[BUG]: AzureCli task fails to authenticate to service connection when multiple managed identities are assigned.

[craigthackerx]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

AzureCLI

Task version

2

Issue Description

Based on user @teeroddesigns issue here. There is a bug when assigning multiple user assigned managed identities to a Windows and Linux VM with the Azure CLI task.

Steps to recreate:

1. Create a service connection to Azure Resource Manager using managed identity
2. Provide details etc and setup succssfully
3. Add this managed identity to your VM running the Azure DevOps agent, along with an addtional, unrelated managed identity.
4. Run the AzureCli task,, you will see the errors:

ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.
##[error]Error Code: [1]
Get Token request returned http error: 400, reason: Bad Request
##[error]Error: Azure login failed using Managed Service Identity
##[error]Script failed with error: ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.
Get Token request returned http error: 400, reason: Bad Request

##[error]Script failed with error: ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.
Get Token request returned http error: 400, reason: Bad Request

To validate this, I went ahead and removed the unrelated managed identity from my VM, meaning only managed identity to the corresponding service connection, and it works:

[
  {
    "environmentName": "AzureCloud",
    "homeTenantId": "xxx",
    "id": xxx",
    "isDefault": true,
    "managedByTenants": [],
    "name": "xxx",
    "state": "Enabled",
    "tenantId": "xxx",
    "user": {
      "assignedIdentityInfo": "MSI",
      "name": "systemAssignedIdentity",
      "type": "servicePrincipal"
    }
  }
]

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Ubuntu22.04

Relevant log output

ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.
##[error]Error Code: [1]
Get Token request returned http error: 400, reason: Bad Request
##[error]Error: Azure login failed using Managed Service Identity
##[error]Script failed with error: ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.
Get Token request returned http error: 400, reason: Bad Request

##[error]Script failed with error: ERROR: Failed to connect to MSI. Please make sure MSI is configured correctly.
Get Token request returned http error: 400, reason: Bad Request

Full task logs with system.debug enabled

No response

Repro steps

1. Create a service connection to Azure Resource Manager using managed identity
2. Provide details etc and setup succssfully
3. Add this managed identity to your VM running the Azure DevOps agent, along with an addtional, unrelated managed identity.
4. Run the AzureCli task,, you will see the errors:

No response

[teeroddesigns]

Thanks for moving this task along, I lost track of it

[v-schhabra]

Hi @craigthackerx
We are not supporting multiple user assigned managed identities in AzureCLI task.
https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops#create-an-azure-resource-manager-service-connection-to-a-vm-that-uses-a-managed-identity

[craigthackerx]

Hi @craigthackerx We are not supporting multiple user assigned managed identities in AzureCLI task. https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops#create-an-azure-resource-manager-service-connection-to-a-vm-that-uses-a-managed-identity

That's fine, I don't think the document linked above reflects that information, I can't see it explictly called out in these documents that it's not a supported workflow, the documentation should reflect this.

[v-schhabra]

I agree, in the documents it is not explicitly mentioned that we do not support multiple managed identity with AzureCLI.