Skip to content

Keyvault with AzureCliCredential fails from AML Compute #41875

Open
@mlongtin0

Description

@mlongtin0
  • Package Name: azure-keyvault-secrets
  • Package Version: 4.10.0
  • Operating System: Ubuntu 20.04.6 LTS
  • Python Version: Python 3.12.10 (main, May 22 2025, 01:59:14) [Clang 20.1.4 ] on linux

Describe the bug
When running on an AML Compute node, using AzureCliCredential, calling get_secret on a key vault, we get this error:
ClientAuthenticationError: ERROR: Tenant shouldn't be specified for managed identity account

It appears that when receiving the challenge, it passes the tenant_id to az account get-token and it doesn't like that.

To Reproduce
Steps to reproduce the behavior:

  1. Login via az cli: az login -i --client-id $DEFAULT_IDENTITY_CLIENT_ID
  2. Run this:
cred = azure.identity.AzureCliCredential()
secret_cli = SecretClient(f"https://{my_kv_name}.vault.azure.net", cred)
secret = secret_cli.get_secret(my_secret_name) # Boom!

Note that az keyvault secret show works fine.

Expected behavior
That get_secret call works.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

Labels

Azure.IdentityClientThis issue points to a problem in the data-plane of the library.KeyVaultcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.needs-team-attentionWorkflow: This issue needs attention from Azure service team or SDK teamquestionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

Type

No type

Projects

Status

Untriaged

Status

Untriaged

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions