[Issue] No subscriptions found

[dfberry]

• Make sure you've installed the latest version using instructions

Output from azd version
Run azd version and copy and paste the output here:
azd version 1.22.5 (commit f1850eb)

Describe the bug
AZD doesn't find my subscriptions without telling it what tenant. The azd response for no subscriptions found should include information that you should try again with your tenant id.

To Reproduce
Steps to reproduce the behavior...

1. On mac (apply silicon) with docker
2. Fork and clone https://github.com/Azure-Samples/todo-nodejs-mongo-aca
3. azd auth login -> success
4. No subscriptions found
5. azd auth login --tenant-id -> success

Expected behavior

1. I've never had to tell azd the tenant before for my personal FTE VS enterprise sub.
2. Error response should indicate to try tenant switch

Environment
Information on your environment:
* Language name and version
* IDE and version : [e.g. Visual Studio 16.3]

Additional context

[Menghua1]

@dfberry I'm unable to reproduce this issue. Could you please confirm:

1. Does your default (home) tenant have any subscriptions?
2. Does the tenant you specified with --tenant-id require Multi-Factor Authentication (additional verification like a phone code)?

When running azd auth login without --tenant-id, it scans all tenants. If the primary tenant does not have a subscription, and other tenants require MFA, a "subscription not found" error may occur.

[vhvb1989]

This is kind of expected, but azd should definitely do a better job to help users to figure what's going on.

Reproducing this issue is also complicated. You need access to more than one tenant, then both tenants should require 2FA and both tenants should have access-policies to expire the tokens and require re-auth+2FA within a short period of time (compared to the default).

When that's the case, on the first very azd login, azd would open a browser to login. Assuming that's the very first time, the browser would ask for email to login and will go thru 2FA to complete the login. At the end, the browser would typically ask the user if they want to keep the session opened. During the 2FA, the user would only get access to their home tenant (unless they used the --tenant-id xxx) argument. Azd won't try to login to each tenant (and do 2FA challenge for each of them).

One way I know to make sure azd can have access to all your tenants is to first open the Azure Portal and switch to all your tenants, one by one. If there is an expired 2FA, it would be re-challenge. Then you can run azd login and it would use the browser's access token (if you pick to use the account that is already login) with access to all tenants.

[dfberry]

Can the error text change or can it be an aka link to 1P docs FAQ? I could add an FAQ to docs in the new year.

[vhvb1989]

Can the error text change or can it be an aka link to 1P docs FAQ? I could add an FAQ to docs in the new year.

We have a FAQ here: https://learn.microsoft.com/azure/developer/azure-developer-cli/faq

I think we can create one section for authentication to cover multi-tenants, 2FA and those details there. Then provide the link as a suggestion or learn more for all the azd errors coming from the authManager (tokens, subs, etc). I just need to double check this with the team. But I think it would really help folks, as this a common confusing issue.

It would be really awesome if you could start the writing for the FAQ, yes!