS Graph Known issues

There're two solutions:

1. Do not upgrade Azure CLI in Azure Stack environments. You can install Azure CLI <=2.36.0 following install specific version
2. If you don't want to uninstall the latest and install older version, please create keyvault with --no-self-perms to skip auto assignment of access policies. You can update access policies manually with az keyvault set-policy later.

[rakku-ms]

FYI @sarathys @TheOnlyWei @vasanthrajams

[bganapa]

We updated the docs to guide the users to install 2.29.2 or earlier for AzureStack usages

https://docs.microsoft.com/en-us/azure-stack/user/azure-stack-version-profiles-azurecli2?view=azs-2108&tabs=ad-win
You must use Azure CLI version 2.29.2 or earlier with Azure Stack Hub. Microsoft has discovered an issue with Azure Stack Hub that prevents using Azure CLI version 2.30.0 or newer.

[TheOnlyWei]

It seems for AAD you can bypass this error by adding the missing MS Graph endpoint manually during az cloud register, such as via the JSON config method:

az cloud register -n $environmentName --cloud-config @"<PATH TO JSON CONFIG>\cloud.json"

(Put a '`' mark before '@' if you're using PowerShell because '@' is a language symbol for PowerShell)

JSON config cloud.json example:

{
  "endpoints":{
    "microsoftGraphResourceId": "https://graph.microsoft.com",
    "resourceManager": "...",
    "vmImageAliasDoc": "..."
  },
  "profile": "2020-09-01-hybrid",
  "suffixes":{
    "storageEndpoint": "...",
    "keyvaultDns": "..."
  }
}

The microsoftGraphResourceId property is required here to be manually set to work-around the error, along with the other values you might have usually set.
You can also attempt to set these values via parameters. For more information about configuring the cloud during az cloud register, see the official documentation:
https://learn.microsoft.com/en-us/cli/azure/cloud?view=azure-cli-latest#az-cloud-register

Currently microsoftGraphResourceId property can be set along with activeDirectoryGraphResourceId for both AAD and ADFS environments from what I tested. activeDirectoryGraphResourceId is set by Azure CLI during the below ARM metadata endpoint call:

azure-cli/src/azure-cli/azure/cli/command_modules/cloud/custom.py

Line 72 in 04caa20

required_endpoints = {'resource_manager': '--endpoint-resource-manager',

[TheOnlyWei]

Updated here with work-around for ADFS on latest Azure CLI:
https://learn.microsoft.com/en-us/azure-stack/user/azure-stack-version-profiles-azurecli2?view=azs-2306&tabs=ad-win#microsoft-graph-issues