CLI fails to authenticate to Azure for deployment

### Describe the bug

The CLI persistently fails to authenticate to Azure with azd or az when asked to perform tasks that require Azure login.

It repeatedly asks me to use microsoft.com/devicelogin to log in to Azure, but the shell it uses for the login flow immediately terminates and the authentication is not available to the CLI.

The following is an excerpt from /share from a session where I experienced the issue.

### 👤 User

deploy to Foundry

---

⏱️ 266m 3s

### ✅ `skill`

**deploy-to-foundry**

<details>
<summary>Arguments</summary>

```json
{
 "skill": "deploy-to-foundry"
}
```

</details>

```
Skill "deploy-to-foundry" loaded successfully. Follow the instructions in the skill context.
```


---

⏱️ 266m 58s

### ✅ `bash`

**Check if azd is installed**

$ which azd 2>/dev/null && azd version 2>/dev/null || echo "azd not found"

```
/usr/local/bin/azd
azd version 1.23.5 (commit 0130f96396ff5f262c4963fc[3024185131986](tel:3024185131986)f0d)
<exited with exit code 0>
```


---

⏱️ 267m 2s

### 💬 Copilot

Good, `azd` 1.23.5 is installed. Let me check Azure login status and then run the deploy script.

---

⏱️ 267m 4s

### ✅ `bash`

**Check Azure login status**

$ az account show --query '{subscription:name,id:id}' -o table 2>&1 | head -5

```
Subscription
----------------------------------
Visual Studio Enterprise with MSDN
<exited with exit code 0>
```


---

⏱️ 267m 7s

### ✅ `bash`

**Check azd auth status**

$ azd auth login --check-status 2>&1

<details>
<summary>6 lines</summary>

```
Not logged in, run `azd auth login` to login to Azure
WARNING: your version of azd is out of date, you have 1.23.5 and the latest version is 1.23.7

To update to the latest version, run:
curl -fsSL https://aka.ms/install-azd.sh | bash

If the install script was run with custom parameters, ensure that the same parameters are used for the upgrade. For advanced install instructions, see: https://aka.ms/azd/upgrade/linux
<exited with exit code 0>
```

</details>


---

⏱️ 267m 10s

### 💬 Copilot

`azd` is not logged in. Since we're in a Codespace (headless environment), we need to use device code flow.

---

⏱️ 267m 11s

### ✅ `bash`

**Login to azd with device code**

$ azd auth login --use-device-code 2>&1

```
<command started in background with shellId: azd-login>
```


---

⏱️ 267m 24s

### ✅ `read_bash`

**Waiting up to 10 seconds for command output**

<details>
<summary>Arguments</summary>

```json
{
 "delay": 10,
 "shellId": "azd-login"
}
```

</details>

```
Start by copying the next code: JC4Q9HUYJ
Then, go to: https://microsoft.com/devicelogin
Waiting for you to complete authentication in the browser...
<command with shellId: azd-login is still running after 10 seconds. The command is still running. Check the output above - if it looks like the command is waiting for input, use write_bash to provide it. Otherwise, use read_bash to continue waiting for output, or stop_bash to stop it.>
```


---

⏱️ 267m 27s

### 💬 Copilot

**To continue, please authenticate:**

1. Open **https://microsoft.com/devicelogin** in your browser
2. Enter the code: **`JC4Q9HUYJ`**
3. Sign in with your Azure account

Let me know once you've completed the authentication, or I'll check for completion.

---

⏱️ 269m 30s

### 👤 User

done

---

⏱️ 269m 34s

### ❌ `read_bash`

**Waiting up to 5 seconds for command output**

<details>
<summary>Arguments</summary>

```json
{
 "delay": 5,
 "shellId": "azd-login"
}
```

</details>

```
Invalid shell ID: azd-login. Please supply a valid shell ID to read output from.

<no active shell sessions>
```


---

⏱️ 269m 38s

### ✅ `bash`

**Verify azd login status**

$ azd auth login --check-status 2>&1

<details>
<summary>6 lines</summary>

```
Not logged in, run `azd auth login` to login to Azure
WARNING: your version of azd is out of date, you have 1.23.5 and the latest version is 1.23.7

To update to the latest version, run:
curl -fsSL https://aka.ms/install-azd.sh | bash

If the install script was run with custom parameters, ensure that the same parameters are used for the upgrade. For advanced install instructions, see: https://aka.ms/azd/upgrade/linux
<exited with exit code 0>
```

</details>


---

⏱️ 269m 46s

### 💬 Copilot

The login didn't persist — the session may have timed out. Let me try again:

---

⏱️ 269m 46s

### ✅ `bash`

**Login to azd with device code**

$ azd auth login --use-device-code 2>&1

```
<command started in background with shellId: azd-login2>
```


---

⏱️ 269m 57s

### ✅ `read_bash`

**Waiting up to 8 seconds for command output**

<details>
<summary>Arguments</summary>

```json
{
 "delay": 8,
 "shellId": "azd-login2"
}
```

</details>

```
Start by copying the next code: PVML4PQZ2
Then, go to: https://microsoft.com/devicelogin
Waiting for you to complete authentication in the browser...
<command with shellId: azd-login2 is still running after 8 seconds. The command is still running. Check the output above - if it looks like the command is waiting for input, use write_bash to provide it. Otherwise, use read_bash to continue waiting for output, or stop_bash to stop it.>
```


---

⏱️ 270m 6s

### 💬 Copilot

**New device code — please authenticate again:**

1. Open **https://microsoft.com/devicelogin**
2. Enter code: **`PVML4PQZ2`**
3. Sign in with your Azure account

Let me know once you've completed it and I'll check.

---

⏱️ 270m 57s

### 👤 User

done, again

---

⏱️ 271m 0s

### ❌ `read_bash`

**Waiting up to 10 seconds for command output**

<details>
<summary>Arguments</summary>

```json
{
 "delay": 10,
 "shellId": "azd-login2"
}
```

</details>

```
Invalid shell ID: azd-login2. Please supply a valid shell ID to read output from.

<no active shell sessions>
```


---

⏱️ 271m 3s

### ✅ `bash`

**Check azd auth**

$ azd auth login --check-status 2>&1

<details>
<summary>6 lines</summary>

```
Not logged in, run `azd auth login` to login to Azure
WARNING: your version of azd is out of date, you have 1.23.5 and the latest version is 1.23.7

To update to the latest version, run:
curl -fsSL https://aka.ms/install-azd.sh | bash

If the install script was run with custom parameters, ensure that the same parameters are used for the upgrade. For advanced install instructions, see: https://aka.ms/azd/upgrade/linux
<exited with exit code 0>
```

</details>


---

⏱️ 271m 9s

### 💬 Copilot

The `azd` login keeps failing silently. Let me try a different approach — use the existing `az` CLI credential (which is already logged in) to authenticate `azd`:

---

⏱️ 271m 10s

### ✅ `bash`

**Try az-based azd auth**

$ # Check if az is logged in
az account show -o json 2>&1 | head -5
# Try azd with federated auth from az cli
echo "---"
AZURE_AUTH_METHOD=az azd auth login --check-status 2>&1

<details>
<summary>12 lines</summary>

```
{
 "environmentName": "AzureCloud",
 "homeTenantId": "REDACTED",
 "id": "REDACTED",
 "isDefault": true,
---
Not logged in, run `azd auth login` to login to Azure
WARNING: your version of azd is out of date, you have 1.23.5 and the latest version is 1.23.7

To update to the latest version, run:
curl -fsSL https://aka.ms/install-azd.sh | bash

If the install script was run with custom parameters, ensure that the same parameters are used for the upgrade. For advanced install instructions, see: https://aka.ms/azd/upgrade/linux
<exited with exit code 0>
```

</details>


---

⏱️ 271m 48s

### ❌ `bash`

**Login azd with longer timeout**

$ # Try running azd auth login in the foreground with a longer timeout
timeout 120 azd auth login --use-device-code 2>&1

```
The user rejected this tool call. User feedback: Do this another way. YOu keep authenticating in a non-persistent chell
```


---

⏱️ 271m 53s

### 💬 Copilot

Good point — the shell session is not persisting between calls. Let me use a single persistent async shell for the entire flow:

---

⏱️ 271m 54s

### ✅ `bash`

**Start persistent shell for deploy**

$ bash

```
<command started in background with shellId: deploy-shell>
```


---

⏱️ 272m 7s

### ✅ `write_bash`

<details>
<summary>Arguments</summary>

```json
{
 "input": "azd auth login --use-device-code 2>&1{enter}",
 "delay": 10,
 "shellId": "deploy-shell"
}
```

</details>

```
@revodavid ➜ /workspaces/awakening (main) $ azd auth login --use-device-code 2>&1
Start by copying the next code: JHR8UMNKN
Then, go to: https://microsoft.com/devicelogin
Waiting for you to complete authentication in the browser...
<command with shellId: deploy-shell is still running after 10 seconds. The command is still running. Check the output above - if it looks like the command is waiting for input, use write_bash to provide it. Otherwise, use read_bash to continue waiting for output, or stop_bash to stop it.>
```


---

⏱️ 272m 11s

### 💬 Copilot

**Please authenticate one more time** (this time in a persistent shell that will keep the session):

1. Open **https://microsoft.com/devicelogin**
2. Enter code: **`JHR8UMNKN`**

Let me know when done — I'll continue the full deployment in this same shell.

---

⏱️ 274m 5s

### 👤 User

done

---

⏱️ 274m 9s

### ❌ `read_bash`

**Waiting up to 10 seconds for command output**

<details>
<summary>Arguments</summary>

```json
{
 "delay": 10,
 "shellId": "deploy-shell"
}
```

</details>

```
Invalid shell ID: deploy-shell. Please supply a valid shell ID to read output from.

<no active shell sessions>
```


---

⏱️ 274m 12s

### 💬 Copilot

The shell keeps getting cleaned up. Let me try a fundamentally different approach — run everything in one synchronous command chain:

---

⏱️ 274m 13s

### ❌ `bash`

**Login azd persistently**

$ azd auth login --use-device-code 2>&1; echo "EXIT_CODE=$?"

```
Operation aborted by user
```


---

⏱️ 275m 55s

### ℹ️ Info

Operation cancelled by user

---

### Affected version

Latest as of 2026-03-02

### Steps to reproduce the behavior

1. Ask CLI to perform a task that requires login via azd
2. Observe the CLI attempt to authenticate via microsoft.com/devicelogin
3. Observe authentication fails and task fails to complete

### Expected behavior

Copilot CLI makes it easy to log into Azure and complete deployments therein.

### Additional context

_No response_

CLI fails to authenticate to Azure for deployment #1794

Description

Describe the bug

👤 User

✅ skill

✅ bash

💬 Copilot

✅ bash

✅ bash

💬 Copilot

✅ bash

✅ read_bash

💬 Copilot

👤 User

❌ read_bash

✅ bash

💬 Copilot

✅ bash

✅ read_bash

💬 Copilot

👤 User

❌ read_bash

✅ bash

💬 Copilot

✅ bash

Try azd with federated auth from az cli

❌ bash

💬 Copilot

✅ bash

✅ write_bash

💬 Copilot

👤 User

❌ read_bash

💬 Copilot

❌ bash

ℹ️ Info

Affected version

Steps to reproduce the behavior

Expected behavior

Additional context

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

✅ `skill`

✅ `bash`

✅ `bash`

✅ `bash`

✅ `bash`

✅ `read_bash`

❌ `read_bash`

✅ `bash`

✅ `bash`

✅ `read_bash`

❌ `read_bash`

✅ `bash`

✅ `bash`

❌ `bash`

✅ `bash`

✅ `write_bash`

❌ `read_bash`

❌ `bash`