Add manual tenant sign-in fallback for Conditional Access tenants by CoffeeKanzler · Pull Request #1511 · microsoft/vscode-azureresourcegroups

CoffeeKanzler · 2026-06-23T10:01:48Z

No description provided.

CoffeeKanzler · 2026-06-23T10:02:37Z

@microsoft-github-policy-service agree

Copilot

Pull request overview

Adds support for the existing azure.tenant setting when authenticating via VS Code’s built-in Microsoft authentication provider, enabling tenant-directed sign-in and tenant-scoped session requests (notably for auth-record export) consistent with az login --tenant ....

Changes:

Introduces src/utils/azureTenantSetting.ts to normalize/read azure.tenant, construct VSCODE_TENANT:<tenant> scopes, and provide tenant fallback selection logic.
Passes configured tenant through sign-in flows (login command + subscription provider context) and applies tenant-scoped auth session requests during auth-record export.
Adds configuration contribution/localization for azure.tenant and adds unit tests validating tenant normalization/scope behavior and logIn tenant forwarding.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/azureTenantSetting.test.ts	Adds tests for tenant normalization, tenant scope construction, tenant fallback logic, and tenant forwarding in `logIn`.
src/utils/azureTenantSetting.ts	Implements helpers for reading/normalizing `azure.tenant`, appending `VSCODE_TENANT` scope, and choosing effective tenant ID for auth.
src/services/VSCodeAzureSubscriptionProvider.ts	Adds tenant-aware `signIn` override and tenant fallback in subscription context generation.
src/exportAuthRecord.ts	Applies tenant-scoped session request for export and uses configured tenant in tenant resolution logic.
src/commands/accounts/logIn.ts	Passes configured `azure.tenant` into provider `signIn`.
package.nls.json	Adds localized description string for `azure.tenant`.
package.json	Contributes the `azure.tenant` setting to VS Code Settings UI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

+export function getTenantId(session: unknown, context?: IActionContext): string | undefined {
+    return extractTenantIdFromIdToken(session, context) ?? getConfiguredAzureTenant();
 }


bwateratmsft

The Azure Resources extension supports multi-tenant authentication on purpose. You can filter out tenants you aren't interested in looking at with the Accounts and Tenants view and the subscription filter. I don't see why this is necessary.

CoffeeKanzler · 2026-06-23T12:57:34Z

You can not login into some tenants that enforce that via conditional login. You NEED to specifiy the tenant manually to start the Auth workflow via the Microsoft Authenticator

bwateratmsft · 2026-06-23T13:26:56Z

Does the "Sign in to Tenant (Directory)..." command work?

CoffeeKanzler · 2026-06-23T13:57:04Z

No sadly it does not. The flow from my understanding is:

Azure: Sign In
-> provider.signIn(undefined)
-> authentication.getSession("microsoft", ARM scopes)
-> no VSCODE_TENANT scope
-> Microsoft Authentication defaults to the "organizations" authority

Sign in to Tenant
-> getAccounts()
-> for each already-authenticated account: getTenantsForAccount()
-> call Azure listTenants()
-> populate Quick Pick with returned tenants
-> user selects one of those discovered tenants
-> provider.signIn(selectedTenant)
-> VSCODE_TENANT: is finally added

getAccounts() requires an account already registered with the VS Code Microsoft authentication provider. If the initial generic authentication failed, there is no account to use for tenant discovery.

This creates a circular dependency:

Tenant-specific authentication is required to satisfy Conditional Access and sign into tenant requires generic authentication and tenant discovery before it can request tenant-specific authentication

bwateratmsft · 2026-06-23T14:05:52Z

That makes sense. Perhaps an input box in Sign in to Tenant (Directory)... to ask for tenant ID, or something like that would work? If the default sign in fails?

(side note, I wish Azure auth wasn't so nightmarishly overcomplicated...)

CoffeeKanzler · 2026-06-23T14:09:31Z

Yeah that sounds like a better Idea than my current solution. I can look into that and rewrite this.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

+        validateInput: value => value?.trim() ? undefined : localize('enterTenantIdValidation', 'Enter a tenant ID or domain.'),
+    });
+
+    return tenantId ? { tenantId: tenantId.trim() } as TenantIdAndAccount : undefined;
+}


+    return unauthenticatedTenants
+        .sort((a, b) => (a.displayName ?? '').localeCompare(b.displayName ?? ''))
+        .map(tenant => ({
+            label: tenant.displayName ?? '',


+    signIn: (tenant?: TenantIdAndAccount) => Promise<boolean>;
+}): AzureSubscriptionProvider {
+    return {
+        onRefreshSuggested: (() => ({ dispose: () => { /* no-op */ } })) as unknown as vscode.Event<RefreshSuggestedEvent>,


+export async function setManualSignInTenant(tenant: string): Promise<void> {
+    if (!ext.context) {
+        testingManualSignInTenant = normalizeTenant(tenant);
+        return;
+    }


CoffeeKanzler · 2026-06-23T14:52:06Z

I'll rework the description and work on the findings later this week probably. For now my tests are successful but I'll have to work in the additions of Copilot

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/


+    return unauthenticatedTenants
+        .sort((a, b) => (a.displayName ?? '').localeCompare(b.displayName ?? ''))
+        .map(tenant => ({
+            label: tenant.displayName ?? tenant.defaultDomain ?? tenant.tenantId,


+    try {
+        const picks = await getPicks(subscriptionProvider, account);
+        if (picks.length) {
+            const pick = await context.ui.showQuickPick(picks, {
+                placeHolder: localize('selectTenantPlaceholder', 'Select a Tenant (Directory) to Sign In To'),
+                matchOnDescription: true,
+            });
+            return { tenant: pick.data, isManual: false };
+        }


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

- Sort the tenant quick pick by the same display/domain/id fallback used for the label, so tenants without a display name no longer clump at the top. - Add a test for the manual-entry fallback when discovery returns no tenants (account exists but has no unauthenticated tenants).

CoffeeKanzler · 2026-06-23T17:37:56Z

@bwateratmsft One open design question I'd like your call on before this is final:

When a user manually enters a tenant and sign-in succeeds, we persist it (globalState) and use it as the account-level authentication fallback — i.e. it's injected as the tenantId only for contexts that don't already specify one (the "list tenants for account" path). Contexts that already have a tenant ID ignore it, and ARM's tenant-list endpoint is account-wide, so it doesn't hide other tenants from the UI.

The thing I'm unsure about is its lifecycle: it's currently never cleared. The one case that can actually wedge things is a stale/revoked manual tenant — if the user later loses access to it, account-level enumeration keeps trying to get a token for it. Clearing it on a successful discovered sign-in doesn't help there (you can't reach discovery if enumeration is already blocked).

Options I see: (a) leave it as-is, (b) add an explicit "Clear manual tenant" affordance, or (c) self-heal by dropping it if its silent token acquisition fails. Do you have a preference, or would you rather keep this PR to the bootstrap fix and handle lifecycle separately?

bwateratmsft

Once an account is signed in (to a specific tenant), does it still hit the endpoint that CA is blocking? The MSAL broker might be "sticky" enough to remember the tenant for us once the account has been signed in, removing the need to persist the tenant ID ourselves. Not certain, but worth trying.

bwateratmsft · 2026-06-23T18:21:19Z

We should make the changes in the auth package in microsoft/vscode-azuretools rather than duplicating the code there. Potentially we add a tenant or tenant ID arg to that function? @alexweininger thoughts?

@CoffeeKanzler thanks for opening the PR!

getPicks here duplicates the auth package's existing picker, can we instead just delegate to the auth package's signInToTenant(provider) and only fall back to the manual tenant input box when it throws NotSignedInError? That avoids the duplication and any auth-package changes. Also, do we actually need the manualSignInTenant persistence + getSubscriptionContext override?

For example: main...alexweininger/sign-in-to-tenant-manual-entry

Happy to refactor the picker to delegate to the auth package's signInToTenant(provider) with an input-box fallback on NotSignedInError, @alexweininger.

On whether we still need the manualSignInTenant persistence + getSubscriptionContext override: I tested exactly this. The manual sign-in itself succeeds, but resources never populate afterward.

The reason: subscription enumeration goes through getSubscriptionContext({ account, tenantId: undefined }) → listTenants(), and with tenantId undefined the silent token request hits the common/organizations
endpoint. So no subscriptions come back and the tree stays empty. The override re-injects the signed-in tenant into that account-level context, which scopes the silent token correctly and makes resources load.

It has to be persisted (not just in-memory) because the same enumeration re-runs on every reload.

@bwateratmsft — to your MSAL-stickiness question, that's what I was hoping too, but in practice the broker is only sticky for the interactive sign-in, not for the silent enumeration token. Without the persisted
tenant, a reload gives an empty tree.

So my proposal: Refactor the delegation (drop the duplicated picker) and keep the tenant persistence + context override (necessary for resources to actually load).

If you'd rather that re-scoping live in the auth package instead like e.g. a "default/sticky tenant" the provider applies to account-level requests then I'd need to further study the auth package after I am back.

Heads up on timing: I'm traveling in about an hour and won't be back until Friday at the earliest, so apologies in advance for the slow follow-up. I'll pick this up as soon as I'm back.

Sorry to go back and forth on it, but now that we know we need to persist that value, then I think it's best kept as a setting like your original design.

Drop the manualSignInTenant globalState, use an advanced setting instead.

Move the discovery fix to getTenantsForAccount (we already override it, and it gets the account): when ARM /tenants returns empty/throws for a conditional-access user, inject AzureTenant { tenantId: <setting>, account }. The normal per-tenant flow then lists subscriptions via that tenant's session, so we can drop the getSubscriptionContext override entirely.

Keep using the setting for the initial signIn({ tenantId }).

summary: one setting + the existing public override, no globalState, no internal coupling. Clients consume our discovered subscriptions via the Resources API, so this covers the whole extension family too.

Address review feedback from microsoft#1511: - Delegate the tenant picker to the auth package's signInToTenant and fall back to a tenant ID/domain input box only on NotSignedInError. - Drop the manualSignInTenant globalState; persist the manually entered tenant in a new azure.tenant setting (machine scope) instead. - Move the conditional-access discovery fix into getTenantsForAccount: when tenant discovery throws or returns no tenants, inject a synthetic AzureTenant from the setting so the normal per-tenant subscription flow runs against the tenant-scoped session. This removes the getSubscriptionContext override entirely. Claude-Session: https://claude.ai/code/session_01Cqc27MN7o36f4avwMAyj3M

CoffeeKanzler added 3 commits June 23, 2026 11:16

Add azure tenant setting for sign-in

66a06aa

Use configured tenant for provider authentication

451dc18

Remove local asset ignore entries

9567f03

CoffeeKanzler requested a review from a team as a code owner June 23, 2026 10:01

Copilot AI review requested due to automatic review settings June 23, 2026 10:01

Copilot started reviewing on behalf of CoffeeKanzler June 23, 2026 10:03 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Comment thread src/exportAuthRecord.ts Outdated

Comment thread src/services/VSCodeAzureSubscriptionProvider.ts Outdated

Address tenant auth review feedback

7d46ce5

CoffeeKanzler requested a review from Copilot June 23, 2026 10:25

Copilot started reviewing on behalf of CoffeeKanzler June 23, 2026 10:28 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Comment thread src/exportAuthRecord.ts Outdated

Comment on lines 267 to 269

export function getTenantId(session: unknown, context?: IActionContext): string | undefined {

return extractTenantIdFromIdToken(session, context) ?? getConfiguredAzureTenant();

}

bwateratmsft reviewed Jun 23, 2026

View reviewed changes

CoffeeKanzler added 2 commits June 23, 2026 16:17

Add manual tenant sign-in fallback

144eebe

Persist manual tenant for subscription discovery

19bcdf8

CoffeeKanzler requested a review from Copilot June 23, 2026 14:40

Copilot started reviewing on behalf of CoffeeKanzler June 23, 2026 14:41 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Address manual tenant sign-in review feedback

793aa99

CoffeeKanzler changed the title ~~Support azure.tenant for Microsoft authentication sign-in~~ Add manual tenant sign-in fallback for Conditional Access tenants Jun 23, 2026

CoffeeKanzler requested a review from Copilot June 23, 2026 17:16

Copilot started reviewing on behalf of CoffeeKanzler June 23, 2026 17:17 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Potential fix for pull request finding

1cabd47

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

bwateratmsft reviewed Jun 23, 2026

View reviewed changes

Uh oh!

Conversation

CoffeeKanzler commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CoffeeKanzler commented Jun 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

bwateratmsft left a comment

Choose a reason for hiding this comment

Uh oh!

CoffeeKanzler commented Jun 23, 2026

Uh oh!

bwateratmsft commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CoffeeKanzler commented Jun 23, 2026

Uh oh!

bwateratmsft commented Jun 23, 2026

Uh oh!

CoffeeKanzler commented Jun 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

CoffeeKanzler commented Jun 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

CoffeeKanzler commented Jun 23, 2026

Uh oh!

bwateratmsft left a comment

Choose a reason for hiding this comment

Uh oh!

bwateratmsft Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

alexweininger Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

CoffeeKanzler Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

alexweininger Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CoffeeKanzler commented Jun 23, 2026 •

edited

Loading

bwateratmsft commented Jun 23, 2026 •

edited

Loading

alexweininger Jun 24, 2026 •

edited

Loading