azureazure-active-directoryazure-cloud-shell

An Azure Cloud Shell credential problem occurred

I try to use Azure cloud shell , and during execution of "az login" command I got this error:

A Cloud Shell credential problem occurred. When you report the issue with the error 
below, please mention the hostname 'SandboxHost-638476176132956009'

Failed to authenticate 8fa2a577-763e-4f76-81a0-dc97d1871254 'Turnberry Solutions Inc' 
due to error 'AADSTS50079: Due to a configuration change made by your administrator, or 
because you moved to a new location, you must enroll in multi-factor authentication to 
access '797f4846-ba00-4fd7-ba43-dac1f8f63013'. Trace ID: 68d3e4e5-8977-45de-828d- 
e0dd8f717300 Correlation ID: e22260b7-b461-4c2b-afd4-8542bd7dd5ce

I am probably missing something, but when executing "az login" command in Azure Cloud Shell, when I open new web page to login, it asks for a code provided by the shell (like "open the page https://microsoft.com/devicelogin and enter the code BQA3CDBHQ to authenticate.")
When I enter this code in the window which says "Enter code. Enter the code displayed on your app or device." Then there is a window "Pick an account. You're signing in to Microsoft Azure Cross-platform Command Line Interface on another device located in United States. If it's not you, close this page." - this window has my current account with status "Signed in". Then, when I click on my current account, there is a window with question "Are you trying to sign in to Microsoft Azure CLI? Only continue if you downloaded the app from a store or website that you trust." When I click on Continue button, there is a window saying "Microsoft Azure Cross-platform Command Line Interface

You have signed in to the Microsoft Azure Cross-platform Command Line Interface application on your device. You may now close this window." And when I close the tab, in cloud shell I see this error: `A Cloud Shell credential problem occurred. When you report the issue with the error
below, please mention the hostname 'SandboxHost-638476176132956009'

 Failed to authenticate 8fa2a577-763e-4f76-81a0-dc97d1871254 'Turnberry Solutions Inc' 
 due to error 'AADSTS50079: Due to a configuration change made by your administrator, 
 or because you moved to a new location, you must enroll in multi-factor authentication 
 to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'. Trace ID: 6360d017-14ae-4981-b5ff- 
 605e75807500 Correlation ID: b0f0ff80-2b95-4f0f-ac91-41ac15b33bb0`

At no time during this process it asks for 2FA combination (may be because I am already signed in?) In my Microsoft account page, in Security folder, all the "Ways to prove who you are" options are enabled: Email a code, Text a code, Send sign-in notification, Enter a code from an authenticator app, etc. Those methods are used for "Account verification", not for "Account sign in" (only Password option is used for "Account sign in"), and I don't see the way to force additional method for "Account sign in".
And of course my Two-step verification is ON. What am I missing here?

Solution

  • The error "AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013" usually occurs when MFA is required. You need to re-authenticate interactively again.

    I enabled MFA for a user:

    enter image description here

    I logged into the az cli by using MFA enabled account:

    enter image description here

    enter image description here

    az login

    enter image description here

    To resolve the issue, log out from the Azure Portal and clear the cache associated with non-MFA accounts and perform new authentication flow.

    References:

    az login fails due to MFA · Issue #6962 · Azure/azure-cli · GitHub

    How can i login to Azure with MFA using powershell? - Stack Overflow by me