{Core} Handle 403/DecodeError when listing tenants in `az login` by Copilot · Pull Request #33745 · Azure/azure-cli

Copilot · 2026-07-17T04:38:35Z

Related command
az login

Description

When az login calls GET /tenants and the response is a 403 with an HTML body (e.g. blocked by a network firewall or proxy), the SDK's JSON deserializer raises azure.core.exceptions.DecodeError, surfacing the cryptic error JSON is invalid: Expecting value: line 1 column 1 (char 0) instead of anything actionable.

Changes:

In SubscriptionFinder.find_using_common_tenant (_profile.py), wrap client.tenants.list() in a try/except (DecodeError, HttpResponseError) block:
- DecodeError (non-JSON response, e.g. HTML block page): raises AzureResponseError explaining the parse failure and suggesting --tenant TENANT_ID as a workaround
- HttpResponseError 403: raises AzureResponseError explicitly calling out the 403 and suggesting network/proxy/CAP as causes
- Other HttpResponseError: re-raised as-is to preserve SDK error context

Before this fix, users behind a restrictive network got:

ERROR: JSON is invalid: Expecting value: line 1 column 1 (char 0)

After this fix, the same scenario produces:

ERROR: Failed to retrieve tenants. The request was blocked (HTTP 403 Forbidden).
This may be caused by a network firewall, proxy, or Conditional Access policy.
Please check your network settings and try again, or use 'az login --tenant TENANT_ID' to log in to a specific tenant.

Testing Guide

Unit tests added in test_profile.py:

test_login_tenant_list_403_raises_friendly_error — mocks tenants.list() raising HttpResponseError(status_code=403)
test_login_tenant_list_decode_error_raises_friendly_error — mocks tenants.list() raising DecodeError (HTML body)

History Notes

[Core] az login: Show a user-friendly error when tenant listing is blocked by a firewall or proxy (HTTP 403 / non-JSON response) instead of JSON is invalid

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

azure-client-tools-bot-prd · 2026-07-17T04:38:38Z

Validation for Azure CLI Full Test Starting...

Thanks for your contribution!

azure-client-tools-bot-prd · 2026-07-17T04:38:41Z

Validation for Breaking Change Starting...

Thanks for your contribution!

azure-pipelines · 2026-07-17T04:38:43Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

x-engineering-agent · 2026-07-17T04:51:06Z

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

Posted by agent-assist (autonomous bug-fix pipeline).

x-engineering-agent

Automated Review Summary

Result: ✅ Pass

Live test (Tester): Skipped (neutral) — this PR only changes azure-cli-core unit test files, which are not runnable via azdev test --live.
CI checks: 1/1 passed, 0 failed, 0 pending.

No blocking issues found. This PR looks good to merge from an automated-review perspective.

Posted by agent-assist (autonomous bug-fix pipeline).

Yong Zhang (yonzhan) · 2026-07-17T05:07:03Z

Core

… listing Extract error translation into shared `_raise_friendly_error` helper - Apply the same try/except to `client.subscriptions.list()` in `find_using_specific_tenant` so `az login --tenant TENANT_ID` also surfaces an actionable message instead of a raw `JSON is invalid` traceback - Add unit tests for the specific-tenant 403 and DecodeError paths

x-engineering-agent · 2026-07-28T07:12:03Z

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

Posted by agent-assist (autonomous bug-fix pipeline).

x-engineering-agent · 2026-07-29T04:22:34Z

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

Posted by agent-assist (autonomous bug-fix pipeline).

azure-pipelines · 2026-08-04T02:20:43Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR improves az login error handling when tenant or subscription discovery is blocked (HTTP 403) or returns a non-JSON response, raising a more actionable AzureResponseError instead of raw SDK exceptions.

Changes:

Added _raise_friendly_error to translate DecodeError and HttpResponseError(403) into friendly CLI errors.
Forced tenant/subscription pagers to execute within try/except via list(...) to catch lazy pager exceptions deterministically.
Added unit tests covering 403 and decode-error cases for both tenant listing and subscription listing.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/azure-cli-core/azure/cli/core/_profile.py	Adds friendly exception translation and wraps tenant/subscription discovery calls to raise actionable `AzureResponseError`s.
src/azure-cli-core/azure/cli/core/tests/test_profile.py	Adds test coverage to ensure blocked/non-JSON discovery errors are surfaced as friendly `AzureResponseError`s.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+def _raise_friendly_error(ex, resource_name):
+    # Translate blocked-transport errors (HTTP 403 or non-JSON body) into an actionable
+    # AzureResponseError. Any other exception is re-raised unchanged. resource_name is
+    # interpolated into the error message (e.g. "tenants", "subscriptions").
+    if isinstance(ex, DecodeError):
+        raise AzureResponseError(
+            "Failed to retrieve {name}. The response from the server could not be parsed. "
+            "This may be caused by a network firewall or proxy returning an unexpected response. "
+            "Please check your network settings and try again.".format(name=resource_name)
+        ) from ex
+    if isinstance(ex, HttpResponseError) and ex.status_code == 403:
+        raise AzureResponseError(
+            "Failed to retrieve {name}. The request was blocked (HTTP 403 Forbidden). "
+            "This may be caused by a network firewall, proxy, or Conditional Access policy. "
+            "Please check your network settings and try again.".format(name=resource_name)
+        ) from ex
+    raise ex


+        with self.assertRaises(AzureResponseError) as cm:
+            profile.login(True, None, None, False, None, use_device_code=False, allow_no_subscriptions=False)
+        self.assertIn("403", str(cm.exception))


x-engineering-agent

Automated Review Summary

PR: {Core} Handle 403/DecodeError when listing tenants in az login

CI checks: 92/92 passed, 0 failed, 0 pending. ✅
Live test: Skipped (neutral) — this PR only changes azure-cli-core unit tests, which are not runnable via azdev test --live.

No outstanding failures detected. This PR looks good from an automated-check perspective.

Posted by agent-assist (autonomous bug-fix pipeline).

Aditya Pujara (a0x1ab) · 2026-08-04T04:08:52Z

Copilot please review and implement all unaddressed human feedback through Yong Zhang (@yonzhan)'s latest comment at #33745 (comment), then push the fix to this PR.

Posted by agent-assist (autonomous bug-fix pipeline).

x-engineering-agent

✅ Automated Review Summary

All checks are green for this PR:

CI checks: 93/93 passed, 0 failed, 0 pending.
Live test: no runnable test files changed for this PR (skipped neutrally); relying on the completed CI suite above.

No outstanding issues found. This PR looks ready for a maintainer's final review/merge decision.

microsoft-github-policy-service · 2026-09-02T04:17:45Z

🔔 Routing this PR to @Azure/act-identity-squad.

Initial plan

30c58f0

Copilot AI assigned Copilot and Aditya Pujara (a0x1ab) Jul 17, 2026

azure-client-tools-bot-prd Bot added this to the August 2026 (2026-08-04) milestone Jul 17, 2026

microsoft-github-policy-service Bot requested a review from Yong Zhang (yonzhan) July 17, 2026 04:39

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot Account az login/account act-identity-squad labels Jul 17, 2026

Copilot started work on behalf of Aditya Pujara (a0x1ab) July 17, 2026 04:39 View session

Copilot AI linked an issue Jul 17, 2026 that may be closed by this pull request

Login Error #33744

Closed

Copilot AI added 3 commits July 17, 2026 04:46

{Core} Handle 403/DecodeError when listing tenants in az login

eeb971c

{Core} Refine exception handling for tenant list to use specific types

c56fb33

{Core} Re-raise non-403 HttpResponseError with original context

efec20b

Copilot AI changed the title ~~[WIP] Fix login error during az login with device code~~ {Core} Handle 403/DecodeError when listing tenants in az login Jul 17, 2026

Copilot finished work on behalf of Aditya Pujara (a0x1ab) July 17, 2026 04:49

Copilot AI requested a review from Aditya Pujara (a0x1ab) July 17, 2026 04:49

x-engineering-agent Bot reviewed Jul 17, 2026

View reviewed changes

Copilot AI mentioned this pull request Jul 20, 2026

[MySQL] Fix az mysql flexible-server list-skus returning empty list for all regions #33747

Merged

3 tasks

Yong Zhang (yonzhan) requested a review from Yeming Liu (isra-fel) July 28, 2026 07:19

Merge remote-tracking branch 'upstream/dev' into copilot/fix-login-error

7cf1634

x-engineering-agent Bot marked this pull request as ready for review August 4, 2026 02:20

x-engineering-agent Bot requested a review from a team as a code owner August 4, 2026 02:20

x-engineering-agent Bot requested review from a team as code owners August 4, 2026 02:20

Copilot AI review requested due to automatic review settings August 4, 2026 02:20

x-engineering-agent Bot requested a review from a team as a code owner August 4, 2026 02:20

Copilot AI reviewed Aug 4, 2026

View reviewed changes

x-engineering-agent Bot reviewed Aug 4, 2026

View reviewed changes

Copilot started work on behalf of Aditya Pujara (a0x1ab) August 4, 2026 04:09 View session

Copilot finished work on behalf of Aditya Pujara (a0x1ab) August 4, 2026 04:11

Aditya Pujara (a0x1ab) added agent-assist and removed agent-assist labels Aug 6, 2026

x-engineering-agent Bot reviewed Aug 19, 2026

View reviewed changes

Aditya Pujara (a0x1ab) added X Engineering Agent Reviewed Pull request reviewed by X Engineering Agent and removed azure-client-tools-agent labels Sep 2, 2026

Uh oh!

Conversation

Copilot AI commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 17, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 17, 2026

Uh oh!

azure-pipelines Bot commented Jul 17, 2026

Uh oh!

x-engineering-agent Bot commented Jul 17, 2026

Live test skipped

Uh oh!

x-engineering-agent Bot left a comment

Choose a reason for hiding this comment

Automated Review Summary

Uh oh!

Yong Zhang (yonzhan) commented Jul 17, 2026

Uh oh!

x-engineering-agent Bot commented Jul 28, 2026

Live test skipped

Uh oh!

x-engineering-agent Bot commented Jul 29, 2026

Live test skipped

Uh oh!

azure-pipelines Bot commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

x-engineering-agent Bot left a comment

Choose a reason for hiding this comment

Automated Review Summary

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 4, 2026

Uh oh!

x-engineering-agent Bot left a comment

Choose a reason for hiding this comment

✅ Automated Review Summary

Uh oh!

microsoft-github-policy-service Bot commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jul 17, 2026 •

edited

Loading