v3: Intermittent "No subscriptions found" failure with OIDC login despite subscription-id being provided

[AdmirMuric]

When using azure/login@v3 with OIDC (federated credentials) and an explicit subscription-id input, the action intermittently fails with:

Error: No subscriptions found for ***.
Error: Login failed with Error: The process 'C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd' failed with exit code 1. Double check if the 'auth-type' is correct. Refer to https://github.com/Azure/login#readme for more information.

Current behavior

The failure is non deterministic, the same workflow, same SP, same subscription succeeds in parallel jobs within the same run but fails on some.

Expected

When subscription-id is explicitly provided, the action should not fail due to empty subscription enumeration. The subscription ID is already known, there's no need to require successful enumeration before calling az account set.

Potential workaround

Make use of allow-no-subscriptions: true, se explanation of it #592 (comment)

[robertoschiavone]

I can confirm that this is happening in my organization too with action azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a4.

Sometimes restarting the failed job fixes the issue, sometimes it does not.

[rushilShetty]

I can confirm that it's also happening for azure/login@2.2.0 version along with v3too. And indeed restarting the job is fixing the problem it seems.

Run azure/login@v2.2.0
  with:
    client-id: ***
    tenant-id: ***
    subscription-id: ***
  
    enable-AzPSSession: false
    environment: azurecloud
    allow-no-subscriptions: false
    audience: api://AzureADTokenExchange
    auth-type: SERVICE_PRINCIPAL
Running Azure CLI Login.
/usr/bin/az cloud set -n azurecloud
Done setting cloud: "azurecloud"
Federated token details:
 issuer - https://token.actions.githubusercontent.com/
 subject claim - repo:org-name/repo-name:environment:Production
Attempting Azure CLI login by using OIDC...
Error: No subscriptions found for ***.

Error: Login failed with Error: The process '/usr/bin/az' failed with exit code 1. Double check if the 'auth-type' is correct. Refer to https://github.com/Azure/login#readme for more information.

[hemalshah-gradientedge]

We are also experiencing this with azure/login@v3. Primarily seeing this trying to log into west us 2 and west europe. It's very random but having very frequently and disrupting workflows.

[robfraz]

Same here. It seems random, and is happening in roughly 10-20% of our workflow runs that are using this action. We're using v2.

[jluque0101]

Experiencing the same

Attempting Azure CLI login by using OIDC..
Error: No subscriptions found for..
Error: Login failed with Error: The process '/usr/bin/az' failed with exit code 1. Double check if the 'auth-type' is correct. Refer to https://github.com/Azure/login#readme for more information.

[jemeric-unicon]

Same experience here. I found that adding allow-no-subscriptions: true mitigates the issue. The Azure Login action code still executes az account set --subscription <subscription-id>, post login, when the subscription-id is provided and subsequent az interactions work as expected.

[miguelofbc]

We are also experiencing this issue. But in some cases it is persistent. @puagarwa could you please take a look?

[isra-fel]

Can anybody share roughly since when did the error happen? There was no update to neither the github action or az cli itself so just trying to pinpoint the issue.

Same experience here. I found that adding allow-no-subscriptions: true mitigates the issue. The Azure Login action code still executes az account set --subscription <subscription-id>, post login, when the subscription-id is provided and subsequent az interactions work as expected.

Yes allow-no-subscriptions: true would prevent az login from erroring out but this only works if the subsequent az commands do not talk to Azure Resource Manager (ARM) e.g. if you are only doing data plane operations such as storage or key vault.

[lanni-energinet]

Can anybody share roughly since when did the error happen? There was no update to neither the github action or az cli itself so just trying to pinpoint the issue.

Same experience here. I found that adding allow-no-subscriptions: true mitigates the issue. The Azure Login action code still executes az account set --subscription <subscription-id>, post login, when the subscription-id is provided and subsequent az interactions work as expected.

Yes allow-no-subscriptions: true would prevent az login from erroring out but this only works if the subsequent az commands do not talk to Azure Resource Manager (ARM) e.g. if you are only doing data plane operations such as storage or key vault.

Thats not entirely correct,

as @jemeric-unicon points out the code at

login/src/Cli/AzureCliLogin.ts

Line 141 in 9dfca58

if (this.loginConfig.allowNoSubscriptionsLogin) {

Still calls az account set --subscription even though az login --allow-no-subscriptions was executed before, which is illogical - but very useful as this increases our changes to succeed on login

[jemeric-unicon]

Can anybody share roughly since when did the error happen? There was no update to neither the github action or az cli itself so just trying to pinpoint the issue.

Same experience here. I found that adding allow-no-subscriptions: true mitigates the issue. The Azure Login action code still executes az account set --subscription <subscription-id>, post login, when the subscription-id is provided and subsequent az interactions work as expected.

Yes allow-no-subscriptions: true would prevent az login from erroring out but this only works if the subsequent az commands do not talk to Azure Resource Manager (ARM) e.g. if you are only doing data plane operations such as storage or key vault.

It was around 9-10am Eastern for me yesterday, 5/28. It felt more like the action code was interacting with an out-of-sync service/node on the Azure side. Less like a code defect as it wasn't consistent.