az login ignores scope parameter when it's set to https://vault.azure.net/.default

[IanKemp]

Describe the bug

> az login --scope https://vault.azure.net/.default

(pops up login dialog, I do the login, login succeeds)

> az account get-access-token

and pasting the output accessToken into https://jwt.ms yields

"aud": "https://management.core.windows.net/"

when it should be https://vault.azure.net.

Thus when I try to use that access token to sign a payload using a key in a Key Vault that my user has access to, I get:

AKV10022: Invalid audience. Expected <guid>, found: https://management.core.windows.net/.

Related command

az login

Errors

As above.

Issue script & Debug output

If I run az login --scope https://vault.azure.net/.default --debug I see the following output:

msal.token_cache: event={
    "_account_id": <guid>,
    "client_id": <guid>,
    "data": {},
    "environment": "login.microsoftonline.com",
    "grant_type": "broker",
    "response": {
        "_account_id": <guid>,
        "_msalruntime_telemetry": {
            "DATA LIMITED": "Full MSALRuntime telemetry not yet implemented",
            "api_name": "SignInInteractively",
            "broker_app_used": "true",
            "client_id": <guid>,
            "correlation_id": <guid>,
            "is_successful": "true",
            "msal_version": "1.1.0+local",
            "msalruntime_version": "0.16.2"
        },
        "access_token": "********",
        "client_info": <jwt>,
        "expires_in": 3907,
        "id_token": "********",
        "id_token_claims": "********",
        "scope": "https://vault.azure.net/user_impersonation https://vault.azure.net/.default",
        "token_type": "bearer"
    },
    "scope": [
        "https://vault.azure.net/user_impersonation",
        "https://vault.azure.net/.default"
    ],
    "token_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/token"
}

shortly followed by

msal.token_cache: event={
    "_account_id": <guid>,
    "client_id": <guid>,
    "data": {},
    "environment": "login.microsoftonline.com",
    "grant_type": "broker",
    "response": {
        "_account_id": <guid>,
        "_msalruntime_telemetry": {
            "DATA LIMITED": "Full MSALRuntime telemetry not yet implemented",
            "api_name": "AcquireTokenSilently",
            "broker_app_used": "true",
            "client_id": <guid>,
            "correlation_id": <guid>,
            "is_successful": "true",
            "msal_version": "1.1.0+local",
            "msalruntime_version": "0.16.2"
        },
        "access_token": "********",
        "client_info": <jwt>,
        "expires_in": 4644,
        "id_token": "********",
        "id_token_claims": "********",
        "scope": "https://management.core.windows.net//user_impersonation https://management.core.windows.net//.default",
        "token_type": "bearer"
    },
    "scope": [
        "https://management.core.windows.net//user_impersonation",
        "https://management.core.windows.net//.default"
    ],
    "token_endpoint": "https://login.microsoftonline.com/organizations/oauth2/v2.0/token"
}

Note the scope in both instances - initially it's Key Vault as expected, but later on it is incorrectly set (overwritten?) to https://management.core.windows.net/.

Expected behavior

I am logged into Key Vault and can retrieve an access token to perform operations against it.

Environment Summary

azure-cli                         2.64.0

core                              2.64.0
telemetry                          1.1.0

Extensions:
containerapp                      0.3.46

Dependencies:
msal                              1.30.0
azure-mgmt-resource               23.1.1

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory <elided>

Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb  6 2024, 22:03:32) [MSC v.1937 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal


Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az login --use-device-code fails with InvalidAuthenticationTokenAudience when providing non-ARM --scope #19855

[IanKemp]

UGH.

It helps if I pass --scope to az account get-access-token too.

> az account get-access-token --scope https://vault.azure.net/.default

yields a working token.