Login-AzureRmAccount : The received access token failed strong authentication.

Question

Running into this error when trying to run a Powershell script against Azure.

I have a read only account I use that has the credential hard coded:

 Login-AzureRmAccount -Credential $plainCred

Normally, that works just fine and logs me in.

However, now when I run this I get this error:

Login-AzureRmAccount -Credential $plainCred
Login-AzureRmAccount : The received access token failed strong authentication. At least one of the claims Authentication Context Class Reference (acr) '0' or Application Authentication
Context Class Reference (appidacr) '0' should have been greater than 0.
At line:1 char:1
+ Login-AzureRmAccount -Credential $plainCred
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Connect-AzureRmAccount], CloudException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand

Not sure how to address this?

Answer 1

We are getting exact same error for the past 2 hours...

Login-AzureRmAccount : The received access token failed strong authentication. At least one of the claims Authentication Context

Class Reference (acr) '0' or Application Authentication Context Class Reference (appidacr) '0' should have been greater than 0.

At line:1 char:1

+ Login-AzureRmAccount  -Credential $psCred

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : CloseError: (:) [Add-AzureRmAccount], CloudException

    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.AddAzureRMAccountCommand

Answer 2

Yes, it JUST started today.

Very odd.

Answer 3

Moved to the Azure scripting forum.

---

\_(ツ)_/

Answer 4

seems to be working now

Answer 5

Any news from MSFT on what caused the issue?

I didn't see any health alerts in the portal?

Answer 6

Being transparent: This issue was an unknown failure and there isn't any RCA for it at this time. There is speculation derived from the errors present that a certificate change could be the culprit but in this case no smoking gun.

Hope that helps!

~Theo

Answer 7

Being transparent: This issue was an unknown failure and there isn't any RCA for it at this time. There is speculation derived from the errors present that a certificate change could be the culprit but in this case no smoking gun.

Hope that helps!

~Theo

Thank you, that is most helpful!

I appreciate just being upfront about it... we all work in IT.. sometimes "crap just breaks"... it's just nice to know it wasn't an issue that we as users could have done something to prevent, etc...

*Granted things don't just break for no reason, but a random "alignment of the planets" can create all kinds of unanticipated issues, Murphy's Law and all, etc, etc... 

Answer 8

It looks like this problem started and then was resolved a few days ago. I'm experiencing the same thing again. Is this still an issue or has it cleared up for everyone else? 

Answer 9

Sadly looks like the issue is back again.... :(

Any word?

"Login-AzureRmAccount : The received access token failed strong authentication."

Answer 10

++

Same issue started again for me as well.

Answer 11

We are experiencing the same error from this morning again.., very frustrating

Answer 12

Any luck with this issue, OneWithQuestions? Is it working for you?

Answer 13

As of 30 minutes ago still no luck, I'll check again.

*Nope, still the same error

Answer 14

thanks for being honest Theo, we'll use manual workaround for now. but looking forward for updates... 

we're based in Australia South East if that makes any difference, first noticed the issue 5 hours ago

Answer 15

For me adding parameters -TenantId 'xxx' -SubscriptionId 'xxx' did the job

It does not work in CI, only interactive command line :(

Answer 16

Doesn't work for me when I include tenantID as I get 

Login-AzureRmAccount : The provided account [e-mail]
does not have access to subscription ID
"46288bb3-52cb-46b1-b62c-9f142ce8b2c5". Please try logging in with different
credentials or a different subscription ID.
At line:1 char:1
+ Login-AzureRmAccount -TenantId $tenantId -Credential $credentials -Su ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Connect-AzureRmAccount], PSInva
   lidOperationException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmA
   ccountCommand

Although if I don't use get-credentials and just enter it using the browser, it works. I do need to get it working via get-credential or a variable as I have automated schedulers.

Answer 17

I am also seeing this for the first time today, 07-March-2018, on runbooks in Azure Automation that have run successfully for months. I think there is a problem on the Azure side.

--mf

Answer 18

thanks for being honest Theo, we'll use manual workaround for now. but looking forward for updates... 

we're based in Australia South East if that makes any difference, first noticed the issue 5 hours ago

aaaaand now it's working again!

Answer 19

login-azureRmAccount was deprecated in azure automation as of 3/11/18. Use add-azureRmAccount
https://docs.microsoft.com/en-us/powershell/module/azurerm.profile/add-azurermaccount?view=azurermps-4.4.1