Azure Cloud Shell Fails to connect when you have multiple tenants and 1 of them requires MFA

[Dragonsong3k]

I have several Azure AD tenants attached to my account.

When starting cloud shell, I can choose my tenant however, a terminating error appears when one of the other tenants needs MFA and exits instead of continuing to sign in to the chosen tenant.

Steps to Reproduce:

Have an Azure AD account that is used in multiple tenants.

1. Start the Azure Cloud Shell Connector
2. Proceed with the device sign in
3. Choose the tenant that you wish sign in with

You will see an error for the other tenants about requiring MFA even though it is not the tenant you are trying to use.

The only workaround is to sign in to each tenant and then go back and sign in to the tenant you intended to in the first place.

When you do this through shell.azure.com you simply get a warning for each tenant that needs to be refreshed but you end up signed in to the correct tenant.

[zadjii-msft]

Thanks for the bug report!

I'd bet the bug is somewhere around here, though I'm not totally familiar enough with the Azure connection to be sure where we should be catching the error rather than exiting

terminal/src/cascadia/TerminalConnection/AzureConnection.cpp

Lines 487 to 542 in 10c963a

	int selectedTenant{ -1 };
	do
	{
	auto maybeTenantSelection = _ReadUserInput(InputMode::Line);
	if (!maybeTenantSelection.has_value())
	{
	return;
	}
	const auto& tenantSelection = maybeTenantSelection.value();
	if (tenantSelection == RS_(L"AzureUserEntry_RemoveStored"))
	{
	// User wants to remove the stored settings
	_RemoveCredentials();
	_state = AzureState::DeviceFlow;
	return;
	}
	else if (tenantSelection == RS_(L"AzureUserEntry_NewLogin"))
	{
	// User wants to login with a different account
	_state = AzureState::DeviceFlow;
	return;
	}
	else
	{
	try
	{
	selectedTenant = std::stoi(tenantSelection);
	if (selectedTenant < 0 || selectedTenant >= numTenants)
	{
	_WriteStringWithNewline(RS_(L"AzureNumOutOfBoundsError"));
	continue; // go 'round again
	}
	break;
	}
	catch (...)
	{
	// suppress exceptions in conversion
	}
	}
	// if we got here, we didn't break out of the loop early and need to go 'round again
	_WriteStringWithNewline(_formatResWithColoredUserInputOptions(USES_RESOURCE(L"AzureInvalidAccessInput"), USES_RESOURCE(L"AzureUserEntry_NewLogin"), USES_RESOURCE(L"AzureUserEntry_RemoveStored")));
	} while (true);
	// User wants to login with one of the saved connection settings
	auto desiredCredential = credList.GetAt(selectedTenant);
	desiredCredential.RetrievePassword();
	auto passWordJson = json::value::parse(desiredCredential.Password().c_str());
	_currentTenant = til::at(_tenantList, selectedTenant); // we already unpacked the name info, so we should just use it
	_accessToken = passWordJson.at(L"accessToken").as_string();
	_refreshToken = passWordJson.at(L"refreshToken").as_string();
	_expiry = std::stoi(passWordJson.at(L"expiry").as_string());
	const auto t1 = std::chrono::system_clock::now();
	const auto timeNow = std::chrono::duration_cast<std::chrono::seconds>(t1.time_since_epoch()).count();

[Dragonsong3k]

There may be some parity with this feature request - #5311
If we could target a specific tenant instead of looping through them all it can avoid this all together.

If you run Connect-AzAccount -UseDeviceLogin, it follows the same logic as looping through all of the users available tenants and throws warnings.
However, it takes a -tenantID parameter

Connect-AzAccount -UseDeviceLogin -TenantID xxxx-xxxxxxxxx-xxxx-xxxxxxxx

to specify a tenant, thus avoiding the warnings and errors.