[identity] Using scopes in AzureCliCredential

[AkhilGNair]

Is your feature request related to a problem? Please describe.
Is there a reason (security or otherwise) this access token is scoped to a resource?

https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/identity/azure-identity/azure/identity/_credentials/azure_cli.py#L28

I don't fully understand why I need to supply one - I would prefer the access token to have the same access as my user when developing, and have access controlled by RBAC when actually deploying the application.

The issue is that otherwise, if I have some simple code to access blob storage using DefaultAzureCredential, I have to pointlessly construct a scope which is only ever used for local development.

Describe the solution you'd like
I don't know an elegant/proper solution but the behavior I expected was more like

COMMAND_LINE = "az account get-access-token --output json{}"
...

resource = _scopes_to_resource(*scopes) if scopes else None
output, error = _run_command(COMMAND_LINE.format(f" --resource {resource}" if resource else ""))

Then I can choose to supply a scope for the access token when developing, or have fully access to what my user can access.

Happy to submit a PR for this and the aio implementation if I haven't missed something behind the motivation here.

[AkhilGNair]

Maybe I am misunderstanding this though - could it be that I am supposed to supply something like https://storage.azure.com as the scope? TBH I can't find a list of valid scopes, so I have no idea what the options are!

I am aiming to access blob storage - perhaps I just need guidance on what scope to supply :)

[AkhilGNair]

Looks like I was using it wrong and this is all I needed

from azure.identity import DefaultAzureCredential
from azure.storage.blob import ContainerClient

credentials = DefaultAzureCredential()

container_client = ContainerClient(
    "https://storageaccountname12345.blob.core.windows.net/",
    container_name="container-01",
    credential=credentials,
)

print(list(container_client.list_blobs()))

Love the new feature! Thanks