Question 103024 in Azure Question posted in
The official documentation to get you started can be found here.

Azure PowerShell Command: `Get-AzSubscription …` – SharedTokenCacheCredential authentication failed: AADSTS9002332

I’ve some PowerShell Script on Configuring the Azure Key Vault, where I’m running each command one by one for observing the execution flow:

#Log into Azure
Add-AzAccount

Result:

enter image description here

#Select the correct subscription
Get-AzSubscription -SubscriptionName "Test Subscription" | Select-AzSubscription

Error:

Get-AzSubscription -SubscriptionName "Test Subscription" | Select-AzS …
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | SharedTokenCacheCredential authentication failed: AADSTS9002332: Application '<some_Guid_id>'(Windows Azure Service Management API) is configured for use by Azure Active Directory users only. Please do not use the /consumers endpoint to serve this request.

I didn’t get much details about above error for resolving the issue.

Note:

  1. I’m the owner of my Azure Tenant/Subscription, logged in with the same account credentials in the Visual Studio code for executing the PowerShell Script.
Tags:

2

Answers


  1. 0

    To log into Azure, I would suggest using:

    Connect-AzAccount

    • This will prompt you to open a browser and authenticate to your Azure tenant

    To set the Azure subscription you want to work in:

    Set-AzContext -SubscriptionName ‘paste-your-subscription-name-here’

    Login or Signup to reply.
  2. 0

    I can see the user principal name of the user you’re logging with the Azure PowerShell command, is ending with the external identity provider i.e., gmail.com.
    If that user is the root user (Tenant Owner + Subscription Owner), then you cannot login with the Add-AzAccount because they are added as external users.

    To login with that command, you have to add the user in that subscription and give the Global Administrator as Azure AD Role and required role in Subscription level such as Owner, Contributor etc.

    Hence, this new user is part of your Azure Tenant Domain and UPN ends with the domain such as onmicrosoft.com or any other configured custom domain.

    enter image description here

    For more information on External Users, Guest Users, Tenant Domain users, Refer to this Similar issues on SO #35727866 given by the user @PhilippeSignoret and MS Q&A #81053 by the user @VasilMichev.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search