Azure credentials wrong after deploying with Azure CLI

Question

Azure credentials wrong after deploying with Azure CLI

owenpww 1

Hello I created 2 bots with Bot Framework Composer and I have been successfully testing them on Composer, Emulator and ngrok. I also have been successfully publishing them to Azure initially with the Publish function on Composer but now with a CI/CD pipeline on an Azure project.

My problem is that, in trying to implement a feature, I wanted to determine if it would be better if we switched over to a Bot Framework SDK bot should it be easier to implement and relatively easy to do all the work we've previously done on it. After following this https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-tutorial-deploy-basic-bot?view=azure-bot-service-4.0&tabs=csharp%2Cuserassigned exactly (for Javascript Bot), I was successfully able to implement the feature and deploy the bot to Azure. However, when I tried to test my Composer bots locally again, they no longer were working. Moreover, when I went to the Azure Bot resource for these two bots and I click Manage on their app ID's Azure gives me an error saying the apps couldn't be found. It keeps giving me an error saying that the App ID and password are not found on the tenant. When I try to publish the bots using composer, I get prompted to log in and then it tells me my tenant xxxx is not found. What is strange is that the tenant ID the error is telling me cannot be found is not my home tenant neither my other tenant (I only have two tenants confirmed).

Additionally, I cannot even test the SDK bot locally anymore either (neither on emulator or on ngrok) because of a 401 error (but I can deploy and test it on Azure with the same Azure CLI commands that messed up my Azure credentials). It keeps telling me the app ID and password are incorrect when I know them to be true because I queried this endpoint https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token?= with the exact same app ID and password and it came back successful.

I think the Azure credentials stored on my computer or stored somewhere locally is messing up all my bots. I've tried clearing the cookies, cache and storage on Composer, deleting the contents of .azure dir and az logout but nothing has helped. Azure doesn't even give me the chance to specify what directory or tenant I want to choose when it prompts me to login. Whenever I login, it just assumes this weird tenant ID I've never seen before. Please help me. I cannot test any of the bots (composer or sdk) locally because of these sign in issues.

romungi-MSFT 48,906 Reputation points Microsoft Employee Moderator

2021-12-06T14:06:43.167+00:00

@owenpww Usually when you login with azure cli the list of subscriptions that you have access to is shown based on the account chosen to login. With az logout and az login actions do you see this tenant id in the list? Try using --allow-no-subscriptions option along with az login to list subscriptions and tenants you have access to.

With Azure portal you have an option to switch and check if these services are created on a different directory, Do you have any options to switch and check?
owenpww 1 Reputation point

2021-12-06T17:42:25.523+00:00

@romungi-MSFT For both the Azure CLI (using az account list) and the Azure Portal, I only see two directories in my account. Neither of the 2 directory IDs match with the tenant ID that the error keeps showing me so I'm wondering where it's getting this information and how I can change it to the correct one/s. Whenever I sign in, it doesn't ask for any additional info and just tells me the tenant ID can't be found.

Something that might be useful is that after all these errors, caused by what I assume is deploying the SDK bot using Azure CLI, started happening, when I check the Azure AD > App Registrations, my two composer bots don't show up. Only the SDK bot shows up. Also when I go to Azure Portal and click on the Azure Bot resource for any of the two composer bots and go to Manage Certificates and Secrets, it tells me the apps can't be found. If I go to the Azure Portal and click on the Azure Bot resource for the SDK bot and go to Manage Certificate and Secrets, I can see the list of secrets just fine without error.

Could deploying the SDK bot on a multitenant option somehow have reconfigured my directory and therefore rendered my composer bots unregistered? Could it also have changed my machine's Azure/tenant settings, causing these new Azure login issues? Honestly, I think the answer to both of these are yes because the errors occurred immediately after deploying the SDK bot using Azure CLI. I'm just very unsure as to how and how to fix it.
romungi-MSFT 48,906 Reputation points Microsoft Employee Moderator

2021-12-07T11:04:40.613+00:00

@owenpww I am not sure what could have triggered the issue but deploying the bot through SDK or composer should not have altered your AAD settings. Composer bots are multi-tenant enabled as per my knowledge and newer bots with the SDK can use single tenant. I am just curious to check what was the tenant id that you used while creating the bot with the SDK? The linked documentation in the original question guides to use an ARM template for preexisting and new resources, in both cases I think the template needs the tenant ID. Is the tenant id shown in the error same as what was used with these templates?

I believe it might be easier to prioritize your issue through a support case with the help of a support engineer to lookup what could be wrong with the bots and advise mitigation steps. Do you have a valid support subscription to raise a case? If not, we could help you with a free one time support case. Thanks!!

Your answer

romungi-MSFT 48,906 Reputation points Microsoft Employee Moderator

2021-12-06T14:06:43.167+00:00

@owenpww Usually when you login with azure cli the list of subscriptions that you have access to is shown based on the account chosen to login. With az logout and az login actions do you see this tenant id in the list? Try using --allow-no-subscriptions option along with az login to list subscriptions and tenants you have access to.

With Azure portal you have an option to switch and check if these services are created on a different directory, Do you have any options to switch and check?
owenpww 1 Reputation point

2021-12-06T17:42:25.523+00:00

@romungi-MSFT For both the Azure CLI (using az account list) and the Azure Portal, I only see two directories in my account. Neither of the 2 directory IDs match with the tenant ID that the error keeps showing me so I'm wondering where it's getting this information and how I can change it to the correct one/s. Whenever I sign in, it doesn't ask for any additional info and just tells me the tenant ID can't be found.

Something that might be useful is that after all these errors, caused by what I assume is deploying the SDK bot using Azure CLI, started happening, when I check the Azure AD > App Registrations, my two composer bots don't show up. Only the SDK bot shows up. Also when I go to Azure Portal and click on the Azure Bot resource for any of the two composer bots and go to Manage Certificates and Secrets, it tells me the apps can't be found. If I go to the Azure Portal and click on the Azure Bot resource for the SDK bot and go to Manage Certificate and Secrets, I can see the list of secrets just fine without error.

Could deploying the SDK bot on a multitenant option somehow have reconfigured my directory and therefore rendered my composer bots unregistered? Could it also have changed my machine's Azure/tenant settings, causing these new Azure login issues? Honestly, I think the answer to both of these are yes because the errors occurred immediately after deploying the SDK bot using Azure CLI. I'm just very unsure as to how and how to fix it.
romungi-MSFT 48,906 Reputation points Microsoft Employee Moderator

2021-12-07T11:04:40.613+00:00

@owenpww I am not sure what could have triggered the issue but deploying the bot through SDK or composer should not have altered your AAD settings. Composer bots are multi-tenant enabled as per my knowledge and newer bots with the SDK can use single tenant. I am just curious to check what was the tenant id that you used while creating the bot with the SDK? The linked documentation in the original question guides to use an ARM template for preexisting and new resources, in both cases I think the template needs the tenant ID. Is the tenant id shown in the error same as what was used with these templates?

I believe it might be easier to prioritize your issue through a support case with the help of a support engineer to lookup what could be wrong with the bots and advise mitigation steps. Do you have a valid support subscription to raise a case? If not, we could help you with a free one time support case. Thanks!!

Share via

Azure credentials wrong after deploying with Azure CLI

Your answer