az logout will not prevent to az login without inserting credentials

Question

Hello,
after completing my work, I want to ensure that no one who might gain control of my Windows account would be able to perform any Azure CLI operations. However, after

az logout 

I can still do

az login

without asked for my Entra Id login's password and MFA on my phone. I have the default - Web Account Manager Broker. No browser authentication.

Answer 1

Hello Jan Vávra,

Thanks for posting your question in the Microsoft Q&A forum.

When you use az login with WAM on Windows, the authentication tokens are stored securely by the operating system. az logout doesn't completely remove these tokens from the system

To ensure complete logout and prevent unauthorized access, you can run the following command to clear the Azure CLI token cache

az account clear

If you prefer browser-based authentication, you can disable WAM

az config set core.enable_broker_on_windows=false

Configure your Azure AD to issue tokens with shorter lifetimes.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful

Answer 2

Well, the broker was set as a default solution.
And I still ask, how to prevent login without password required?

I also deleted

del %USERPROFILE%\.azure\msal_token_cache.bin  
del %USERPROFILE%\.azure\msal_http_cache.bin

and this also didn't helped.