azureazure-devopsazure-pipelinesazure-cli

Use Az CLI without fetching subscriptions


I need to log in via the Azure CLI with a predefined tenant (using either the tenant ID or tenant domain name, as shown in the example below). After logging in, I want to manually set the subscription in a pipeline or script, e.g:

az login --allow-no-subscriptions --tenant contoso.onmicrosoft.com
az account set --subscription aabbccdd-1234-4567-8900-eb9ab9c0c010

The problem is that I get the following output immediately after a successful login:

Retrieving subscriptions for the selection...

[Tenant and subscription selection]

It prompts the user to select a subscription. What I want is to continue without selecting a default subscription and let me set it with additional commands.

So far I have found this issue for the same purpose but I can't set any similar option in a PowerShell script, the solution is just for Azure CLI v2 pipelines: https://github.com/Azure/azure-cli/issues/17254


Solution

  • Beginning with Azure CLI version 2.61.0, if you have access to multiple subscriptions, you're prompted to select an Azure subscription at time of login.

    If want to disable the subscription selector feature, set the core.login_experience_v2 configuration property to off(doc Subscription selector).

    In addition, if you want no output other than errors and warnings, you can set --output as none for azure cli(doc None output format).

    az config set core.login_experience_v2=off
    az login --allow-no-subscriptions --tenant <tenant> --output none
    az account set --subscription aabbccdd-1234-4567-8900-eb9ab9c0c010
    

    The output as below: enter image description here

    The azure cli above is interactive authentication method, it pops a web browser and ask to enter code. If you would like to run in DevOps pipeline, it requires non-interactive method, you can use service principal to login. Please refere to the doc content below:

    enter image description here

    - task: PowerShell@2
      inputs:
        targetType: 'inline'
        script: |
          az login --service-principal -u <appId> -p <password> --tenant <tenant> --output none
          ......
    

    BTW, the AzureCLI@2 task in devops supports powershell script, besides the DevOps powershell task, it's recommended to use AzureCLI@2 task directly with option visibleAzLogin: false.

    enter image description here