Confusing Identity Authentication Messages

“Response from "az login --identity" can display confusing message > ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62 **Describe the bug** When a managed identity is implicitly used to authenticate, a message can be displayed saying incorrectly, that a system assigned identity is being used, when it should say user-assigned. This only happens when there is a single user-assigned identity and no system-assigned identity <!--- A clear and concise description of what the bug is. ---> **To Reproduce** <!--- Steps to reproduce the behavior. ---> 1. Create an Azure VM 2. Associate it with a single user-assigned identity, ensure that system-assigned identity is not enabled 3. Access VM using shell 4. Install Azure CLI 5. Authenticate using `az login --identity` (as the user-assigned identity is the only one available, it is used) 6. observe that response says that system-assigned identity was used, instead of user-assigned identity ``` azureuser@temp1:~$ az login --identity [ { "environmentName": "AzureCloud", "homeTenantId": "<snip>", "id": "<snip>", "isDefault": true, "managedByTenants": [], "name": "Visual Studio Enterprise Subscription", "state": "Enabled", "tenantId": "<snip>", "user": { "assignedIdentityInfo": "MSI", "name": "systemAssignedIdentity", "type": "servicePrincipal" } } ] ``` 7. Authenticate using `az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/<myRG>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<myID>` 8. Observe that the response correctly references the user-assigned identity ``` azureuser@temp1:~$ az login --identity -u /subscriptions/<snip>/resourceGroups/Revocation/providers/Microsoft.ManagedIdentity/userAssignedIdentities/RevocationUAM [ { "environmentName": "AzureCloud", "homeTenantId": "<snip>", "id": "<snip>", "isDefault": true, "managedByTenants": [], "name": "Visual Studio Enterprise Subscription", "state": "Enabled", "tenantId": "<snip>", "user": { "assignedIdentityInfo": "MSIResource-/subscriptions/<snip>/resourceGroups/Revocation/providers/Microsoft.ManagedIdentity/userAssignedIdentities/RevocationUAM", "name": "userAssignedIdentity", "type": "servicePrincipal" } } ] ``` 9. Result - can cause confusion for new users whether the correct identity is being used / if the VM does actually have a system-assigned identity that is being used **Expected behavior** When a user-assigned identity is used to authenticate, the response should correctly contain the details of the identity, even if it was not explicitly referenced in the az login command through the `-u` parameter **Environment summary** * VM created from `Ubuntu Server 18.04 LTS` image in portal * Shell type: OSX terminal, connecting to VM by ssh * CLI installed using `curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash` * CLI version: ``` azure-cli 2.25.0 core 2.25.0 telemetry 1.0.6 Python location '/opt/az/bin/python3' Extensions directory '/home/azureuser/.azure/cliextensions' Python (Linux) 3.6.10 (default, Jun 11 2021, 05:19:38) [GCC 9.3.0] Legal docs and information: aka.ms/AzureCliLegal Your CLI is up-to-date. Please let us know how we are doing: https://aka.ms/azureclihats and let us know if you're interested in trying out our newest features: https://aka.ms/CLIUXstu ``` **Additional context** This only happens when there is a single user-assigned identity and no system-assigned identity. The overall behaviour is correct, it's just the message that is returned is confusing, possibly because the user-assigned identity has not been explicitly referenced in the login command. ”