[Ssh] az ssh: Allow SSH certificate flow in Cloud Shell - #33860
Merged
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
requested review from
Yu Chen (jsntcy),
ZelinWang (wangzelin007) and
Yong Zhang (yonzhan)
August 6, 2026 22:01
microsoft-github-policy-service
Bot
added
Auto-Assign
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Cloud Shell speaks the managed identity protocol but brokers a user token, and MSAL forwards the `data` parameter through acquire_token_interactive to its Cloud Shell endpoint, which accepts the CheckMyAccess/Linux scope and issues an SSH certificate. Blocking it stops `az ssh vm` from working for users signed in with their own account in Cloud Shell. Keep the guard for managed identity, where acquire_token_for_client() takes no `data` and would silently return a plain access token instead of a certificate.
xuming-ms
force-pushed
the
allow-vm-ssh-in-cloudshell
branch
from
August 6, 2026 22:24
a0e1000 to
8d63a67
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Enables az ssh vm SSH-certificate flow to work in Cloud Shell by removing an overly broad Cloud Shell block while keeping managed identity blocked (since it drops SSH-cert data).
Changes:
- Relaxed
Profile.get_msal_token()guard to only reject managed identity (not Cloud Shell). - Updated unit tests to validate Cloud Shell passes through
scopesanddataunchanged to the credential. - Improved the managed-identity error message and adjusted test coverage accordingly.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/azure-cli-core/azure/cli/core/_profile.py | Removes Cloud Shell from the SSH-cert unsupported guard; keeps managed identity blocked. |
| src/azure-cli-core/azure/cli/core/tests/test_profile.py | Reworks Cloud Shell test to assert data propagation and updates MI error message expectation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if managed_identity_type or (in_cloud_console() and account[_USER_ENTITY].get(_CLOUD_SHELL_ID)): | ||
| raise AuthenticationError("VM SSH currently doesn't support managed identity or Cloud Shell.") | ||
| if managed_identity_type: | ||
| # MSAL's ManagedIdentityClient.acquire_token_for_client() takes no `data`, so the |
Member
|
/azp run |
Yeming Liu (isra-fel)
approved these changes
Aug 7, 2026
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Contributor
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
This was referenced Aug 7, 2026
pull Bot
pushed a commit
to LadyK-21/azure-cli
that referenced
this pull request
Aug 12, 2026
(cherry picked from commit 171de4a)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation — ️✔️ All clear
Related command
az ssh vm -n <vm-name> -g <resource-group>Description
#33534 restored a guard in
get_msal_token()that rejects both managed identity and Cloud Shell. The managed identity half is correct, but the Cloud Shell half is an over-block that breaksaz ssh vmfor users signed in with their own account in Cloud Shell.Testing Guide
Unit tests:
test_get_msal_token_cloud_shellnow asserts the call succeeds and thatscopesanddatareach the credential unchanged.CloudShellCredentialStubwas discarding**kwargs, so it could not have caught a droppeddata; it now records it.History Notes
[Ssh]
az ssh: Allow SSH certificate flow in Cloud Shell