```
az login # interactive browser, local dev only
az login --use-device-code # headless SSH sessions
az login --service-principal -u [app-id] -p [secret] --tenant [tenant] # CI
az login --identity # on an Azure VM with managed identity
```
Rules:
- **CI = service principal or workload identity federation.** Never `az login` interactively in a pipeline; it hangs waiting for a browser that never opens. Prefer federated credentials (no secret at all) over `--service-principal -p [secret]`; the secret expires and breaks the pipeline at 2am.
- **Laptop = your own identity.** `az login` (or device code over SSH). Do not paste a service principal secret into your shell profile; when it rotates, everything breaks and the secret lives in your history.
- **On Azure VMs = --identity.** If the VM has a managed identity, `az login --identity` needs no secret. Check `az account show` after; the "user" will be the identity.
- **Tokens expire.** `az login` tokens last ~90 days of inactivity but access tokens are short-lived; the CLI refreshes silently until the refresh token dies. "Please run 'az login' to setup account" in automation means the refresh token expired; re-login.
- **Clear state between contexts.** `az logout` plus `az account clear` when switching from a service principal back to personal use, or the next human command runs as the bot.
Verify: `az account show` shows the expected user type and subscription before any provisioning command.