[Feature Request] Support custom client ID

[jiasli]

Related command
az login

Is your feature request related to a problem? Please describe.
Currently Azure CLI uses a fixed client ID to authenticate into AAD

azure-cli/src/azure-cli-core/azure/cli/core/auth/identity.py

Line 22 in 1d973cc

AZURE_CLI_CLIENT_ID = '04b07795-8ddb-461a-bbee-02f9e1bf7b46'

This client ID 04b07795-8ddb-461a-bbee-02f9e1bf7b46 is a First Party Application, registered in First Party Portal.

This application is only pre-authorized for a limited set of Microsoft Graph permissions. Using Azure CLI command az rest to call trustFrameworkKeySet API which requires TrustFrameworkKeySet.Read.All, TrustFrameworkKeySet.ReadWrite.All will fail (#22755).

Describe the solution you'd like
Support custom client ID, so that users can create their own app in their tenant, consent to that app and let Azure CLI use that app’s client ID:

az login --client-id

Describe alternatives you've considered
Apply for those permissions in First Party Portal to support these APIs.

[yonzhan]

Support custom client ID

[navba-MSFT]

Removing CXP Attention label from this issue since this was created internally by SDK team

[jiasli]

We received a similar issue today that the user wants to use Azure CLI's client ID to call b2cIdentityUserFlows API which requires delegated permission IdentityUserFlow.Read.All, IdentityUserFlow.ReadWrite.All:

https://docs.microsoft.com/en-us/graph/api/identitycontainer-list-b2cuserflows?view=graph-rest-beta&tabs=csharp

but Azure CLI's Directory.AccessAsUser.All delegated permission is not sufficient. This causes failure:

AADSTS65002: Consent between first party application '04b07795-8ddb-461a-bbee-02f9e1bf7b46' and first party resource '00000003-0000-0000-c000-000000000000' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API.

[jiasli]

Workaround: Use service principal instead of user login

1. Create your own application and service principal
2. Give the application Application Permission IdentityUserFlow.Read.All, IdentityUserFlow.ReadWrite.All
3. Log in to Azure CLI with that service principal: https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli#sign-in-with-a-service-principal