Azure: set the right subscription and tenant before you create anything
Shows how to fix azure: set the right subscription and tenant before you create anything. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
TL;DR
Pass --subscription on every mutating command, or set the ARM\SUBSCRIPTION\ID environment variable. Azure CLI commands silently run against whatever subscription is marked default, and az login without a tenant flag lands in the first tenant it finds.
Steps
- Azure CLI commands silently run against whatever subscription is marked default, and
az loginwithout a tenant flag lands in the first tenant it finds. Agents trip on this constantly. - Check where you are before doing anything that creates or bills:
az account show --output table- Look at
name,id, andtenantId. If any of them is wrong, fix it:
az account list --output table # see everything you can reach
az account set --subscription "My Subscription" # or pass the subscription id
az login --tenant [tenant-id] # when you have access to several tenants- Rules that save loops:
- - Never trust the default in a script. Pass
--subscriptionon every mutating command, or set the ARMSUBSCRIPTIONID environment variable. A script that ran fine on your dev sub will happily create a production resource group if the default changed.
- Service principals are tenant-scoped. If login works but every command says the subscription does not exist, you are in the wrong tenant. Re-login with --tenant.
az account showcaches. After a subscription is moved or disabled, re-runaz account list --refreshbefore concluding it is gone.- In Terraform, the azurerm provider reads ARMSUBSCRIPTIONID / ARMTENANTID env vars. Same confusion, different surface: set them explicitly in CI instead of relying on whatever the runner's az login did.
- Billing surprise guard:
az account list --query "[?isDefault].{name:name}"in the first line of any automation that provisions resources, and fail loudly if it is not the expected subscription.
- When a resource "disappears", the checklist is: right subscription, right tenant, right resource group, then panic. The first two explain most of it.
When to use
You are seeing this: Agents trip on this constantly. Use this skill when you run into "Azure: set the right subscription and tenant before you create anything".
When not to use
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
Versions
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
Why this happens
The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.