Azure CLI auth: pick the login method that matches where the command runs

Not specified by the original author.

TL;DR: az login has four modes: interactive, device code, service principal, managed identity. Using interactive login in CI is the classic hang; using a service principal secret on a laptop is the classic leak. Never az login interactively in a pipeline; it hangs waiting for a browser that never opens. Prefer federated credentials (no secret at all) over --service-principal -p [secret]; the secret expires and breaks the pipeline at 2am. - Laptop = your own identity. az login (or device code over SSH).

The fix

az login                                    # interactive browser, local dev only
az login --use-device-code                   # headless SSH sessions
az login --service-principal -u [app-id] -p [secret] --tenant [tenant]   # CI
az login --identity                          # on an Azure VM with managed identity

Rules:

• CI = service principal or workload identity federation. Never az login interactively in a pipeline; it hangs waiting for a browser that never opens. Prefer federated credentials (no secret at all) over --service-principal -p [secret]; the secret expires and breaks the pipeline at 2am.
• Laptop = your own identity. az login (or device code over SSH). Do not paste a service principal secret into your shell profile; when it rotates, everything breaks and the secret lives in your history.
• On Azure VMs = --identity. If the VM has a managed identity, az login --identity needs no secret. Check az account show after; the "user" will be the identity.
• Tokens expire. az login tokens last ~90 days of inactivity but access tokens are short-lived; the CLI refreshes silently until the refresh token dies. "Please run 'az login' to setup account" in automation means the refresh token expired; re-login.
• Clear state between contexts. az logout plus az account clear when switching from a service principal back to personal use, or the next human command runs as the bot.

Verify: az account show shows the expected user type and subscription before any provisioning command.

When to use this

• This covers exactly what the title says: Azure CLI auth.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Azure; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Azure behavior.

Proactive skill. Login modes verified against current Azure CLI auth docs. Evidence: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli