Azure cli az login failure

[gaurav-gsl]

Describe the bug

az login fails due to subscription api failure

Related command

Environment:
az version
{
"azure-cli": "2.88.0",
"azure-cli-core": "2.88.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {}
}

az --version
azure-cli 2.88.0

core 2.88.0
telemetry 1.1.0

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python location '/opt/az/bin/python3'
Config directory '/var/lib/jenkins/.azure'
Extensions directory '/var/lib/jenkins/.azure/cliextensions'

Python (Linux) 3.14.5 (main, Jun 30 2026, 10:52:46) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.

Errors

curl https://management.azure.com/subscriptions?api-version=2022-12-01

<style type='text/css'>body { font-family:Arial; margin-left:40px; }img { border:0 none; }#content { margin-left: auto; margin-right: auto }#message h2 { font-size: 20px; font-weight: normal; color: #000000; margin: 34px 0px 0px 0px }#message p { font-size: 13px; color: #000000; margin: 7px 0px 0px 0px }#errorref { font-size: 11px; color: #737373; margin-top: 41px }</style><title>Microsoft</title>

The request is blocked.

Ref A: D4B90D3A726A4D90B2AA14D85B188613 Ref B: PNQ241100401031 Ref C: 2026-07-16T11:02:17Z

Issue script & Debug output

Log:
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x768a238aada0>, <function OutputProducer.on_global_arguments at 0x768a237c00f0>, <function CLIQuery.on_global_arguments at 0x768a237fe820>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Using packaged command index for profile 'latest'.
cli.azure.cli.core: Modules found from index for 'login': ['azure.cli.command_modules.profile']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: profile 0.001 2 8
cli.azure.cli.core: Loaded command modules:
cli.azure.cli.core: Total (1) 0.001 2 8
cli.azure.cli.core: Loaded 2 groups, 8 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : login
cli.azure.cli.core: Command table: login
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x768a235dc040>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/var/lib/jenkins/.azure/commands/2026-07-17.04-54-24.login.262793.log'.
az_command_data_logger: command args: login --service-principal -u {} -p {} -t {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x768a235f5900>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x768a235f59b0>, <function register_global_policy_argument..add_global_policy_argument at 0x768a233bcbf0>, <function register_cache_arguments..add_cache_arguments at 0x768a233bcca0>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x768a233bcd50>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x768a237c01a0>, <function CLIQuery.handle_query_parameter at 0x768a237fe8d0>, <function register_ids_argument..parse_ids_arguments at 0x768a233bcb40>]
cli.azure.cli.core.auth.persistence: build_persistence: location='/var/lib/jenkins/.azure/msal_token_cache.json', encrypt=False
cli.azure.cli.core.auth.binary_cache: load: /var/lib/jenkins/.azure/msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? None
msal.application: Region to be used: None
cli.azure.cli.core.auth.msal_credentials: ServicePrincipalCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 671bcf7c-3c19-4f68-915b-0ba02f5bbb97
cli.azure.cli.core.auth.persistence: build_persistence: location='/var/lib/jenkins/.azure/service_principal_entries.json', encrypt=False
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? None
msal.application: Region to be used: None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: ServicePrincipalCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: d0ffc398-4d65-4dd0-aaac-5e4f09149050
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions?api-version=2022-12-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '95467e72-819b-11f1-b26c-79568fa036a3'
cli.azure.cli.core.sdk.policies: 'CommandName': 'login'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--service-principal -u -p -t --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.88.0 (DEB) azsdk-python-core/1.39.0 Python/3.14.5 (Linux-6.8.0-1051-azure-x86_64-with-glibc2.35)'
cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions?api-version=2022-12-01 HTTP/1.1" 403 None
cli.azure.cli.core.sdk.policies: Response status: 403
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 035A8F5292234A8DB7E626BDF5E4A3FE Ref B: PNQ241100406036 Ref C: 2026-07-17T04:54:25Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Fri, 17 Jul 2026 04:54:24 GMT'
cli.azure.cli.core.sdk.policies: 'Connection': 'close'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: <style type='text/css'>body { font-family:Arial; margin-left:40px; }img { border:0 none; }#content { margin-left: auto; margin-right: auto }#message h2 { font-size: 20px; font-weight: normal; color: #000000; margin: 34px 0px 0px 0px }#message p { font-size: 13px; color: #000000; margin: 7px 0px 0px 0px }#errorref { font-size: 11px; color: #737373; margin-top: 41px }</style><title>Microsoft</title>

The request is blocked.

Ref A: 035A8F5292234A8DB7E626BDF5E4A3FE Ref B: PNQ241100406036 Ref C: 2026-07-17T04:54:25Z

cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/policies/_universal.py", line 618, in deserialize_from_text
return json.loads(data_as_str)
~~~~~~~~~~^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/json/init.py", line 352, in loads
return _default_decoder.decode(s)
~~~~~~~~~~~~~~~~~~~~~~~^^^
File "/opt/az/lib/python3.14/json/decoder.py", line 345, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/json/decoder.py", line 363, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/opt/az/lib/python3.14/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/init.py", line 677, in execute
raise ex
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/init.py", line 820, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/init.py", line 789, in _run_job
result = cmd_copy(params)
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/init.py", line 335, in call
return self.handler(*args, **kwargs)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
return op(**command_args)
File "/opt/az/lib/python3.14/site-packages/azure/cli/command_modules/profile/custom.py", line 215, in login
subscriptions = profile.login(
interactive,
...<11 lines>...
subscription=subscription
)
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/_profile.py", line 214, in login
subscriptions = subscription_finder.find_using_specific_tenant(tenant, credential)
File "/opt/az/lib/python3.14/site-packages/azure/cli/core/_profile.py", line 903, in find_using_specific_tenant
for s in subscriptions:
^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/core/paging.py", line 136, in next
return next(self._page_iterator)
File "/opt/az/lib/python3.14/site-packages/azure/core/paging.py", line 82, in next
self._response = self._get_next(self.continuation_token)
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/mgmt/resource/subscriptions/v2022_12_01/operations/_operations.py", line 515, in get_next
pipeline_response: PipelineResponse = self._client._pipeline.run( # pylint: disable=protected-access
~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_request, stream=_stream, **kwargs
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/_base.py", line 242, in run
return first_node.send(pipeline_request)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/_base.py", line 98, in send
response = self.next.send(request)
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/_base.py", line 98, in send
response = self.next.send(request)
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/_base.py", line 98, in send
response = self.next.send(request)
[Previous line repeated 1 more time]
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/_base.py", line 102, in send
_await_result(self._policy.on_response, request, response)
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/_tools.py", line 49, in await_result
result = func(*args, **kwargs)
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/policies/_universal.py", line 728, in on_response
response.context[self.CONTEXT_NAME] = self.deserialize_from_http_generics(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
response.http_response, response_encoding
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/policies/_universal.py", line 690, in deserialize_from_http_generics
return cls.deserialize_from_text(response.text(encoding), mime_type, response=response)
~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.14/site-packages/azure/core/pipeline/policies/_universal.py", line 620, in deserialize_from_text
raise DecodeError(
...<3 lines>...
) from err
azure.core.exceptions.DecodeError: JSON is invalid: Expecting value: line 1 column 1 (char 0)
Content: <style type='text/css'>body { font-family:Arial; margin-left:40px; }img { border:0 none; }#content { margin-left: auto; margin-right: auto }#message h2 { font-size: 20px; font-weight: normal; color: #000000; margin: 34px 0px 0px 0px }#message p { font-size: 13px; color: #000000; margin: 7px 0px 0px 0px }#errorref { font-size: 11px; color: #737373; margin-top: 41px }</style><title>Microsoft</title>

The request is blocked.

Ref A: 035A8F5292234A8DB7E626BDF5E4A3FE Ref B: PNQ241100406036 Ref C: 2026-07-17T04:54:25Z

cli.azure.cli.core.azclierror: JSON is invalid: Expecting value: line 1 column 1 (char 0)
az_command_data_logger: JSON is invalid: Expecting value: line 1 column 1 (char 0)
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x768a235dc300>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 0.336 seconds (init: 0.065, invoke: 0.271)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 3991 in cache file under /var/lib/jenkins/.azure/telemetry/20260717045425269
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/opt/az/bin/python3 /opt/az/lib/python3.14/site-packages/azure/cli/telemetry/init.py /var/lib/jenkins/.azure /var/lib/jenkins/.azure/telemetry/20260717045425269"
telemetry.process: Return from creating process 262801
telemetry.main: Finish creating telemetry upload process.

Expected behavior

az login should work successfully

Server environment

Ubuntu 22.04.4 LTS

Environment Summary

azure-cli 2.88.0

core 2.88.0
telemetry 1.1.0

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python location '/opt/az/bin/python3'
Config directory '/var/lib/jenkins/.azure'
Extensions directory '/var/lib/jenkins/.azure/cliextensions'

Python (Linux) 3.14.5 (main, Jun 30 2026, 10:52:46) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[azure-client-tools-agent]

Hi @gaurav-gsl, thanks for the report. Looking at the log, the actual failure isn't coming from the Azure CLI itself — the response returned by management.azure.com is:

The request is blocked.
Ref A: D4B90D3A726A4D90B2AA14D85B188613 Ref B: PNQ241100401031 Ref C: 2026-07-16T11:02:17Z

This is a WAF/network-layer block page, not an error raised by az login or the azure-cli-core code path. Before we can investigate further as a CLI bug, could you confirm:

1. Are you running this from a corporate network, proxy, or firewall that could be intercepting/blocking outbound HTTPS calls to management.azure.com?
2. Does a plain curl -v https://management.azure.com/subscriptions?api-version=2022-12-01 from the same machine/network (outside the CLI) return the same blocked HTML page?
3. Does the same az login --service-principal ... command succeed from a different network (e.g. a different machine or without the proxy)?
4. Is there any outbound TLS inspection / SSL-interception proxy in place, and if so, have you configured az to trust its certificate (e.g. via REQUESTS_CA_BUNDLE or az config set core.custom_ca_certificates_file)?

If this turns out to be an environment/network restriction rather than a CLI defect, we may need to close this as not-a-bug, but let's confirm first. I'll pick this up automatically once you reply.

---

Posted by agent-assist (autonomous bug-fix pipeline).