Refine or deprecate `--refresh` in `az account list`

[jiasli]

Context

--refresh in az account list was introduced by #4091 on 2017-07-29 and was never maintained ever since then.

It doesn't work with managed identity and Cloud Shell account:

$ az login --identity
...
$ az account list --refresh
Refreshing for 'systemAssignedIdentity' failed with an error 'No matched service principal found'. The existing accounts were not modified. You can run 'az login' later to explicitly refresh them
...

It adds a lot of complexity given the same effect can be achieved by

az account clear
az login

The usage of --refresh is not very popular. Here is the client telemetry for the last 7 days:

	invocations	subscriptions
az account list --refresh	2522	280
all commands	1156167962	73166

RawEventsAzCli
| where EventTimestamp > ago(7d) and EventTimestamp < ago(1h)
| extend exeVersion = tostring(Properties['context.default.vs.core.exeversion'])
| extend clientRequestId = tostring(Properties['context.default.azurecli.clientrequestid'])
| extend result = tostring(Properties['reserved.datamodel.action.result'])
| extend commandName = tostring(Properties['reserved.datamodel.entityname'])
| extend CommandRaw = tostring(Properties['context.default.azurecli.rawcommand'])
| extend paramSet = tostring(Properties['context.default.azurecli.params'])
| extend FaultTypeString = tostring(Properties['reserved.datamodel.fault.typestring'])
| extend FaultMessage = tostring(Properties['reserved.datamodel.fault.exception.message'])
| where RawCommand == 'account list'
| where paramSet contains '--refresh'
| summarize count(), dcount(AzureSubscriptionId)

Proposals

--refresh should either be

• Refined to support managed identity and Cloud Shell account
• Deprecated and removed

Also see

• [Feature Request] Drop multi-account login #17607
• Service principal context left in inconsistent state after az account list --refresh #20402

[yonzhan]

Refine or deprecate --refresh

[jiasli]

Another issue spotted on az account list --refresh today.

If the initial login is done with specific --tenant:

> az login --tenant 54826b22-38d6-4fb2-bad9-b7b93a3e9c5a --output table
A web browser has been opened at https://login.microsoftonline.com/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.
CloudName    HomeTenantId                          IsDefault    Name          State    TenantId
-----------  ------------------------------------  -----------  ------------  -------  ------------------------------------
AzureCloud   54826b22-38d6-4fb2-bad9-b7b93a3e9c5a  True         AzureSDKTest  Enabled  54826b22-38d6-4fb2-bad9-b7b93a3e9c5a

az account list --refresh will still do tenant discovery and list subscriptions from all accessible tenants:

> az account list --refresh --output table
The following tenants don't contain accessible subscriptions. Use 'az login --allow-no-subscriptions' to have tenant level access.
246b1785-9030-40d8-a0f0-d94b15dc002c 'Selfhost'
Name                                              CloudName    SubscriptionId                        TenantId                              State    IsDefault
------------------------------------------------  -----------  ------------------------------------  ------------------------------------  -------  -----------
Azure CLI Tests with TTL = 2 Days                 AzureCloud   1c638cf4-608f-4ee6-b680-c329e824c3a8  72f988bf-86f1-41af-91ab-2d7cd011db47  Enabled  False
...
AzureSDKTest                                      AzureCloud   0b1f6471-1bf0-4dda-aec3-cb9272f09590  54826b22-38d6-4fb2-bad9-b7b93a3e9c5a  Enabled  True

Unfortunately, there is no easy way to solve it, as we don't log how the initial az login command was called.