Az cli login with Bring Your Own AccessToken

[zhenqxuMSFT]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

az login --access-token
az group list

Resource Provider

N/A

Description of Feature or Work Requested

We would like to be able to login az cli with an access token. All the subsequent ARM calls use this access token.

The caller ensures the token is not expired and issued for ARM operations.

Minimum API Version Required

N/A

Swagger PR link / SDK link

N/A

Request Example

No response

Target Date

2025-06-16

PM Contact

mingxuli

Engineer Contact

zhenqxu

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• [Enhancement Proposal] Support "bring your own access token" #16459

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Enhancement Proposal:

1. az login should support either:

   • --access-token argument which accepts an access token with permission:

     az login --access-token <access_token>
     

   • both --access-token (may not have permission) and --subscription which explicitly specifies the default subscription:

     az login --access-token <access_token> --subscription <subscription_id>
     

2. Each az command should support a global argument --access-token which can be used together with --subscription to invoke ARM request:

   az group list --access-token <access_token> --subscription <subscription_id>
   

3. Consume an environment variable AZURE_CLI_ACCESS_TOKEN so that all commands can use the same access token:

   export AZURE_CLI_ACCESS_TOKEN=<access_token>
   az group list
   

Reference:

• [Enhancement Proposal] Support "bring your own access token" #16459 (comment)
• [Enhancement Proposal] Support "bring your own access token" #16459 (comment)
• [Enhancement Proposal] Support "bring your own access token" #16459 (comment)
• [Enhancement Proposal] Support "bring your own access token" #16459 (comment)
• [Enhancement Proposal] Support "bring your own access token" #16459 (comment)

Solution 2:

Limitations:

1. The access token usually expires after 1 hour. Users will have to log in again after it expires.
2. The access token has a specific audience claim (aud), which means it can only be used on one resource. For example, if an ARM's access token is provided, Storage or Key Vault data-plane commands will fail as the audience doesn't match the resource.
3. Directly manipulating access tokens is risky and can lead to credential leak.

Reference:

• [Enhancement Proposal] Support "bring your own access token" #16459 (comment)

Powered by issue-sentinel