How to Fix az login Not Working

A release was due at 5 p.m. The deployment pipeline had passed for months, then it failed at the first step with a vague authentication error. On the engineer’s laptop, az login opened a blank browser tab and hung. Two people were blaming the network, and a third was ready to rebuild the build agent.

I have seen az login not working in many forms: no browser, an MFA loop, the wrong tenant, an expired secret, or a corporate proxy that rewrites certificates. The fix is almost never to reinstall everything. It is to read the error, match it to a cause, and change one thing at a time. This guide gives you a triage method, tested commands for each failure type, and a way to prevent repeat outages.

Start Here: Triage Before You Change Anything

The Azure CLI is the command-line tool that talks to Azure Resource Manager, Azure’s deployment and management layer. az login proves your identity to Microsoft Entra ID, the identity service behind every Azure sign-in. If you need a refresher on the tool, read what the Azure CLI is.

Run these three checks first. They take a minute and rule out half the causes.

az --version

This prints the CLI version and installed extensions. Old versions can mishandle newer sign-in methods, so if you are far behind, follow this guide to update Azure CLI.

az account show --output table

This shows whether a session already exists and which subscription is active. If it returns an account but commands still fail, your problem may be permissions, not sign-in. See az account show for the output fields.

az login --debug

The --debug flag prints each step of the sign-in, including HTTP calls and error codes. Read the first error line. Look for an AADSTS code, which is a Microsoft Entra error number, or for words like “certificate verify failed.”

Symptom-to-Cause Table

Pro Tip: In my experience, copying the exact AADSTS code into the ticket cuts troubleshooting time in half. “Login doesn’t work” tells nobody anything, but “AADSTS53003 on tenant X” points straight at a policy.

Fix az login Not Working When the Browser Fails

By default, az login starts a browser-based sign-in. If it cannot open a browser, the CLI is supposed to fall back to device code flow. That flow gives you a short code to enter on any device. When the fallback does not trigger, force it:

az login --use-device-code

The CLI prints a Microsoft URL and a code. Open the URL on your phone or another computer, enter the code, and complete MFA there. This is the right method for SSH sessions, containers, jump boxes, and WSL. It is still a user sign-in, so MFA and Conditional Access policies still apply.

Windows Broker Problems

Recent CLI versions on Windows use the Web Account Manager (WAM), a Windows component that handles sign-in through your Windows account. It is convenient, but it can fail when the device is not joined correctly, when a work account is stale, or when you switch between an elevated and a normal terminal. Turn the broker off to test:

az config set core.enable_broker_on_windows=false

This tells the CLI to use the regular browser flow instead of WAM. Run az account clear, then az login again. If that works, the broker was the problem. You can turn it back on later with the same command and true. This is a client setting, so it does not change anything in Azure.

Cloud Shell and Remote Sessions

If you only need quick commands, Azure Cloud Shell is already signed in through the portal and needs no az login. If you use the CLI inside an editor, see how to use Azure CLI in Visual Studio Code. Browser-based loops inside editors are covered in the article on InteractiveBrowserCredential authentication failed.

If you can sign in with Azure PowerShell but not the CLI, remember that each tool keeps its own session. Test the same account there:

$TenantId = "<tenant-id>"
Connect-AzAccount -Tenant $TenantId

Connect-AzAccount is the Azure PowerShell sign-in cmdlet, and -Tenant pins the directory. If it works, your account and policies are fine, and the issue is local to the CLI. If the cmdlet is missing, read the term Connect-AzAccount is not recognized.

Pro Tip: I keep device code login in my back pocket for every locked-down jump box. When a browser misbehaves, switching to --use-device-code solves it in under a minute.

Fix MFA and Conditional Access Errors

This is the most common failure I see in modern tenants. Multifactor authentication (MFA) asks for a second proof of identity. Conditional Access is a Microsoft Entra policy engine that can require MFA, a compliant device, or a trusted location before it issues a token. Here is what MFA is if you need background.

Typical errors:

• AADSTS50076. MFA is required, and your sign-in did not satisfy it.
• AADSTS53003. A Conditional Access policy blocked access.
• “Your sign-in was successful but you do not have permission to access this resource.” This often points to a policy rather than a missing role.

Microsoft documents that an MFA-enabled user identity fails in unattended scripts because MFA needs a person to respond. Passing a username and password on the command line cannot work when MFA is required.

Fix It Step by Step

1. Run az logout, then az login on its own so the browser can show the MFA prompt.
2. On a headless machine, use az login --use-device-code.
3. If you belong to several tenants, name the one the policy applies to.

az login --tenant <tenant-id-or-domain>

The --tenant parameter prevents the CLI from trying the wrong directory first. This matters because MFA claims earned in one tenant cannot be reused in another. Not sure of the value? See where to find the tenant ID in the Azure portal.

4. Ask an administrator to open the failed sign-in and review the policy. In the Microsoft Entra admin center, go to the sign-in logs, open the failed event, and check the Conditional Access tab. It lists each policy that applied. This guide explains where to find Microsoft Entra ID sign-in logs, and this one shows how to check a Conditional Access policy in Azure.

Do not weaken policies just to make a script work. Warning: excluding an account from MFA or location rules to “fix” a login exposes your subscription. Move the script to a workload identity instead, which I cover below.

Pro Tip: I ask admins to run the Conditional Access “What If” tool for the exact user and app. It shows which policy blocks the sign-in without anyone changing a setting.

Fix Tenant and Subscription Errors

Sometimes sign-in succeeds, but you see “No subscriptions found,” or you land in the wrong directory. A tenant is a dedicated Entra directory for an organization. A subscription is the billing and governance boundary for resources. Learn the difference in what a tenant in Azure means.

Common causes:

• Your account has no Azure RBAC role on any subscription. RBAC grants permissions through roles at a chosen scope. Start with what RBAC is.
• You signed in to your home tenant, but the subscription lives in another.
• A guest account has not been accepted or assigned a role.

If you need tenant-level access without a subscription, use:

az login --tenant <tenant-id> --allow-no-subscriptions

--allow-no-subscriptions lets the sign-in finish even when no subscription is visible. Then check what you can see:

az account list --output table

This lists every subscription your identity can reach. The az account list article explains the columns. If the target subscription appears, select it:

az account set --subscription "<subscription-name-or-id>"

This sets the default for later commands. Read az account set for details. If you still see tenant errors, these two guides cover them: please provide a valid tenant or a valid subscription and requested tenant identifier is not valid.

To confirm your permissions, check your role in the Azure portal. Test with a normal, non-admin account when possible, because an Owner account hides missing-role problems.

Pro Tip: I once spent an hour on a “login failure” that was actually a missing Reader role. The sign-in worked fine, and the CLI simply had no subscription to show.

Fix Proxy, Firewall, and Certificate Errors

If the error says CERTIFICATE_VERIFY_FAILED or “self signed certificate in certificate chain,” a proxy is probably intercepting HTTPS traffic. Many companies use TLS inspection, where a proxy re-signs traffic with its own certificate. The CLI’s Python runtime does not trust that certificate unless you tell it to.

The right fix is to trust the proxy’s root certificate:

export REQUESTS_CA_BUNDLE="/path/to/corporate-ca-bundle.pem"
export HTTPS_PROXY="http://<proxy-host>:<port>"
az login --use-device-code

REQUESTS_CA_BUNDLE points the CLI at a certificate bundle that inclu