az devops fails with confusing permission denied for invalid organization #32897
Description
When using az devops If you use a typo when specifying the organization name, and so get an invalid organization name, then the underlying API gives a 404 Not Found, but the error message from az is Permission Denied (403 Forbidden). This is super confusing and makes it very hard to spot the typo because you go looking for security configuration problems or token problems, instead of looking for a typo.
Expect: no such organization should be reported as such
Actual: no such organization is reported as token problem with the preceeding az login command.
az devops project list --debug
cli.knack.cli: Command arguments: ['devops', 'project', 'list', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
Enable VT mode.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x0000012BE5665300>, <function OutputProducer.on_global_arguments at 0x0000012BE5C168E0>, <function CLIQuery.on_global_arguments at 0x0000012BE5C60860>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'devops': ['azext_devops']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Loaded command modules in parallel:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: Total (0) 0.001 0 0
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: azure-devops 0.130 60 192 C:\Users\RJBlack.azure\cliextensions\azure-devops
cli.azure.cli.core: Total (1) 0.130 60 192
cli.azure.cli.core: Loaded 60 groups, 192 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : devops project list
cli.azure.cli.core: Command table: devops project list
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x0000012BE83B1080>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\RJBlack.azure\commands\2026-03-03.10-28-01.devops_project_list.7176.log'.
az_command_data_logger: command args: devops project list --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x0000012BE83FADE0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x0000012BE847D120>, <function register_cache_arguments..add_cache_arguments at 0x0000012BE847D300>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x0000012BE847D3A0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x0000012BE5C16980>, <function CLIQuery.handle_query_parameter at 0x0000012BE5C60900>, <function register_ids_argument..parse_ids_arguments at 0x0000012BE847D1C0>, <function DevCommandsLoader.post_parse_args at 0x0000012BE84C5620>]
az_command_data_logger: extension name: azure-devops
az_command_data_logger: extension version: 1.0.2
cli.azext_devops.dev.team.project: Opening web page: Test CLI Release
cli.azext_devops.dev.team.project: __________________________________________________________________________________________________
cli.azext_devops.dev.common.git: GitDetect: Could not detect current remotes based on current working directory.
cli.azext_devops.dev.common.git: Command '['git', 'remote', '-v']' returned non-zero exit status 128.
Traceback (most recent call last):
File "C:\Users\RJBlack.azure\cliextensions\azure-devops\azext_devops\dev\common\git.py", line 106, in get_git_remotes
output = subprocess.check_output([_GIT_EXE, 'remote', '-v'], stderr=subprocess.STDOUT)
File "subprocess.py", line 472, in check_output
File "subprocess.py", line 577, in run
subprocess.CalledProcessError: Command '['git', 'remote', '-v']' returned non-zero exit status 128.
cli.azext_devops.dev.common.services: Detect: Url discovery took 0:00:00.163094
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli:https://msrc-optics.visualstudio.com
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli: default
cli.azure.cli.core: Current cloud config:
AzureCloud
cli.azext_devops.dev.common.services: trying to get token (temp) for tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 and user SC-wk23@microsoft.com
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\Users\RJBlack\.azure\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\RJBlack.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47
msal.authority: openid_config(https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0/.well-known/openid-configuration) = {'token_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': 'WW', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['499b84ac-1321-427f-aa17-267ca6975798/.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 9b68404a-368a-40cc-ac46-a739df92f2d8
cli.azext_devops.dev.common.services: instance recieved in validate_token_for_instance https://msrc-optics.visualstudio.com
cli.azext_devops.dev.common.services: instance processed in validate_token_for_instance https://msrc-optics.visualstudio.com
msrest.universal_http.requests: Configuring retry: max_retries=3, backoff_factor=0.8, max_backoff=90
msrest.universal_http.requests: Configuring retry: max_retries=3, backoff_factor=0.8, max_backoff=90
azext_devops.devops_sdk._file_cache: Cache file does not exist: C:\Users\RJBlack.azure-devops\python-sdk\cache\resources.json
azext_devops.devops_sdk.connection: File cache miss for resources on: https://msrc-optics.visualstudio.com
azext_devops.devops_sdk._file_cache: Cache file does not exist: C:\Users\RJBlack.azure-devops\python-sdk\cache\options.json
azext_devops.devops_sdk.client: File cache miss for options on: https://msrc-optics.visualstudio.com
azext_devops.devops_sdk.client: OPTIONS https://msrc-optics.visualstudio.com/_apis
msrest.universal_http: Configuring redirects: allow=True, max=30
msrest.universal_http: Configuring request: timeout=100, verify=True, cert=None
msrest.universal_http: Configuring proxies: ''
msrest.universal_http: Evaluate proxies against ENV settings: True
urllib3.connectionpool: Starting new HTTPS connection (1): msrc-optics.visualstudio.com:443
urllib3.connectionpool: https://msrc-optics.visualstudio.com:443 "OPTIONS /_apis HTTP/1.1" 404 29
msrest.exceptions: The resource cannot be found. Operation returned a 404 status code.
cli.azext_devops.dev.common.services: The resource cannot be found. Operation returned a 404 status code.
cli.azext_devops.dev.common.services: failed while trying to get token for tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
cli.azext_devops.dev.common.services: trying to get token (temp) for tenant 72f988bf-86f1-41af-91ab-2d7cd011db47 and user rjblack@microsoft.com
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47
msal.authority: openid_config(https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0/.well-known/openid-configuration) = {'token_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': 'WW', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['499b84ac-1321-427f-aa17-267ca6975798/.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 74aaf829-a205-4821-a7a0-99491b9a2b32
cli.azext_devops.dev.common.services: instance recieved in validate_token_for_instance https://msrc-optics.visualstudio.com
cli.azext_devops.dev.common.services: instance processed in validate_token_for_instance https://msrc-optics.visualstudio.com
msrest.universal_http.requests: Configuring retry: max_retries=3, backoff_factor=0.8, max_backoff=90
msrest.universal_http.requests: Configuring retry: max_retries=3, backoff_factor=0.8, max_backoff=90
azext_devops.devops_sdk.connection: File cache miss for resources on: https://msrc-optics.visualstudio.com
azext_devops.devops_sdk.client: File cache miss for options on: https://msrc-optics.visualstudio.com
azext_devops.devops_sdk.client: OPTIONS https://msrc-optics.visualstudio.com/_apis
msrest.universal_http: Configuring redirects: allow=True, max=30
msrest.universal_http: Configuring request: timeout=100, verify=True, cert=None
msrest.universal_http: Configuring proxies: ''
msrest.universal_http: Evaluate proxies against ENV settings: True
urllib3.connectionpool: Starting new HTTPS connection (1): msrc-optics.visualstudio.com:443
urllib3.connectionpool: https://msrc-optics.visualstudio.com:443 "OPTIONS /_apis HTTP/1.1" 404 29
msrest.exceptions: The resource cannot be found. Operation returned a 404 status code.
cli.azext_devops.dev.common.services: The resource cannot be found. Operation returned a 404 status code.
cli.azext_devops.dev.common.services: failed while trying to get token for tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli:https://msrc-optics.visualstudio.com
cli.azext_devops.dev.common._credentials: Getting credential: azdevops-cli: default
cli.azext_devops.dev.common.exception_handler: handling generic error
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 682, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 812, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 804, in _run_job
File "C:\Users\RJBlack.azure\cliextensions\azure-devops\azext_devops\dev\common\exception_handler.py", line 31, in azure_devops_exception_handler
reraise(*sys.exc_info())
~~~~~~~^^^^^^^^^^^^^^^^^
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\six.py", line 719, in reraise
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 781, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "C:\Users\RJBlack.azure\cliextensions\azure-devops\azext_devops\dev\team\project.py", line 142, in list_projects
core_client = get_core_client_v51(organization)
File "C:\Users\RJBlack.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 220, in get_core_client_v51
connection = get_connection(organization)
File "C:\Users\RJBlack.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 43, in get_connection
credentials = _get_credentials(organization)
File "C:\Users\RJBlack.azure\cliextensions\azure-devops\azext_devops\dev\common\services.py", line 81, in _get_credentials
raise get_authentication_error('Before you can run Azure DevOps commands, you need to run the login command'
'(az login if using AAD/MSA identity else az devops login if using PAT token) to '
'setup credentials.')
knack.util.CLIError: Before you can run Azure DevOps commands, you need to run the login command(az login if using AAD/MSA identity else az devops login if using PAT token) to setup credentials. Please see https://aka.ms/azure-devops-cli-auth for more information.
cli.azure.cli.core.azclierror: Before you can run Azure DevOps commands, you need to run the login command(az login if using AAD/MSA identity else az devops login if using PAT token) to setup credentials. Please see https://aka.ms/azure-devops-cli-auth for more information.
az_command_data_logger: Before you can run Azure DevOps commands, you need to run the login command(az login if using AAD/MSA identity else az devops login if using PAT token) to setup credentials. Please see https://aka.ms/azure-devops-cli-auth for more information.
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x0000012BE83B1300>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 3.844 seconds (init: 1.169, invoke: 2.675)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4229 in cache file under C:\Users\RJBlack.azure\telemetry\20260303102804079
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry_init_.pyc C:\Users\RJBlack.azure C:\Users\RJBlack.azure\telemetry\20260303102804079"
telemetry.process: Return from creating process 55820
telemetry.main: Finish creating telemetry upload process.
az --version
azure-cli 2.84.0
core 2.84.0
telemetry 1.1.0
Extensions:
azure-devops 1.0.2
Dependencies:
msal 1.35.0b1
azure-mgmt-resource 24.0.0
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\RJBlack.azure'
Extensions directory 'C:\Users\RJBlack.azure\cliextensions'
Python (Windows) 3.13.11 (tags/v3.13.11:6278944, Dec 5 2025, 16:26:58) [MSC v.1944 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.