`az login` fails due to MFA

[davidobrien1985]

Describe the bug
az login doesn't work for me anymore with an MFA enabled user.

Failed to authenticate '{'additional_properties': {}, 'id': '/tenants/4253165e-ba77-4eaa-bd15-e7abb69a74ef', 'tenant_id': '4253165e-ba77-4eaa-bd15-e7abb69a74ef'}' due to error 'Get Token request returned http error: 400 and server response: {"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.\r\nTrace ID: 384cee7c-cf4c-4dfe-8a11-a510c4e90c00\r\nCorrelation ID: 66394469-089e-42dc-aaf6-e5d6e77c7987\r\nTimestamp: 2018-08-03 12:27:46Z","error_codes":[50076],"timestamp":"2018-08-03 12:27:46Z","trace_id":"384cee7c-cf4c-4dfe-8a11-a510c4e90c00","correlation_id":"66394469-089e-42dc-aaf6-e5d6e77c7987","suberror":"basic_action"}'

To Reproduce
az login, also read -sp "Azure password: " AZ_PASS && echo && az login -u auobrien.david@outlook.com -p $AZ_PASS doesn't work.

Expected behavior
I receive an MFA prompt on my phone.

Environment summary
az --version
azure-cli (2.0.43)

Installed on WSL.

[yugangw-msft]

For MFA, you have to use interactive login through az login w/o -u. This requirement comes from AAD token service, not CLI.

[davidobrien1985]

Sorry if I wasn't clear. Interactive AND non-interactive fail with MFA.

…

Sent from my iPhone On 4 Aug 2018, at 2:05 am, Yugang Wang <notifications@github.com<mailto:notifications@github.com>> wrote: For MFA, you have to use interactive login through az login w/o -u. This requirement comes from AAD token service, not CLI. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#6962 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AIKIGZaRtyc6hjM6tKyAlLX21_sXU9nKks5uNHSwgaJpZM4Vt50X>.

[yugangw-msft]

Are you able to login in to portal? If yes, can you try az login again?

[davidobrien1985]

Yes, all fine via the portal and cloud shell. Only CLI on my local is broken.

…

Sent from my iPhone On 4 Aug 2018, at 7:27 am, Yugang Wang <notifications@github.com<mailto:notifications@github.com>> wrote: Are you able to login in to portal? If yes, can you try az login again? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#6962 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AIKIGdZDEY3JLjyEcXrgWuow8eOLbpcpks5uNMAogaJpZM4Vt50X>.

[yugangw-msft]

This is an error from AAD server which I shall clarify with service team.

    AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'

At the same time, in browser, can you log out the portal and run "az login" again? The goal is to clear the old cache associated with non MFA accounts, and force a new authentication flow.

[yugangw-msft]

if still not working, can you send the correlation id displayed in the browser to me at yugangw at microsoft dot com? It is needed for AAD team to diagnose for the root cause.

[davidobrien1985]

I just sent you an email to your microsoft address. From: Yugang Wang <notifications@github.com> Sent: Saturday, 4 August 2018 8:55 AM To: Azure/azure-cli <azure-cli@noreply.github.com> Cc: David O'Brien <me@david-obrien.net>; Author <author@noreply.github.com> Subject: Re: [Azure/azure-cli] `az login` fails due to MFA (#6962) if still not working, can you send the correlation id displayed in the browser to me at yugangw at microsoft dot com? It is needed for AAD team to diagnose for the root cause. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#6962 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AIKIGdGlORkbmQ9TsmrPa8ZOxlQlzH2xks5uNNSygaJpZM4Vt50X>.

[NateB2]

I'm having this exact issue on azure-cli version 2.0.30. First noticed it a couple days ago.

[yugangw-msft]

2.0.30 might be a bit too old CLI version, but regardless can you send me the error at yugangw at microsoft dot com as well? Once confirmed is the same error code, I will submit a support ticket.
Also did your tenant admin make any recent change such as location condition policies?

[NateB2]

I tried again after updating to 2.0.43, and at first received the same error, but then after running it several times it mysteriously disappeared and everything seems to be working fine. Weird.

[yugangw-msft]

I can reproduce this behavior by doing:

1. In portal, enable the baseline policy right away by following "Azure Active Directory=>Conditional Access=>Baseline policy" and turning on the option of "Use policy immediately"
2. Launch CLI, and click the account tile in the browser, which will sign you in, but then you will get a same error from CLI.

I ended up fixing this by re-opening the browser and re-login to the portal, which triggered the wizard for me to configure all needed for MFA authentication. After that, "az login" works again.
Hope this help.

[yugangw-msft]

Closing. No actions I can take from CLI's end to make it better, the issue is on the browser ui caches old auth configurations. If more users report the same error I will transfer to AAD/ESTS team who owns the whole browser based authentication flow.