[BUG] InteractiveBrowserCredential fails when using a personal/MSA account without passing tenant_id

[anpaz]

Describe the bug

When using InteractiveBrowserCredential with a personal/MSA account without passing the user's TenantId, the interactive authentication fails with message:

User account '[email protected]' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot
access the application '04b07795-8ddb-461a-bbee-02f9e1bf7b46'(Microsoft Azure CLI) in that tenant. The account needs to
be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

To Reproduce

Steps to reproduce the behavior:

1. Use the InteractiveBrowserCredential with any Azure SDK client that accepts it, without passing the tenant_id.
2. Attempt to login using a personal/MSA account
   When the browser authentication opens a new https://login.microsoftonline.com/ web page, try to login with a personal/MSA account such as [email protected]. A work/school account should authenticate just fine.
   In the case of a personal/MSA account you should see the error message described above.

Sample code:

    var credential = new InteractiveBrowserCredential();
    
    var blobClient = new BlobClient(new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"), credential);
    var result = blobClient.DownloadContent();

Expected behavior

We should spare the user from passing their personal account tenant id and had a seamless experience as found with az login.

Workarounds

Option 1: Use the DefaultAzureCredential and pass the tenant_id via environment variable
a) Find your account tenant_id: How to find your Azure Active Directory tenant ID
b) Before running the program, set the AZURE_TENANT_ID environment variable with your tenant_id value.
PowerShell example:

$env:AZURE_TENANT_ID = "your tenant id"

Option 2: Pass the tenant_id via the InteractiveBrowserCredential
a) Find your account tenant_id: How to find your Azure Active Directory tenant ID
b) Pass your tenant_id as part of the InteractiveBrowserCredential constructor:

    var options = new InteractiveBrowserCredentialOptions { TenantId = "ed8ca8a2-451e-4a07-b172-f38e7969c820" };
    var credential = new InteractiveBrowserCredential(options);

Environment:

• Name and version of the Library package used: Azure.Storage.Blobs 12.9.0, Azure.Identity 1.4.0
• Hosting platform or OS and .NET runtime version

>dotnet --info
.NET SDK (reflecting any global.json):
 Version:   5.0.204
 Commit:    84d1fe1bb7

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.19042
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\5.0.204\

Host (useful for support):
  Version: 5.0.7
  Commit:  556582d964

.NET SDKs installed:
  2.1.524 [C:\Program Files\dotnet\sdk]
  2.1.816 [C:\Program Files\dotnet\sdk]
  2.2.401 [C:\Program Files\dotnet\sdk]
  2.2.402 [C:\Program Files\dotnet\sdk]
  3.0.103 [C:\Program Files\dotnet\sdk]
  3.1.302 [C:\Program Files\dotnet\sdk]
  3.1.404 [C:\Program Files\dotnet\sdk]
  3.1.410 [C:\Program Files\dotnet\sdk]
  5.0.203 [C:\Program Files\dotnet\sdk]
  5.0.204 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.All 2.1.28 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.28 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.15 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.16 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.28 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.15 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.15 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.6 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.7 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

[christothes]

Hi @anpaz This is a known issue related to how personal/MSA accounts work. By default, the tenantId that MSAL will try when no hint is given results in this error. I believe the CLI actually goes out and pre-emptively fetches a token for each of your subscriptions so that they are pre-cached.

That said, we are working on a feature now that will enable tenant discovery based on challenges retrieved from the service (for services that supply tenant Id info in challenges). The experience when using one of Azure.Identity's built in TokenCredentials with those service clients will be that it just works.

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in 7 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

[mjrousos]

I'm working with a customer who is running into this same issue. Has the work @christothes described been done yet? If not, can this be re-opened to track the issue?

Also, thanks @anpaz for the work-arounds!

[christothes]

Yes, tenant discovery is now enabled by default in the latest version of Azure.Identity. A tenantId hint can be sent as part of the TokenRequestContext now to GetToken which will be used in favor of the explicitly defined tenantId, if present.

[mjrousos]

Thanks, @christothes. I'll check with the customer which version of Azure.Identity they're using since they're hitting an issue very similar to what's described here and it sounds like that shouldn't be happening if they have up-to-date SDK packages.