[Feature]: Support MaxContextPopulation Configuration in azure/login

[andreasschild]

Description of the new feature

Description

Platform teams that operate Azure environments at scale often use GitHub Actions together with the Azure PowerShell modules to automate management tasks across many Azure subscriptions.

When azure/login@v2 is configured with enable-AzPSSession: true, the action initializes an Azure PowerShell session by calling Connect-AzAccount internally. The Azure PowerShell modules populate a maximum of 25 contexts by default (MaxContextPopulation = 25).

This behavior can lead to unexpected results when the authenticated identity has access to more than 25 subscriptions. In such cases, only a subset of available subscription contexts is loaded into the session, which may cause PowerShell automation to behave differently depending on the RBAC assignments of the identity being used.

Currently, there is no way to override the MaxContextPopulation value through the azure/login action. As a result, workflows that require access to a larger number of subscriptions must disable Azure PowerShell session initialization and perform a separate authentication step to call Connect-AzAccount manually with the desired MaxContextPopulation value.

Steps to Reproduce

Create a service principal with access to more than 25 Azure subscriptions.
Configure a GitHub Actions workflow using azure/login@v2 with Azure PowerShell enabled:

- uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    enable-AzPSSession: true
- name: Subscription interaction
  uses: azure/powershell@v2
  with:
    azPSVersion: latest
    inlineScript: |
      foreach ($Subscription in (Get-AzSubscription)) {
        Get-AzAksCluster -SubscriptionId $Subscription.Id
     }

Observe that only contexts populated during login are available (and the Get-AzAksCluster command will fail for subs not part of any loaded context) and that behavior may vary depending on how many subscriptions are accessible to the identity.

Environment Setup

Tested in GitHub:

• GitHub Enterprise Cloud with azure/login@v2
• Service principal authentication using Federated Identity Credentials (OIDC)
• Identity with access to more than 25 Azure subscriptions

Tested locally with Connect-AzAccount, which have a default value of 25 for MaxContextPopulation.

• PowerShell: 7.6.4
• Az: 16.1.0
  • Az.Accounts: 5.5.1

Potential Workaround

To override the default behavior, Azure PowerShell session initialization must be disabled and authentication must be performed manually in a subsequent step:

- uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    enable-AzPSSession: false

- name: Az Connect
  uses: azure/powershell@v2
  with:
    azPSVersion: latest
    inlineScript: |
      $token = az account get-access-token --query accessToken -o tsv

      Connect-AzAccount `
        -AccessToken $token `
        -AccountId '${{ vars.AZURE_CLIENT_ID }}' `
        -SubscriptionId '${{ vars.AZURE_SUBSCRIPTION_ID }}' `
        -MaxContextPopulation -1

The workaround would introduce additional code for authentication, which must be roll out to all customer of platform teams, which became quite expensive and error prone.

Additional Consideration

If adding a new input parameter is not desirable, it may still be helpful to explicitly document the Azure PowerShell default limit of 25 contexts and its potential impact on GitHub Actions workflows that operate across many subscriptions.