az ssh vm fails with "parent_window_handle is required" error, only on some Windows VMs #30519
Description
Describe the bug
I'm having an odd error with az ssh vm failing on only some of my VMs.
On a few VMs, call them srv-1 and srv-2, when I run az ssh vm -g <group> -n <name> after a successful az login, it fails with the following error, complaining that "". It happens for any remote target VM I try to connect to, and I think has been happening for the entire lifetime of the affected VMs. It doesn't occur on my other VMs, and I have not been able to reproduce it on other VMs. Both VMs where it fails are running Windows 11 Enterprise Multi-Session 23H2, and were built from the "win11-23h2-avd-m365" VM image.
C:\>az ssh vm --prefer-private-ip -g my-group -n lx-1
(pii). Status: Response_Status.Status_InteractionRequired, Error code: 3400073247, Tag: 558133255
The default web browser has been opened at https://login.microsoftonline.com/aa04c913-a37b-4cfb-9516-7fc58bd3b82c/oauth2/v2.0/authorize for scope 'https://pas.windows.net/CheckMyAccess/Linux/.default'. Please continue the login in the web browser.
The command failed with an unexpected error. Here is the traceback:
parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 68, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 149, in check_result
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 53, in aad_error_handler
azure.cli.core.azclierror.AuthenticationError: (pii). Status: Response_Status.Status_InteractionRequired, Error code: 3400073247, Tag: 558133255
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 666, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 733, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 703, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 336, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 65, in ssh_vm
_do_ssh_op(cmd, ssh_session, op_call)
File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 178, in _do_ssh_op
op_info.cert_file, op_info.local_user = _get_and_write_certificate(cmd, op_info.public_key_file,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 232, in _get_and_write_certificate
certificatedata = credential.get_token(*scopes, data=data)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 66, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 38, in _get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 84, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/application.py", line 2112, in acquire_token_interactive
ValueError: parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues
RG and server names here have been replaced with placeholders, to avoid exposing private info.
This is with az CLI version 2.65.0 and ssh extension 2.0.6. It also happened with azure-cli 2.65.0 and (I think) ssh extension 2.0.5, and on older versions too. The affected VM has been in existence since June, and as far as I can remember, az ssh vm run on that VM has been failing the whole time.
I have only seen this occur on Windows 11 Multi-Session 23H2. But I haven't been able to reproduce it on a freshly-created Win 11 Multi-Sesh 23H2 VM, so I don't know if the OS version is important. The error isn't happening on other VMs I've tested in this Azure tenant, running Windows 11 (non-multi-sesh) 24H2, Win 11 Multi-Sesh 24H2, Windows Server 2025. All these VMs are domain-joined to our Entra DS AD domain. All the VMs are kept up to date with Windows Update.
I've tried upgrading azure-cli and the ssh extension, uninstalling and reinstalling the ssh extension, and fully uninstalling and reinstalling azure-cli.
The error is also not happening for some other users on the affected srv-1 VM. I've tested with other Windows users using other Azure user accounts, and other Windows users using the same Azure user account as my main user it happens for. Neither of them encountered the error. I don't know what's different about those other users. I tried unsetting my %PYTHONPATH% and %PATH% variables for my main affected user (just on a hunch), and the error didn't go away.
There are several programs installed on the affected VMs, including both Microsoft and third-party applications, and Anaconda (Miniforge, actually).
Related command
az ssh vm
Errors
I've replaced the RG, VM name, and user name with placeholders here, for privacy.
C:\>az ssh vm --prefer-private-ip -g my-group -n lx-1
(pii). Status: Response_Status.Status_InteractionRequired, Error code: 3400073247, Tag: 558133255
The default web browser has been opened at https://login.microsoftonline.com/aa04c913-a37b-4cfb-9516-7fc58bd3b82c/oauth2/v2.0/authorize for scope 'https://pas.windows.net/CheckMyAccess/Linux/.default'. Please continue the login in the web browser.
The command failed with an unexpected error. Here is the traceback:
parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 68, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 149, in check_result
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 53, in aad_error_handler
azure.cli.core.azclierror.AuthenticationError: (pii). Status: Response_Status.Status_InteractionRequired, Error code: 3400073247, Tag: 558133255
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 666, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 733, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 703, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 336, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 65, in ssh_vm
_do_ssh_op(cmd, ssh_session, op_call)
File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 178, in _do_ssh_op
op_info.cert_file, op_info.local_user = _get_and_write_certificate(cmd, op_info.public_key_file,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\John.Doe\.azure\cliextensions\ssh\azext_ssh\custom.py", line 232, in _get_and_write_certificate
certificatedata = credential.get_token(*scopes, data=data)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 66, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/credential_adaptor.py", line 38, in _get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 84, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\msal/application.py", line 2112, in acquire_token_interactive
ValueError: parent_window_handle is required when you opted into using broker. You need to provide the window handle of your GUI application, or use msal.PublicClientApplication.CONSOLE_WINDOW_HANDLE when and only when your application is a console app.
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues
Issue script & Debug output
I'm not sure how to remove all of the sensitive information from debugs here. There seem to be a lot of account and user identifiers, and I don't know what all might be sensitive.
Here's an excerpt from the log that I think is sanitized and safe to share, showing some warnings that happened shortly before the error was raised. The "*****"s are me manually redacting things.
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: msalruntime_version, Value: 0.16.2
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: is_successful, Value: true
msal.broker: [MSAL:0001] INFO LogTelemetryData:430 Key: request_duration, Value: 0
msal.broker: [MSAL:0002] WARNING SetAuthorityUri:78 Initializing authority from URI 'https://login.microsoftonline.com/*****' without authority type, defaulting to MsSts
msal.broker: [MSAL:0002] INFO SetCorrelationId:258 Set correlation ID: *******
msal.broker: [MSAL:0002] INFO EnqueueBackgroundRequest:1000 The original authority is 'https://login.microsoftonline.com/*********'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:219 Additional query parameter added successfully. Key: '(pii)' Value: '(pii)'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:219 Additional query parameter added successfully. Key: '(pii)' Value: '(pii)'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:219 Additional query parameter added successfully. Key: '(pii)' Value: '(pii)'
msal.broker: [MSAL:0002] INFO ModifyAndValidateAuthParameters:243 Authority Realm: ********
msal.broker: [MSAL:0002] WARNING TryEnqueueMsaDeviceCredentialAcquisitionAndContinue:1052 MsaDeviceOperationProvider is not available. Not attempting to register the device.
msal.broker: [MSAL:0003] INFO StorageTokenResponse:84 StorageTokenResponse account constructor invoked. This is only expected in Runtime flows
msal.broker: [MSAL:0003] WARNING DiscardAccessAndIdTokensIfUnusable:808 No access token found in the cache
msal.broker: [MSAL:0003] WARNING StorageTokenResponse:15 No credentials found in the cache
msal.broker: [MSAL:0003] WARNING GetPlatformPropertiesFromStorage:2013 No account found in cache.
msal.broker: [MSAL:0003] ERROR ErrorInternalImpl:134 Created an error: 7rhah, StatusInternal::InteractionRequired, InternalEvent::None, Error Code 3400073247, Context '(pii)'
msal.broker: [MSAL:0003] INFO LogTelemetryData:422 Printing Telemetry for Correlation ID: ******
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: start_time, Value: 2024-12-15T06:16:39.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_name, Value: AcquireTokenSilently
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: was_request_throttled, Value: false
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: authority_type, Value: AAD
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: read_token, Value: ID
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: msal_version, Value: 1.1.0+local
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_status_code, Value: StatusInternal::InteractionRequired
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: client_id, Value: ******
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: correlation_id, Value: ******
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: broker_app_used, Value: true
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: stop_time, Value: 2024-12-15T06:16:39.000Z
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: all_error_tags, Value: 7rhah|7rhah
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: msalruntime_version, Value: 0.16.2
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: original_authority, Value: https://login.microsoftonline.com/*****
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: request_eligible_for_broker, Value: true
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: additional_query_parameters_count, Value: 3
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: storage_read, Value: DAC|DID|DAMD
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: is_successful, Value: false
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: wam_telemetry, Value: {"ui_visible":false,"scope":"https://pas.windows.net/CheckMyAccess/Linux/.default offline_access openid profile","redirect_uri":"ms-appx-web://Microsoft.AAD.BrokerPlugin/*****","provider_id":"https://login.windows.net","oauth_error_code":"authentication_failed","http_status":400,"http_event_count":2,"http_content_type":"application/json; charset=utf-8","http_content_size":166,"device_join":"dj","correlation_id":"{*****}","client_id":"*****","cache_event_count":0,"broker_version":"10.0.22621.4541","authority":"https://login.microsoftonline.com/*******","api_error_code":-894894049,"account_join_on_start":"not_joined","account_join_on_end":"not_joined","silent_code":0,"silent_bi_sub_code":0,"silent_message":"","silent_status":0,"is_cached":0}
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: auth_flow, Value: Broker
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: broker_error_location, Value: 7rhah
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_error_code, Value: 3400073247
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_error_tag, Value: 7rhah
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: api_error_context, Value: (pii)
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: authorization_type, Value: WindowsIntegratedAuth
msal.broker: [MSAL:0003] INFO LogTelemetryData:430 Key: request_duration, Value: 774
[...]
cli.azure.cli.core.auth.msal_credentials: (pii). Status: Response_Status.Status_InteractionRequired, Error code: 3400073247, Tag: 558133255
cli.azure.cli.core.auth.msal_credentials:
The default web browser has been opened at https://login.microsoftonline.com/****/oauth2/v2.0/authorize for scope 'https://pas.windows.net/CheckMyAccess/Linux/.default'. Please continue the login in the web browser.
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/msal_credentials.py", line 68, in get_token
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 149, in check_result
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/auth/util.py", line 53, in aad_error_handler
azure.cli.core.azclierror.AuthenticationError: (pii). Status: Response_Status.Status_InteractionRequired, Error code: 3400073247, Tag: 558133255
BTW, it says "default web browser has been opened" in the log, but I didn't see any web browser or web-looking authentication window pop up.
Expected behavior
An SSH connection to the remote machine is opened.
Environment Summary
C:\>az --version
azure-cli 2.67.0
core 2.67.0
telemetry 1.1.0
Extensions:
ssh 2.0.6
Dependencies:
msal 1.31.0
azure-mgmt-resource 23.1.1
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\John.Doe\.azure\cliextensions'
Python (Windows) 3.12.7 (tags/v3.12.7:0b05ead, Oct 1 2024, 03:06:41) [MSC v.1941 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
Additional context
No response