az keyvault create with parameter "--enable-rbac-authorization false" throws error "Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied"

[m-b-afk]

Describe the bug

In our Azure DevOps Pipelines we receive this error since 2025-06-27. Azure Cli Command is following:

az keyvault create `
        --name $Name `
        --enabled-for-deployment `
        --enabled-for-template-deployment `
        --location $Location `
        --resource-group $ResourceGroup `
        --enable-rbac-authorization false

This only happens when the ServicePrincipal of the ServiceConnection is executing the commands.

The weird thing is when the parameter "--enable-rbac-authorization" is not used and the rbac authorization is deactivated afterwards with a

az keyvault update `
        --name $Name `
        --resource-group $ResourceGroup `
        --enable-rbac-authorization false 

command it works.

All commands worked before 2025-06-28 we did not change a thing in the pipelines or in the deployment scripts.

Related command

az keyvault create

Errors

ERROR: The command failed with an unexpected error. Here is the traceback:
ERROR: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied
Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 52, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1007, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-08T13:35:28","request-id":"15b23ac5-4206-4b17-8cbc-cf3cb950d9b4","client-request-id":"15b23ac5-4206-4b17-8cbc-cf3cb950d9b4"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 757, in create_vault
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 309, in _get_current_user_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 224, in signed_in_user_get
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 55, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 52, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1007, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-08T13:35:28","request-id":"547b759b-1647-429f-ab8e-a075a5e1953f","client-request-id":"547b759b-1647-429f-ab8e-a075a5e1953f"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 664, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 731, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 701, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 334, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 536, in create_vault_or_hsm
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 759, in create_vault

Issue script & Debug output

cli.knack.cli: Command arguments: ['keyvault', 'create', '--name', 'kv-bof-nlst-int909', '--enabled-for-deployment', '--enabled-for-template-deployment', '--location', 'westeurope', '--resource-group', 'rg-bof-nlst-int909-stateful', '--enable-rbac-authorization', 'false', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x0000017255E4F2E0>, <function OutputProducer.on_global_arguments at 0x00000172561EC180>, <function CLIQuery.on_global_arguments at 0x0000017256211580>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'keyvault': ['azure.cli.command_modules.keyvault']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: keyvault 0.016 20 113
cli.azure.cli.core: Total (1) 0.016 20 113
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: Total (0) 0.000 0 0
cli.azure.cli.core: Loaded 20 groups, 113 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : keyvault create
cli.azure.cli.core: Command table: keyvault create
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x00000172584F20C0>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\MartinBach.azure\commands\2025-07-09.08-17-16.keyvault_create.2548.log'.
az_command_data_logger: command args: keyvault create --name {} --enabled-for-deployment --enabled-for-template-deployment --location {} --resource-group {} --enable-rbac-authorization {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x00000172585518A0>]
cli.knack.commands: Configured default 'westeurope' for arg location
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x0000017258551940>, <function register_cache_arguments..add_cache_arguments at 0x0000017258551A80>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x0000017258551B20>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x00000172561EC220>, <function CLIQuery.handle_query_parameter at 0x0000017256211620>, <function register_ids_argument..parse_ids_arguments at 0x00000172585519E0>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=KeyVaultManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\Users\MartinBach\.azure\service_principal_entries.bin', encrypt=True
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\Users\MartinBach\.azure\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\MartinBach.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21
msal.authority: openid_config("https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
cli.azure.cli.core.auth.msal_credentials: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 336adae1-dac3-43eb-8404-af9970240d35
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/e47e2217-e2a1-43ec-8159-900d957980f3/resourceGroups/rg-bof-nlst-int909-stateful/providers/Microsoft.KeyVault/vaults/kv-bof-nlst-int909?api-version=2023-02-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '5ca179c8-5c8c-11f0-8a69-4c77cb655834'
cli.azure.cli.core.sdk.policies: 'CommandName': 'keyvault create'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --enabled-for-deployment --enabled-for-template-deployment --location --resource-group --enable-rbac-authorization --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.70.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.26100-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/e47e2217-e2a1-43ec-8159-900d957980f3/resourceGroups/rg-bof-nlst-int909-stateful/providers/Microsoft.KeyVault/vaults/kv-bof-nlst-int909?api-version=2023-02-01 HTTP/1.1" 404 243
cli.azure.cli.core.sdk.policies: Response status: 404
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '243'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-failure-cause': 'gateway'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '4b9cc320-0ce8-4096-ae3f-739fc9fd9e5e'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '4b9cc320-0ce8-4096-ae3f-739fc9fd9e5e'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'GERMANYNORTH:20250709T061717Z:4b9cc320-0ce8-4096-ae3f-739fc9fd9e5e'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 56FFD639CBBC42499B300D9534CA04CE Ref B: FRA231050416051 Ref C: 2025-07-09T06:17:17Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 09 Jul 2025 06:17:17 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"error":{"code":"ResourceNotFound","message":"The Resource 'Microsoft.KeyVault/vaults/kv-bof-nlst-int909' under resource group 'rg-bof-nlst-int909-stateful' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"}}
cli.azure.cli.core.util: Retrieving token for resource https://graph.microsoft.com/
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21
msal.authority: openid_config("https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? None
cli.azure.cli.core.auth.msal_credentials: ServicePrincipalCredential.get_token: scopes=('https://graph.microsoft.com//.default',), kwargs={}
msal.telemetry: Generate or reuse correlation_id: 58caf506-bcd6-433b-966a-a79721d3e596
urllib3.connectionpool: Starting new HTTPS connection (1): login.microsoftonline.com:443
urllib3.connectionpool: https://login.microsoftonline.com:443 "POST /ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/token HTTP/1.1" 200 2126
msal.token_cache: event={
"client_id": "0009e522-2e5f-4059-93e5-e5ad7e57e252",
"data": {
"claims": "{"access_token": {"xms_cc": {"values": ["CP1"]}}}",
"scope": [
"https://graph.microsoft.com//.default"
]
},
"environment": "login.microsoftonline.com",
"grant_type": "client_credentials",
"params": null,
"response": {
"access_token": "***",
"expires_in": 86399,
"ext_expires_in": 86399,
"token_type": "Bearer"
},
"scope": [
"https://graph.microsoft.com//.default"
],
"token_endpoint": "https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/token"
}
cli.azure.cli.core.util: Request URL: 'https://graph.microsoft.com/v1.0/me'
cli.azure.cli.core.util: Request method: 'GET'
cli.azure.cli.core.util: Request headers:
cli.azure.cli.core.util: 'User-Agent': 'python/3.12.8 (Windows-11-10.0.26100-SP0) AZURECLI/2.70.0 (MSI)'
cli.azure.cli.core.util: 'Accept-Encoding': 'gzip, deflate'
cli.azure.cli.core.util: 'Accept': '/'
cli.azure.cli.core.util: 'Connection': 'keep-alive'
cli.azure.cli.core.util: 'x-ms-client-request-id': 'b7d3cccd-e023-440e-b1f1-394b5a0218a8'
cli.azure.cli.core.util: 'CommandName': 'keyvault create'
cli.azure.cli.core.util: 'ParameterSetName': '--name --enabled-for-deployment --enabled-for-template-deployment --location --resource-group --enable-rbac-authorization --debug'
cli.azure.cli.core.util: 'Authorization': 'Bearer eyJ0eXAiOiJKV...'
cli.azure.cli.core.util: Request body:
cli.azure.cli.core.util: None
urllib3.connectionpool: Starting new HTTPS connection (1): graph.microsoft.com:443
urllib3.connectionpool: https://graph.microsoft.com:443 "GET /v1.0/me HTTP/1.1" 401 None
cli.azure.cli.core.util: Response status: 401
cli.azure.cli.core.util: Response headers:
cli.azure.cli.core.util: 'Transfer-Encoding': 'chunked'
cli.azure.cli.core.util: 'Content-Type': 'application/json'
cli.azure.cli.core.util: 'Content-Encoding': 'gzip'
cli.azure.cli.core.util: 'Vary': 'Accept-Encoding'
cli.azure.cli.core.util: 'Strict-Transport-Security': 'max-age=31536000'
cli.azure.cli.core.util: 'request-id': 'c9c2c1b2-cb85-4b69-8e70-1ad0068c670d'
cli.azure.cli.core.util: 'client-request-id': 'c9c2c1b2-cb85-4b69-8e70-1ad0068c670d'
cli.azure.cli.core.util: 'x-ms-ags-diagnostic': '{"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"007","RoleInstance":"FR2PEPF00000D00"}}'
cli.azure.cli.core.util: 'WWW-Authenticate': 'Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", error_description="Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzUyMDQxODM3In0sInhtc19ycF9pcGFkZHIiOnsidmFsdWUiOiIxODUuNy4xOTcuMTc4In19fQ==", PoP realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", nonce="eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IkRDRDcxRjA5NzE0RkJFOTk2NDlCM0M5Mjk1N0REODM1N0M4QjM3NjcifQ.eyJ0cyI6MTc1MjA0MTgyMH0.gLQ0rxU1POnzEX5ImiflIeOi4cPxdQCEMWpYvg-9sh0kg9AGC9vznZYubwd7gaW_gsidZWWKqgHPBZ_ZS7JM_vkhVrGU75ZjLBXFH2Hp_n8840jUdRBk8T1uodqqO8QtAUFNfNuAnsFtVJO0_iyJwVrlApLwPh9Irno1ejAQztC2MBR38LDfyR3Ia-5BEk8awbm9-5HyaBlfAi_N8TD3JvCKbP5P3mf0QybTX3r0TZ2rK9Zu_MBVKW_xrtO20zBlw0xQRTx2FsEwEXNER21mJSwqiwHObksCW_EIAT4ehWUR8TX6u-rKogXizRKcXzX6xZLS9wG51gb2iVUJ3XO4gQ"'
cli.azure.cli.core.util: 'Date': 'Wed, 09 Jul 2025 06:17:16 GMT'
cli.azure.cli.core.util: Response content:
cli.azure.cli.core.util: {"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d","client-request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d"}}}
cli.azure.cli.core.util: Retrieving token for resource https://graph.microsoft.com/
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21
msal.authority: openid_config("https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/ca03ca7a-a980-4a7f-a0d5-3cb24ded3b21/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? None
cli.azure.cli.core.auth.msal_credentials: ServicePrincipalCredential.get_token: scopes=('https://graph.microsoft.com//.default',), kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: d096e508-fdc4-40ab-8547-5a2508fe9390
cli.azure.cli.core.util: Request URL: 'https://graph.microsoft.com/v1.0/servicePrincipals?$filter=servicePrincipalNames%2Fany%28c%3Ac%20eq%20%270009e522-2e5f-4059-93e5-e5ad7e57e252%27%29'
cli.azure.cli.core.util: Request method: 'GET'
cli.azure.cli.core.util: Request headers:
cli.azure.cli.core.util: 'User-Agent': 'python/3.12.8 (Windows-11-10.0.26100-SP0) AZURECLI/2.70.0 (MSI)'
cli.azure.cli.core.util: 'Accept-Encoding': 'gzip, deflate'
cli.azure.cli.core.util: 'Accept': '/'
cli.azure.cli.core.util: 'Connection': 'keep-alive'
cli.azure.cli.core.util: 'x-ms-client-request-id': 'dfce72f8-45e7-4233-ae38-c571e373d7d4'
cli.azure.cli.core.util: 'CommandName': 'keyvault create'
cli.azure.cli.core.util: 'ParameterSetName': '--name --enabled-for-deployment --enabled-for-template-deployment --location --resource-group --enable-rbac-authorization --debug'
cli.azure.cli.core.util: 'Authorization': 'Bearer eyJ0eXAiOiJKV...'
cli.azure.cli.core.util: Request body:
cli.azure.cli.core.util: None
urllib3.connectionpool: Starting new HTTPS connection (1): graph.microsoft.com:443
urllib3.connectionpool: https://graph.microsoft.com:443 "GET /v1.0/servicePrincipals?$filter=servicePrincipalNames%2Fany%28c%3Ac%20eq%20%270009e522-2e5f-4059-93e5-e5ad7e57e252%27%29 HTTP/1.1" 401 None
cli.azure.cli.core.util: Response status: 401
cli.azure.cli.core.util: Response headers:
cli.azure.cli.core.util: 'Transfer-Encoding': 'chunked'
cli.azure.cli.core.util: 'Content-Type': 'application/json'
cli.azure.cli.core.util: 'Content-Encoding': 'gzip'
cli.azure.cli.core.util: 'Vary': 'Accept-Encoding'
cli.azure.cli.core.util: 'Strict-Transport-Security': 'max-age=31536000'
cli.azure.cli.core.util: 'request-id': '10718a18-a6b7-42a6-966d-4fc4e88c72ad'
cli.azure.cli.core.util: 'client-request-id': '10718a18-a6b7-42a6-966d-4fc4e88c72ad'
cli.azure.cli.core.util: 'x-ms-ags-diagnostic': '{"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"007","RoleInstance":"FR2PEPF00000C31"}}'
cli.azure.cli.core.util: 'WWW-Authenticate': 'Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", error_description="Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied", error="insufficient_claims", claims="eyJhY2Nlc3NfdG9rZW4iOnsibmJmIjp7ImVzc2VudGlhbCI6dHJ1ZSwidmFsdWUiOiIxNzUyMDQxODM3In0sInhtc19ycF9pcGFkZHIiOnsidmFsdWUiOiIxODUuNy4xOTcuMTc4In19fQ==", PoP realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", nonce="eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IkRDRDcxRjA5NzE0RkJFOTk2NDlCM0M5Mjk1N0REODM1N0M4QjM3NjcifQ.eyJ0cyI6MTc1MjA0MTgyMH0.gLQ0rxU1POnzEX5ImiflIeOi4cPxdQCEMWpYvg-9sh0kg9AGC9vznZYubwd7gaW_gsidZWWKqgHPBZ_ZS7JM_vkhVrGU75ZjLBXFH2Hp_n8840jUdRBk8T1uodqqO8QtAUFNfNuAnsFtVJO0_iyJwVrlApLwPh9Irno1ejAQztC2MBR38LDfyR3Ia-5BEk8awbm9-5HyaBlfAi_N8TD3JvCKbP5P3mf0QybTX3r0TZ2rK9Zu_MBVKW_xrtO20zBlw0xQRTx2FsEwEXNER21mJSwqiwHObksCW_EIAT4ehWUR8TX6u-rKogXizRKcXzX6xZLS9wG51gb2iVUJ3XO4gQ"'
cli.azure.cli.core.util: 'Date': 'Wed, 09 Jul 2025 06:17:17 GMT'
cli.azure.cli.core.util: Response content:
cli.azure.cli.core.util: {"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad","client-request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad"}}}
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1046, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d","client-request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 72, in get_current_identity_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 14, in _get_current_user_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 229, in signed_in_user_get
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1046, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad","client-request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 666, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 734, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 703, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 487, in create_vault_or_hsm
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 704, in create_vault
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 80, in get_current_identity_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 40, in _get_object_id_from_subscription
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 19, in _get_object_id_by_spn
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 184, in service_principal_list
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied

cli.azure.cli.core.azclierror: The command failed with an unexpected error. Here is the traceback:
az_command_data_logger: The command failed with an unexpected error. Here is the traceback:
cli.azure.cli.core.azclierror: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied
Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1046, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d","client-request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 72, in get_current_identity_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 14, in _get_current_user_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 229, in signed_in_user_get
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1046, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad","client-request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 666, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 734, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 703, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 487, in create_vault_or_hsm
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 704, in create_vault
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 80, in get_current_identity_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 40, in _get_object_id_from_subscription
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 19, in _get_object_id_by_spn
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 184, in service_principal_list
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied
az_command_data_logger: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied
Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1046, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d","client-request-id":"c9c2c1b2-cb85-4b69-8e70-1ad0068c670d"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 72, in get_current_identity_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 14, in _get_current_user_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 229, in signed_in_user_get
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1046, in send_raw_request
azure.cli.core.azclierror.HTTPError: Unauthorized({"error":{"code":"InvalidAuthenticationToken","message":"Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied","innerError":{"date":"2025-07-09T06:17:17","request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad","client-request-id":"10718a18-a6b7-42a6-966d-4fc4e88c72ad"}}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 666, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 734, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 703, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 487, in create_vault_or_hsm
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 704, in create_vault
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 80, in get_current_identity_object_id
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 40, in _get_object_id_from_subscription
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/util.py", line 19, in _get_object_id_by_spn
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 184, in service_principal_list
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: LocationConditionEvaluationSatisfied
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues

Expected behavior

should just work (like before 2025-06-27)

Environment Summary

{
"azure-cli": "2.70.0",
"azure-cli-core": "2.70.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"authV2": "1.0.0",
"communication": "1.13.0"
}
}

Additional context

No response

[azure-client-tools-bot-prd]

Hi @m-b-afk,

2.70.0 is not the latest Azure CLI(2.75.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[m-b-afk]

Hi @m-b-afk,

2.70.0 is not the latest Azure CLI(2.75.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

as already mentioned it worked before 2025-06-27. it even worked with older versions of the cli before that date.

[evelyn-ys]

@m-b-afk I've replied to you in #25248 (comment)

You can succeed with no --enable-rbac-authorization because by default it's true in latest CLI. And when you manually specify --enable-rbac-authorization false, we will create keyvault using access policies instead of using RBAC. To create access policies we need to get the object id of service principal so we call Graph's API https://graph.microsoft.com/v1.0/servicePrincipals?$filter=servicePrincipalNames%2Fany%28c%3Ac%20eq%20%270009e522-2e5f-4059-93e5-e5ad7e57e252%27%29, then it turns out your service principal are not allowed to query Graph API and return failure due to CAE policy.

Does this answer your question?

[m-b-afk]

ok this enlightens it a bit.

So someone changed the rights of the serviceprincipal? because it worked until the given date...

and why does trhe update command work then?