[Reference feedback]: `az login` in firewalled environment, FQDNs required

[jonnyry]

Type of issue

Other (describe below)

Reference command name

az login

Feedback

Use case

Creation of an Azure environment that handles sensitive data and minimises routes for data exfiltration.

Azure Firewall is deployed and blocks most outbound traffic.

The environment provides Azure SQL and Storage accounts with Entra authentication only - therefore the ability for users to authenticate to Entra is required, which I'm testing using az login.

Getting az login working

In order to get az login working so that users can authenticate to Entra, I've add the following service tag to the firewall allow list:

• AzureActiveDirectory service tag

However az login works part of the way and fails as it tries to retrieve tenant and subscription information:

I've found that adding the FQDN management.azure.com to the firewall unblocks this last step.

I've tried the same within Azure Data Studio using the 'Microsoft Entra ID - Universal with MFA Support' authentication method and that also fails without management.azure.com on the allow list.

However this is the whole management plane API of Azure (not just to authenticate), and I'd rather not allow access to this if it's not needed.

Question

Is there a way to authenticate to Entra WITHOUT having to add management.azure.com to the firewall allow list?

Thanks

Page URL

No response

Content source URL

No response

Author

jonnyry

Document Id

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[marrobi]

@yonzhan I'm also hitting this today.

[marrobi]

This works, so would think the CLI could use this mechanism?

# 1. Get AAD token from IMDS (link-local, bypasses firewall)
ACCESS_TOKEN=$(curl -s -H 'Metadata:true' \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&client_id=${MSI_CLIENT_ID}&resource=https://management.azure.com/" \
  | jq -r '.access_token')

# 2. Exchange AAD token for ACR refresh token
ACR_LOGIN_SERVER="xxx.azurecr.io"
ACR_REFRESH_TOKEN=$(curl -s -X POST "https://${ACR_LOGIN_SERVER}/oauth2/exchange" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=access_token&service=${ACR_LOGIN_SERVER}&access_token=${ACCESS_TOKEN}" \
  | jq -r '.refresh_token')

# 3. Docker login with ACR token
echo "${ACR_REFRESH_TOKEN}" | docker login "${ACR_LOGIN_SERVER}" \
  --username 00000000-0000-0000-0000-000000000000 --password-stdin