ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url:

Question

HI,

Am trying to connect to Azure from Azure VM using service principle and Azure Cli but facing the error as described below

it's a windows VM behind the firewall with no internet connection.

There are some firewall openings to allow application agent in the VM to send logs to Azure portal. as described here.

https://learn.microsoft.com/en-us/azure/azure-monitor/app/ip-addresses#outgoing-ports

we do not want to open internet connection completely but is there a way to connect to Azure portal from VM by opening few ports in firewall ?

**

• ERROR

**:

az login --service-principal -u "xxxxx..

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : NotSpecified: (ERROR: The comm... the traceback::String) [], RemoteException
• FullyQualifiedErrorId : NativeCommandError

ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url:
/a652adc3-xxxxx-xxxx-xxx/v2.0/.well-known/openid-configuration (Caused by ProtocolError('Connection aborted.', ConnectionResetError(10054, 'An
existing connection was forcibly closed by the remote host', None, 10054, None)))
Traceback (most recent call last):
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 382, in _make_request
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\s

Answer 1

Hello @Rathirojini Sangilipandy ,

Thank you for reaching out to the Microsoft Q&A platform. Happy to answer your question.

When you said you are trying to connect to the azure, do you mean you are trying to access the URL "Portal.azure.com" alone or if there are any other Azure URLs?
This error here indicates that Azure CLI cannot connect to the AAD server and port 443. You can try to whitelist the Azure AD URL "login.microsoftonline.com" from your firewall in case of restricted internet connection.

Since, you are looking for login using Azure AD, whitelisting login.microsoftonline.com:443 shall work and for safe-side, you can add *.login.microsoftonline.com:443 to allow all the matching URLs as well.

Check out similar issue here. The right thing to do is to ensure thus and all the endpoints azure portal needs, are allowed through the firewall.

Please "Accept as Answer" and Upvote if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Answer 2

Hi @Prrudram-MSFT ,

Thanks for the clear explanation. Requested our Infra team for whitelisting the URL in firewall settings.
Hope that will fix the issue .

Answer 3

it is simple steps, just open command prompt as administrator and run the command from this directory in windows and for mac and then try again

Configure Azure CLI Python

The Azure CLI uses some Python commands internally, which in turn by default will not make use of trusted system certificates. Also, Azure CLI has its own Python runtime which has its own configuration. You will need to update this Python instance to use a hook that tells the Certifi library to use trusted certificates.

For Windows, in a terminal, navigate to the installation directory for Azure CLI (default C:\Program Files\Microsoft SDKs\Azure\CLI2\ for 64-bit installs). Execute python.exe here with the command:

PS C:\Program Files\Microsoft SDKs\Azure\CLI2>./python.exe -m pip install pip-system-certs

You may need to run your terminal as an administrator.

For Ubuntu (in my case, in WSL), you would do the same. Navigate to the install directory (default /opt/az) and run the following install command using the Python runtime in the bin folder:

myUser@machineName:~$ /opt/az/bin/python3.11 -m pip install pip-system-certs # Python version may be different for your scenario.