Failed to refresh the RT and cannot use existing AT (expired or missing)

[TheOnlyWei]

Description

Hi, in our Azure Local environment, we are seeing issues with Connect-AzAccount with credential login, but we don't see this issue with interactive login (browser or device authentication flow) or using Azure CLI's credential flow. The issue seems to be failure to refresh the RT no matter how many times we call Connect-AzAccount with credential login. The Az modules show older versions, but the same issue happens on latest versions.

Note that I cannot paste the entire debug output because of character limits:

Body is too long (maximum is 65536 characters)

Issue script & Debug output

DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] Skipping Instance discovery for Aad
authority because it is not enabled.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] [FindRefreshTokenAsync] Refresh token found
 in the cache? - True
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] [Region discovery] Not using a regional
authority.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] [Instance Discovery] Skipping Instance
discovery because it is disabled.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] [Throttling] Entry found. Creation:
2/17/2026 11:06:15 PM +00:00 Expiration: 2/17/2026 11:08:15 PM +00:00
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] [Throttling] Returning valid entry.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] [Throttling] Exception thrown because of
throttling rule UiRequired
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] Refreshing the RT failed. Is the exception
retryable? False. Is there an AT in the cache that is usable? False
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] Failed to refresh the RT and cannot use
existing AT (expired or missing).
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET Framework 4.8.4795.0 Microsoft Windows 10.0.20348  [2026-02-17 23:08:07Z - 3be4ff99-6f95-4556-be17-67f5ef81ed14] Exception type:
Microsoft.Identity.Client.MsalThrottledUiRequiredException
, ErrorCode: invalid_grant
HTTP StatusCode 400
CorrelationId e089420c-de5b-41d3-9a44-a2ce39c96168
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.<ExecuteAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Utils.StopwatchService.<MeasureCodeBlockAsync>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<RunAsync>d__11.MoveNext()
DEBUG: SharedTokenCacheCredential.GetToken was unable to retrieve an access token. Scopes: [ https://armmanagement.autonomous.cloud.private/.default ] ParentRequestId:  Exception:
Azure.Identity.CredentialUnavailableException (0x80131500): SharedTokenCacheCredential authentication unavailable. Token acquisition failed for user admin@demo.asz. Ensure that you have authenticated
with a developer tool that supports Azure single sign on.
 ---> Microsoft.Identity.Client.MsalThrottledUiRequiredException (0x80131500): AADSTS70000: Authentication failed. The refresh token is not valid.
Trace ID: acc6ba22-733b-4a1e-90d7-f5837828da75
Correlation ID: e089420c-de5b-41d3-9a44-a2ce39c96168
Timestamp: 2026-02-17 23:06:15Z
WARNING: Unable to acquire token for tenant '98b8267d-e97f-426e-8b3f-7956511fd63f' with error 'Authentication failed against tenant 98b8267d-e97f-426e-8b3f-7956511fd63f. User interaction is required.
This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional
 parameter '-TenantId 98b8267d-e97f-426e-8b3f-7956511fd63f'.'
DEBUG: 3:08:08 PM - Unable to acquire token for tenant '98b8267d-e97f-426e-8b3f-7956511fd63f' with error 'Microsoft.Azure.Commands.Common.Exceptions.AzPSAuthenticationFailedException: Authentication
failed against tenant 98b8267d-e97f-426e-8b3f-7956511fd63f. User interaction is required. This may be due to the conditional access policy settings such as multi-factor authentication (MFA). If you
need to access subscriptions in that tenant, please rerun 'Connect-AzAccount' with additional parameter '-TenantId 98b8267d-e97f-426e-8b3f-7956511fd63f'. --->
Azure.Identity.CredentialUnavailableException: SharedTokenCacheCredential authentication unavailable. Token acquisition failed for user admin@demo.asz. Ensure that you have authenticated with a
developer tool that supports Azure single sign on. ---> Microsoft.Identity.Client.MsalThrottledUiRequiredException: AADSTS70000: Authentication failed. The refresh token is not valid.
Trace ID: acc6ba22-733b-4a1e-90d7-f5837828da75
Correlation ID: e089420c-de5b-41d3-9a44-a2ce39c96168
Timestamp: 2026-02-17 23:06:15Z
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.<ExecuteAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Utils.StopwatchService.<MeasureCodeBlockAsync>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<RunAsync>d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Identity.Client.ApiConfig.Executors.ClientApplicationBaseExecutor.<ExecuteAsync>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.<ExecuteAsync>d__0`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Azure.Identity.MsalPublicClient.<AcquireTokenSilentCoreAsync>d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Azure.Identity.MsalPublicClient.<AcquireTokenSilentAsync>d__10.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Azure.Identity.SharedTokenCacheCredential.<GetTokenImplAsync>d__31.MoveNext()
   --- End of inner exception stack trace ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)
   at Azure.Identity.SharedTokenCacheCredential.<GetTokenImplAsync>d__31.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Azure.Identity.SharedTokenCacheCredential.<GetTokenAsync>d__30.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.PowerShell.Authenticators.MsalAccessToken.<GetAccessTokenAsync>d__33.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.Azure.Commands.Common.Authentication.Factories.AuthenticationFactory.Authenticate(IAzureAccount account, IAzureEnvironment environment, String tenant, SecureString password, String
promptBehavior, Action`1 promptAction, IAzureTokenCache tokenCache, String resourceId)
   --- End of inner exception stack trace ---
   at Microsoft.Azure.Commands.Common.Authentication.Factories.AuthenticationFactory.Authenticate(IAzureAccount account, IAzureEnvironment environment, String tenant, SecureString password, String
promptBehavior, Action`1 promptAction, IAzureTokenCache tokenCache, String resourceId)
   at Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient.AcquireAccessToken(IAzureAccount account, IAzureEnvironment environment, String tenantId, SecureString password, String
promptBehavior, Action`1 promptAction, String resourceId)
   at Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient.ListAllSubscriptionsForTenant(String tenantId)'
DEBUG: 3:08:08 PM - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].

DEBUG: 3:08:08 PM - [ConfigManager] Got nothing from [LoginExperienceV2], Module = [], Cmdlet = []. Returning default value [On].
DEBUG: 3:08:08 PM - [ConfigManager] Got [False] from [EnableLoginByWam], Module = [], Cmdlet = [].
DEBUG: 3:08:08 PM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 3:08:08 PM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent:  Module: Az.Accounts:4.0.2; CommandName: Connect-AzAccount; PSVersion: 5.1.20348.4294; IsSuccess: True; Duration: 00:00:03.3621834; SanitizeDuration: 00:00:00.0001052
DEBUG: 3:08:08 PM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 3:08:08 PM - ConnectAzureRmAccountCommand end processing.
Subscription name   Tenant
-----------------   ------
System Subscription 98b8267d-e97f-426e-8b3f-7956511fd63f

Environment data

Name                           Value
----                           -----
PSVersion                      5.1.20348.4294
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.4294
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Module versions

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     4.0.2      Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}
Script     6.3.1      Az.KeyVault                         {Add-AzKeyVaultCertificate, Add-AzKeyVaultCertificateContact, Add-AzKeyVaultKey, Add-AzKeyVaultManagedStorageAccount...}
Script     7.9.0      Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}

Error output

   HistoryId: 33


Message        : SharedTokenCacheCredential authentication failed:
StackTrace     :    at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)
                    at Azure.Identity.SharedTokenCacheCredential.<GetTokenImplAsync>d__31.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.SharedTokenCacheCredential.<GetTokenAsync>d__30.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.PowerShell.Authenticators.MsalAccessToken.<GetAccessTokenAsync>d__33.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at Microsoft.Azure.Commands.Common.Authentication.Factories.AuthenticationFactory.Authenticate(IAzureAccount account, IAzureEnvironment environment, String tenant, SecureString
                 password, String promptBehavior, Action`1 promptAction, IAzureTokenCache tokenCache, String resourceId)
                    at Microsoft.Azure.Commands.Common.Authentication.Factories.AuthenticationFactory.Authenticate(IAzureAccount account, IAzureEnvironment environment, String tenant, SecureString
                 password, String promptBehavior, Action`1 promptAction, String resourceId)
                    at Microsoft.Azure.Commands.Common.ContextAdapter.<>c__DisplayClass15_0.<AuthorizeRequest>b__0()
                    at System.Threading.Tasks.Task`1.InnerInvoke()
                    at System.Threading.Tasks.Task.Execute()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.Commands.Common.ContextAdapter.<AuthorizeRequest>d__15.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.Commands.Common.ContextAdapter.<AuthenticationHelper>d__13.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.Commands.Common.ContextAdapter.<>c__DisplayClass10_0.<<AddAuthorizeRequestHandler>b__0>d.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.Commands.Common.ContextAdapter.<>c__DisplayClass9_0.<<AddPatchRequestUriHandler>b__0>d.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Module.<SendAsync>d__80.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.MSGraph.<ServicePrincipalsServicePrincipalListServicePrincipal_Call>d__271.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.MSGraph.<ServicePrincipalsServicePrincipalListServicePrincipal_Call>d__271.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.MSGraph.<ServicePrincipalsServicePrincipalListServicePrincipal>d__266.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Cmdlets.GetAzADServicePrincipal_List.<ProcessRecordAsync>d__90.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Cmdlets.GetAzADServicePrincipal_List.<ProcessRecordAsync>d__90.MoveNext()
Exception      : Azure.Identity.AuthenticationFailedException
InvocationInfo : {Get-AzADServicePrincipal_List}
Line           :     Az.MSGraph.internal\Get-AzADServicePrincipal @PSBoundParameters

Position       : At C:\Program Files\WindowsPowerShell\Modules\Az.Resources\7.9.0\MSGraph.Autorest\custom\Get-AzADServicePrincipal.ps1:221 char:5
                 +     Az.MSGraph.internal\Get-AzADServicePrincipal @PSBoundParameters
                 +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 33

Message        : AADSTS50001: The resource is disabled or does not exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you are trying to access.
                 Requested resource: 'MicrosoftGraphEndpointResourceId'
                 Trace ID: 5709b42e-152e-4a42-96fd-14791270f838
                 Correlation ID: 3e60ec64-7f8e-4f4d-8f1e-974780fd6fa2
                 Timestamp: 2026-02-14 08:27:50Z
StackTrace     :    at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.<ExecuteAsync>d__5.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Identity.Client.Utils.StopwatchService.<MeasureCodeBlockAsync>d__4.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Identity.Client.Internal.Requests.RequestBase.<RunAsync>d__11.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Microsoft.Identity.Client.ApiConfig.Executors.ClientApplicationBaseExecutor.<ExecuteAsync>d__2.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.<ExecuteAsync>d__0`1.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.MsalPublicClient.<AcquireTokenSilentCoreAsync>d__11.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.MsalPublicClient.<AcquireTokenSilentAsync>d__10.MoveNext()
                 --- End of stack trace from previous location where exception was thrown ---
                    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
                    at Azure.Identity.SharedTokenCacheCredential.<GetTokenImplAsync>d__31.MoveNext()
Exception      : Microsoft.Identity.Client.MsalServiceException
InvocationInfo : {Get-AzADServicePrincipal_List}
Line           :     Az.MSGraph.internal\Get-AzADServicePrincipal @PSBoundParameters

Position       : At C:\Program Files\WindowsPowerShell\Modules\Az.Resources\7.9.0\MSGraph.Autorest\custom\Get-AzADServicePrincipal.ps1:221 char:5
                 +     Az.MSGraph.internal\Get-AzADServicePrincipal @PSBoundParameters
                 +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 33

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Get-AzAccessToken : SharedTokenCacheCredential authentication unavailable. #15619
• Get-AzADServicePrincipal fails with AuthenticationFailedException - SharedTokenCacheCredential authentication failed when used from custom Az environment #27948
• [Az.Functions] Failed to get Function App Stack definitions from ARM API. #24166

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

For custom AAD app, user needs to authorize Azure PowerShell client app. Add client id 1950a258-227b-4e31-a9cf-717495945fc2. Some tenant requires consent from admin, user needs to do that via Portal. Current Azure PowerShell doesn't support it.

Reference:

• Get-AzAccessToken : SharedTokenCacheCredential authentication unavailable. #15619 (comment)

Solution 2:

We have priority to improve Invoke-AzRestMethod. It will analyze user's input URL and figure out correct resource name (scope) according to Azure environment variables for further authentication. Since your endpoint cannot be recognized by Azure PowerShell, it cannot be supported even we improve it as I mentioned above.

Reference:

• Get-AzAccessToken : SharedTokenCacheCredential authentication unavailable. #15619 (comment)

Powered by issue-sentinel