Authentication Fails: Account has previously been signed out of this application.. Status: Response_Status.Status_AccountUnusable, Error code: 0 #30405
Description
Describe the bug
When trying to use the Azure CLI for Terraform authentication, I received an error message that it could not acquire an access token. After looking at the provider logs, I found the command that failed was:
az account get-access-token --scope "https://management.azure.com/.default" --subscription [redacted] -o=json
The same command against `https://graph.azure.com/.default" was successful.
After running the failing command directly from the Azure CLI, I received the following error message:
Account has previously been signed out of this application.. Status: Response_Status.Status_AccountUnusable, Error code: 0, Tag: 540940121
Please explicitly log in with:
az login --scope https://management.azure.com/.defaultI have upgraded my Azure CLI to the latest version and logged out of all accounts and back in.
Related command
az account get-access-token
Errors
Here is the brief error:
Account has previously been signed out of this application.. Status: Response_Status.Status_AccountUnusable, Error code: 0, Tag: 540940121
Please explicitly log in with:
az login --scope https://management.azure.com/.defaultIssue script & Debug output
Here is the debug error:
cli.knack.log: File logging enabled - writing logs to 'C:\Users\nedbe\.azure\logs'.
cli.knack.cli: Command arguments: ['account', 'get-access-token', '--scope', 'https://management.azure.com/.default', '--subscription', 'REDACTED', '-o=json', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x0000021D6A67B380>, <function OutputProducer.on_global_arguments at 0x0000021D6AA1C0E0>, <function CLIQuery.on_global_arguments at 0x0000021D6AA414E0>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'account': ['azure.cli.command_modules.profile', 'azure.cli.command_modules.resource']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: profile 0.010 2 8
cli.azure.cli.core: resource 0.633 52 232
cli.azure.cli.core: Total (2) 0.643 54 240
cli.azure.cli.core: Loaded 53 groups, 240 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : account get-access-token
cli.azure.cli.core: Command table: account get-access-token
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x0000021D6D581D00>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\nedbe\.azure\commands\2024-11-23.12-42-49.account_get-access-token.1248.log'.
az_command_data_logger: command args: account get-access-token --scope {} --subscription {} -o={} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x0000021D6D5E9760>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x0000021D6D5E9800>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x0000021D6D5E9940>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x0000021D6D5E99E0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x0000021D6AA1C180>, <function CLIQuery.handle_query_parameter at 0x0000021D6AA41580>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x0000021D6D5E98A0>]
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\\Users\\nedbe\\.azure\\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\nedbe\.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/REDACTED
msal.authority: openid_config("https://login.microsoftonline.com/REDACTED/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/REDACTED/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/REDACTED/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/REDACTED/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/REDACTED/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/REDACTED/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/REDACTED/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/REDACTED/kerberos', 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.msal_credentials: UserCredential.get_token: scopes=('https://management.azure.com/.default',), claims=None, kwargs={}
msal.broker: [MSAL:0001] INFO LogTelemetryData:422 Printing Telemetry for Correlation ID: de30e6dd-a222-4de1-98f1-77c0377a065a
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: start_time, Value: 2024-11-23T17:42:49.000Z
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: api_name, Value: ReadAccountById
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: was_request_throttled, Value: false
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: authority_type, Value: Unknown
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: msal_version, Value: 1.1.0+local
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: correlation_id, Value: de30e6dd-a222-4de1-98f1-77c0377a065a
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: broker_app_used, Value: false
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: stop_time, Value: 2024-11-23T17:42:49.000Z
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: msalruntime_version, Value: 0.16.2
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: is_successful, Value: true
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: request_duration, Value: 0
msal.broker: [MSAL:0002] WARNING SetAuthorityUri:78 Initializing authority from URI 'https://login.microsoftonline.com/REDACTED' without authority type, defaulting to MsSts
msal.broker: [MSAL:0002] INFO SetCorrelationId:258 Set correlation ID: de30e6dd-a222-4de1-98f1-77c0377a065a
msal.broker: [MSAL:0002] INFO EnqueueBackgroundRequest:1000 The original authority is 'https://login.microsoftonline.com/REDACTED'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:243 Authority Realm: REDACTED
msal.broker: [MSAL:0002] WARNING TryEnqueueMsaDeviceCredentialAcquisitionAndContinue:1052 MsaDeviceOperationProvider is not available. Not attempting to register the device.
msal.broker: [MSAL:0003] INFO StorageTokenResponse:84 StorageTokenResponse account constructor invoked. This is only expected in Runtime flows
msal.broker: [MSAL:0003] ERROR ErrorInternalImpl:134 Created an error: 6p73z, StatusInternal::AccountUnusable, InternalEvent::None, Error Code 0, Context 'Account has previously been signed out of this application.'
msal.broker: [MSAL:0003] INFO LogTelemetryData:422 Printing Telemetry for Correlation ID: de30e6dd-a222-4de1-98f1-77c0377a065a
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: start_time, Value: 2024-11-23T17:42:49.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_name, Value: AcquireTokenSilently
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: was_request_throttled, Value: false
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: authority_type, Value: MSA
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: msal_version, Value: 1.1.0+local
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_status_code, Value: StatusInternal::AccountUnusable
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: client_id, Value: 04b07795-8ddb-461a-bbee-02f9e1bf7b46
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: correlation_id, Value: de30e6dd-a222-4de1-98f1-77c0377a065a
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: broker_app_used, Value: false
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: stop_time, Value: 2024-11-23T17:42:49.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: all_error_tags, Value: 6p73z|6p73z
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: msalruntime_version, Value: 0.16.2
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: original_authority, Value: https://login.microsoftonline.com/REDACTED
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: request_eligible_for_broker, Value: true
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: additional_query_parameters_count, Value: 0
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: storage_read, Value: DAC
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_error_code, Value: 0
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_error_tag, Value: 6p73z
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_error_context, Value: Account has previously been signed out of this application.
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: is_successful, Value: false
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: authorization_type, Value: WindowsIntegratedAuth
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: request_duration, Value: 5
msal.broker: [MSAL:0003] INFO LogTelemetryData:435 Printing Execution Flow:
msal.broker: [MSAL:0003] INFO LogTelemetryData:443 {"t":"4s7uc","tid":2,"ts":0,"l":2},{"t":"4sufd","tid":2,"ts":0,"s":2,"l":2},{"t":"4swgg","tid":2,"ts":0,"s":1,"l":2},{"t":"4swgf","tid":2,"ts":0,"s":1,"l":2},{"t":"4swgi","tid":3,"ts":1,"s":1,"l":2},{"t":"8b2yn","tid":3,"ts":1,"l":2},{"t":"8dqkx","tid":3,"ts":1,"l":2},{"t":"8dqik","tid":3,"ts":1,"l":2},{"t":"4q2di","tid":3,"ts":1,"l":2},{"t":"4qnng","tid":3,"ts":1,"l":2,"a":2,"ie":0},{"t":"4qnnf","tid":3,"ts":2,"l":2,"a":2,"ie":1},{"t":"8dqit","tid":3,"ts":2,"l":2},{"t":"646u1","tid":3,"ts":4,"l":2}
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 666, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 733, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 703, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 336, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/profile/custom.py", line 83, in get_access_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/_profile.py", line 465, in get_raw_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 68, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 149, in check_result
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 53, in aad_error_handler
azure.cli.core.azclierror.AuthenticationError: Account has previously been signed out of this application.. Status: Response_Status.Status_AccountUnusable, Error code: 0, Tag: 540940121
cli.azure.cli.core.azclierror: Account has previously been signed out of this application.. Status: Response_Status.Status_AccountUnusable, Error code: 0, Tag: 540940121
az_command_data_logger: Account has previously been signed out of this application.. Status: Response_Status.Status_AccountUnusable, Error code: 0, Tag: 540940121
Please explicitly log in with:
az login --scope https://management.azure.com/.default
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x0000021D6D581F80>]
az_command_data_logger: exit code: 1
cli.__main__: Command ran in 1.243 seconds (init: 0.406, invoke: 0.837)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4458 in cache file under C:\Users\nedbe\.azure\telemetry\20241123124250033
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry\__init__.pyc C:\Users\nedbe\.azure C:\Users\nedbe\.azure\telemetry\20241123124250033"
telemetry.process: Return from creating process 13520
telemetry.main: Finish creating telemetry upload process.Expected behavior
I expect to receive and access token.
Environment Summary
azure-cli 2.67.0
core 2.67.0
telemetry 1.1.0
Dependencies:
msal 1.31.0
azure-mgmt-resource 23.1.1
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\nedbe.azure\cliextensions'
Python (Windows) 3.12.7 (tags/v3.12.7:0b05ead, Oct 1 2024, 03:06:41) [MSC v.1941 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
Additional context
I'm running Windows 11 Home, 10.0.26100, ARM64
Metadata
Metadata
Assignees
Labels
az resource/group/lock/tag/deployment/policy/managementapp/account management-groupaz login/accountAuto assign by botThe command of the issue is owned by Azure CLI teamIssues from broker (currently WAM on Windows. More on other platforms are coming.)This label is used to track how many GitHub issues we have resolved for OKR purpose.Issues that are reported by GitHub users external to the Azure organization.The issue doesn't require a change to the product in order to be resolved. Most issues start as that