The access token is from the wrong issuer

Dhariwal, Jaanvi 15

I am getting this error while deploying container apps environment through terraform, all the other resources are created on the right subscription as well as tenant id but for container apps only I'm not able to make them up.

RESPONSE 401: 401 Unauthorized

│ ERROR CODE: InvalidAuthenticationTokenTenant

│ --------------------------------------------------------------------------------

│ {

│ "error": {

│ "code": "InvalidAuthenticationTokenTenant",

│ "message": "The access token is from the wrong issuer 'https://sts.windows.net/tenant-id/'. It must match one of the tenants https://sts.windows.net/tenant-id/' associated with this subscription. Please use any authority (URL) from 'https://login.windows.net/tenant-id' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."

MayankBargali-MSFT 70,751 Reputation points

2023-08-24T05:59:02.8766667+00:00
@Dhariwal, Jaanvi Thanks for reaching out.

It seems like you are facing an authentication issue while deploying container apps environment through Terraform. The error message suggests that the access token is from the wrong issuer, and it must match one of the tenants associated with this subscription.

To resolve this issue, you can try the following steps:

Make sure that the tenant ID and subscription ID are correct in your Terraform configuration file.

Check if the Azure CLI is logged in with the correct account. You can use the following command to check:

az account show

If the account is not correct, you can use the following command to log in:

az login

If you are using a service principal for authentication, make sure that the service principal has the correct permissions to access the subscription and the tenant.

Try using a different authority (URL) to get the token. You can use the following command to set the authority:

az cloud set --name AzureCloud

This will set the authority to 'https://login.microsoftonline.com/'.

The other reason could be as mentioned in the error "if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later". In case if you have transferred the subscription to different tenant then please wait for some hours and retry the operation again.

If none of the above step's work, please provide more information about your Terraform configuration file and the steps you have taken so far.
Dhariwal, Jaanvi 15 Reputation points

2023-08-25T07:32:43.3633333+00:00

I have tried everything but nothing worked, I am logging in through az login --tenant <tenant-id>, az account show told that I am in right subscription and tenant, other resources are being created in desired resource groups, but only while creating container apps environment I am having this error.
MayankBargali-MSFT 70,751 Reputation points

2023-08-28T10:23:41.1233333+00:00

@Dhariwal, Jaanvi Just to confirm you are not performing the cross-tenant operation. I will suggest you create a bug here to track it and terraform team can assist you further.
Andrew Folz 5 Reputation points

2023-09-05T18:16:58.2766667+00:00

Hello, I am also having the same exact issue when trying to list my datastores via the azure.ai.ml.MLClient.from_config() method. The link to creating a bug was not available as well. I have not transferred my subscription. The azureml.core.Workspace.datastores method works perfectly, but I am struggling to get MLClient() to work. I need MLClient for loading and importing data locally to my machine to run MLFlow pipelines locally on my machine for testing.
Magaret Wong 5 Reputation points

2023-11-30T05:50:47.2066667+00:00
Hello all - was there a solution to this issue? I am having the same problem with Terraform.

Scenario: https://developer.hashicorp.com/terraform/tutorials/azure/aks

Logged in with "az login"

Terraform apply failed with SubscriptionNotFound - for some reason it's trying to use a different sub-id

I then added "subscription_id" to the Terraform provider block, using the sub-id associated with my Azure account

terraform apply failed with the 401 "The access token is from the wrong issuer 'https://sts.windows.net/<diifferent tenant id>'"
Abhimanyu Bajaj (Linkedin/theabhibajaj/) 0 Reputation points

2024-02-07T20:26:00.1233333+00:00

Hello,

So we need to stick with version 3.0.0 for hashicorp azurerm provider.
Do a terraform init --upgrade
terraform apply --auto-approve afterwards. I replicated :)
Gerry Tan 0 Reputation points Microsoft Employee

2024-12-14T06:24:02.76+00:00

In my case there are bunch of ARM_ environment variables set in my shell that screw up the authentication set via az login. After unsetting these env vars I was able to authenticate the Terraform REST API calls.

Note that these env vars are specific to azurerm providers.

1 answer

Joshua Worley 0

I had a similar problem when creating new resources in terraform using the azurerm provider.

provider "azurerm" {
  features {}
  subscription_id            = var.parent_tenant_subscription_id
  skip_provider_registration = true
}

data "azurerm_billing_enrollment_account_scope" {
  billing_account_name    = var.billing_account_name
  enrollment_account_name = var.enrollment_account_name # this is from the child_tenant
}

resource "azurerm_subscription" "child_tenant" {
  subscription_name = "my_child_subscription"
  billing_scope_id  = data.azurerm_billing_enrollment_account_scope.parent.id
}

When creating the subscription, I had to reference the subscription_id from a parent account. Once that is created, I reference the new subscription id in a new provider for creating my resource where I previously encountered the error you received.

provider "azurerm" {
  features {}
  alias                      = "child"
  subscription_id            = azurerm_subscription.child_tenant.subscription_id
  skip_provider_registration = true
}

resource "azurerm_resource_group" "logging" {
  provider = azurerm.child
  name     = "child_logging"
  location = "East US"
}

Share via

The access token is from the wrong issuer

1 answer

Your answer