Allow subscription selector to use advanced filter from the Azure portal

[annapankiewicz]

Related command

az login / az login --use-device-code

Is your feature request related to a problem? Please describe.

In the past I have disabled the subscription selector feature during CLI logins because I have too many available subscriptions, some completely irrelevant to my internal team. I don't believe I have control over access to these subscriptions. In the Azure portal, I can create and use an advanced filter to view certain subscriptions that are relevant.

I like the concept of the subscription selector, but there would be much less friction as a user if the CLI respected the active filter from the portal. Below is a view of my current subscription selector, where none of the subscriptions in view are relevant to my team or organization.

Describe the solution you'd like

The az login command would utilize the active subscription filter that a user has set in the portal, and only display subscriptions matching the filter.

Describe alternatives you've considered

An alternative could be adding a new az configure option alongside core.login_experience_v2. One option could be a boolean core.use_portal_filter or core.advanced_subscription_filter. Another option could be a string core.default_subscriptions or something along those lines that accepts a string of comma-separated subscription IDs.

Additional context

[yonzhan]

Thank you for opening this issue, we will look into it.

[jiasli]

Filtering the subscription list requires dynamically updating the terminal content. This is a difficult task as there is no reliable library to do this. The interactive Azure CLI extension uses prompt_toolkit library for this job, but we have noticed different issues in different operation systems and terminals.

In the Azure portal, I can create and use an advanced filter to view certain subscriptions that are relevant.

This is because Azure Portal is a GUI tool. Using GUI to do this is easier and reasonable.

Below is a view of my current subscription selector, where none of the subscriptions in view are relevant to my team or organization.

You must have permissions to these subscriptions through RBAC, possibly inherited from groups you are in. It is not possible for Azure CLI to show subscriptions you cannot access.

One option could be a boolean core.use_portal_filter

Azure Portal has its own server backend. Azure CLI as a pure client application cannot interact with Azure Portal's server backend.

core.advanced_subscription_filter

This is a possible solution, but we need to define the syntax of the subscription filter.

Another option could be a string core.default_subscriptions or something along those lines that accepts a string of comma-separated subscription IDs.

There can be only one default subscription. You may change the default subscription by az account set, so this core.default_subscriptions option is not really necessary.