Azure CLI auth: pick the login method that matches where the command runs

Not specified by the original author.

az login                                    # interactive browser, local dev only
az login --use-device-code                   # headless SSH sessions
az login --service-principal -u [app-id] -p [secret] --tenant [tenant]   # CI
az login --identity                          # on an Azure VM with managed identity

Rules:

• CI = service principal or workload identity federation. Never az login interactively in a pipeline; it hangs waiting for a browser that never opens. Prefer federated credentials (no secret at all) over --service-principal -p [secret]; the secret expires and breaks the pipeline at 2am.
• Laptop = your own identity. az login (or device code over SSH). Do not paste a service principal secret into your shell profile; when it rotates, everything breaks and the secret lives in your history.
• On Azure VMs = --identity. If the VM has a managed identity, az login --identity needs no secret. Check az account show after; the "user" will be the identity.
• Tokens expire. az login tokens last ~90 days of inactivity but access tokens are short-lived; the CLI refreshes silently until the refresh token dies. "Please run 'az login' to setup account" in automation means the refresh token expired; re-login.
• Clear state between contexts. az logout plus az account clear when switching from a service principal back to personal use, or the next human command runs as the bot.

Verify: az account show shows the expected user type and subscription before any provisioning command.

Proactive skill. Login modes verified against current Azure CLI auth docs. Evidence: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli