[ACR] Fix Azure/azure-cli#33674: az acr login: Fix incorrect resource URL used for local/private registry token acquisition#33675
Draft
Copilot wants to merge 9 commits into
Draft
Conversation
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
microsoft-github-policy-service
Bot
requested review from
northtyphoon,
terencet-dev,
wangzelin007 and
yonzhan
microsoft-github-policy-service
Bot
added
Auto-Assign
Copilot
AI
changed the title
[WIP] Fix Azure local regression for az acr login
[ACR] Fix Azure/azure-cli#33674: Jun 30, 2026
az acr login: Fix incorrect resource URL used for local/private registry token acquisition
Collaborator
Live test results —
|
Collaborator
Live test results —
|
Collaborator
|
ACR |
Collaborator
Live test results —
|
Collaborator
Live test results —
|
Collaborator
Live test results —
|
Collaborator
Live test results —
|
Collaborator
Live test results —
|
azclibot
reviewed
Jun 30, 2026
azclibot
left a comment
azclibot
left a comment
Collaborator
There was a problem hiding this comment.
✅ Agent Review — Pass
All checks are green. Here's the summary:
| Gate | Result |
|---|---|
| CI checks (50/50) | ✅ Passed |
Live test (azdev test --live) |
✅ Passed |
The fix looks good — CI and live tests both completed successfully with no failures. This PR is ready for maintainer review and merge.
Posted by agent-assist (autonomous bug-fix pipeline).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
az acr loginDescription
az acr loginalways requested AAD tokens withhttps://containerregistry.azure.netas the audience. Local IDPs (e.g. ADFS on Azure Local) don't have this public resource registered, causingAADSTS50001failures for any private-cloud registry.Root cause:
_resolve_acr_scope()unconditionally fell back tohttps://containerregistry.azure.netregardless of which cloud the CLI was targeting.Changes:
_docker_utils.py:_resolve_acr_scopenow accepts an optionallogin_serverparameter. For clouds whose name is not in the set of known standard Azure clouds (AzureCloud,AzureChinaCloud,AzureUSGovernment,AzureGermanCloud,AzureBleuCloud), the audience is derived ashttps://<login_server>— matching what the local IDP has registered._get_aad_token_after_challengepasseslogin_serverthrough to_resolve_acr_scope.az config set acr.audience_resource=<value>override continues to take precedence over everything.Resolution order in
_resolve_acr_scope:acr.audience_resourceconfig override (verbatim or expanded)login_serverprovided →https://<login_server>https://containerregistry.azure.netTesting Guide
On Azure Local (private cloud) with a local registry:
Public Azure registries are unaffected — cloud name
AzureCloudstays on the existing audience.History Notes
[ACR]
az acr login: Fix incorrect AAD resource URL used for local/private registry token acquisitionThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.