Calrify how to login with federated token

[JoHaHu]

Clarify how to login with federated credential tokens with az cli and note that it applies to both Service Principals and Managed Identities

az login --service-principal -u $CLIENT_ID -t $TENANT --federated-token $TOKEN

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: eeedb9a7-2aed-6727-4cfb-1515809d676e
• Version Independent ID: 2c83180d-22ad-db42-e2eb-f27f11977963
• Content: az
• Content Source: latest/docs-ref-autogen/reference-index.yml
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

@jiasli for awareness

[jiasli]

The help message of --federated-token was provided by federated credential service team. We will refine it once we get more information.

[rafagsiqueira]

Wait, can it be used with managed identities without the proxy sidecar?
Genius. It works! Thank you!

[es-cs1]

So to clarify, If I can normally log on to my Service Principal like
az login --service-principal -u <client-id> -p <client-secret> --tenant <tenant>

Is there a way to log on not using client-secret, but fetching the TOKEN somehow?

az login --service-principal -u $CLIENT_ID -t $TENANT --federated-token $TOKEN

how to get $TOKEN?

[pachr]

Federated token value seems to be : api://AzureADTokenExchange if you're using a managed identity and a federated token

[fabio-s-franco]

Running az login --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID returns:

Interactive authentication is needed. Please run:
az login

Still unable to login using user assigned identity using workload identity authentication method. The documented way:
Log in using a VM's user-assigned managed identity. Client or object ids of the service identity
also work.
az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID

yields:

Failed to connect to MSI. Please make sure MSI is configured correctly.
Get Token request returned http error: 400, reason: Bad Request

I verified the environment variables and they are correctly set. The token file is readable.
By now just going in circles as specific documantation about az cli login via workload identity with AKS is very scarce or esluding me.