[BUG] Audience https://api.fabric.microsoft.com/ is not a supported MSI token audience.

[Tonychen0227]

To Reproduce

az extension add --name serviceconnector-passwordless --upgrade
az webapp connection create fabric-sql --connection fabricsql_9343df --source-id /subscriptions/937bc588-a144-4083-8612-5f9ffbbddb14/resourceGroups/rg-Test/providers/Microsoft.Web/sites/FabricDemo --target-id https://api.fabric.microsoft.com/v1/workspaces/6fb24b6c-6d5e-4533-91e7-1cc745b8b0f4/SqlDatabases/92f30990-7ba7-426c-a98d-c7a7565b81d2 --client-type dotnet --system-identity --connstr-props Server=x6eps4xrq2xudenlfv6naeo3i4-nrf3e326nuzulephdtdulofq6q.msit-database.fabric.microsoft.com,1433 Database=TonyFabric-92f30990-7ba7-426c-a98d-c7a7565b81d2

Observed Behavior

Audience https://api.fabric.microsoft.com/ is not a supported MSI token audience.

Expected behavior

Token requested by the extension is successfully retrieved.

Is this specific to Cloud Shell?

Please verify if the same issue can be reproduced by running the same tool outside Cloud Shell - for example,
by installing it on your own computer. If so, it is likely to be a bug in that tool or in the Azure service it communicates with,
not in Cloud Shell. Please file the issue with the appropriate project.

This works in normal CLI, not in cloud shell.

Interface information

How are you accessing Cloud Shell - https://shell.azure.com, https://portal.azure.com, via Windows Terminal, or some other method?
If a browser, which Operating System and browser are you using? (ex. Edge on Windows 10)

Edge on Windows 11

Additional context

Resource setup required to reproduce.

[Tonychen0227]

Hi @surajssd could you please get someone on your team to help triage this? This is blocking a critical new product for us.

Thanks!

[Tonychen0227]

For more context, this is the command we are trying to run in the cloud shell:

az account get-access-token --output json --resource https://api.fabric.microsoft.com/

[Tonychen0227]

Your Cloud Shell session will be ephemeral so no files or system changes will persist beyond your current session.
tony [ ~ ]$ az account get-access-token --output json --resource https://api.fabric.microsoft.com/
A Cloud Shell credential problem occurred. When you report the issue with the error below, please mention the hostname 'SandboxHost-638772488412419748'
Audience https://api.fabric.microsoft.com/ is not a supported MSI token audience.
Interactive authentication is needed. Please run:
az login --scope https://api.fabric.microsoft.com//.default
tony [ ~ ]$ ^[[200~az account get-access-token --output json --resource https://api.fabric.microsoft.com/~^C
tony [ ~ ]$ az login --scope https://api.fabric.microsoft.com//.default
Cloud Shell is automatically authenticated under the initial account signed-in with. Run 'az login' only if you need to use a different account
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code AJ6TGT2R9 to authenticate.

However, interactive login is also no good, since it shows:

[darrentu]

Hey Tony, can you reach out to us on our internal Microsoft Teams and we can discuss this further?