Azure Pipelines · Azure CLI · Checked November 7, 2026

Azure Pipelines: "Please run 'az login' to setup account"

On a pipeline agent nobody has run az login. The Azure CLI is signed in only inside the Azure CLI task (AzureCLI@2), which signs in with an Azure Resource Manager service connection before your script and signs out after it. Any az command outside that task finds no account and stops with this message. The Azure DevOps commands (az devops, az repos, az pipelines, az boards) are different again: they take a token from AZURE_DEVOPS_EXT_PAT.

If the step creates, votes on or completes pull requests with az repos pr, the same pull requests can wait for you in the IDE: Azure DevOps Pull Requests, a plugin for JetBrains IDEs, lists the pull requests that wait for your review in IntelliJ IDEA, PyCharm or Rider, and on Azure DevOps Services it can use your own Azure CLI sign-in instead of a token. Get it on JetBrains Marketplace

What it looks like

ERROR: Please run 'az login' to setup account. from a command such as az account show, az group list or az webapp deploy. The Azure CLI raises it when it has no saved account at all.
From the Azure DevOps commands, the extension's own message instead: Before you can run Azure DevOps commands, you need to run the login command(az login if using AAD/MSA identity else az devops login if using PAT token) to setup credentials. It means there was neither a usable Azure CLI sign-in nor a token.

Where az has no sign-in

A plain script step (bash, pwsh, script, Bash@3, PowerShell@2). Microsoft-hosted agents have the Azure CLI installed, but not signed in.
A step after the Azure CLI task. In the task's source (version 2.283), it runs az account clear when the script ends, and by default it keeps its sign-in in a new configuration folder under the agent's temp directory for that one run, then removes it. The sign-in does not carry over to the next step, even with useGlobalConfig: true.
An Azure PowerShell task (AzurePowerShell@5). It signs in the Az PowerShell modules, not the Azure CLI, so az inside it has no account.
A self-hosted agent where someone ran az login by hand. The Azure CLI keeps its sign-in in the .azure folder of the account that runs it (or in AZURE_CONFIG_DIR). The agent service usually runs as a different account, so it does not see that sign-in.

Azure commands: run them inside the Azure CLI task

Move the commands into AzureCLI@2 with an Azure Resource Manager service connection. Several steps that need Azure each get their own Azure CLI task.
When the script outlives the sign-in on a workload identity federation connection, keepAzSessionActive: true (marked experimental) keeps refreshing it. The task's source added it to avoid AADSTS700024 errors.
Avoid a hand-written az login with a secret in the script: the service connection already holds the credentials, and with workload identity federation there is no secret to store.

- task: AzureCLI@2
  inputs:
    azureSubscription: 'my-arm-connection'
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      az account show
      az webapp deploy --resource-group rg-demo --name app-demo --src-path app.zip

Azure DevOps commands: AZURE_DEVOPS_EXT_PAT

Microsoft's page on the Azure DevOps CLI in YAML passes the pipeline's own token, $(System.AccessToken), as the environment variable AZURE_DEVOPS_EXT_PAT on each step that needs it. Secret variables such as this token are not in a script's environment unless you map them.
The Windows and Linux hosted agents have the azure-devops extension; macOS has the Azure CLI without it, so add az extension add -n azure-devops there.
The token acts as the pipeline's build service identity. If that identity lacks a permission, the command fails with a permission error, not with this message (TF401027 for pushes, for example).
Inside AzureCLI@2, the extension's source tries the Azure CLI sign-in first, which there is the service principal of the Azure connection. Azure DevOps accepts it only when that service principal has been added to the organization; with AZURE_DEVOPS_EXT_PAT also set, the extension checks the sign-in against the organization and falls back to the token when it does not work.
Microsoft now also describes AzureCLI@3 with connectionType: azureDevOps, which signs in with an Azure DevOps service connection that uses workload identity federation. Its pages say the feature is still rolling out to Azure DevOps Services.

- bash: |
    az repos pr list --organization '$(System.TeamFoundationCollectionUri)' --project '$(System.TeamProject)' --status active
  env:
    AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)

Azure DevOps pull requests in IntelliJ IDEA, PyCharm and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, reads the organization, project and repository from your git remote and lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. It signs in with a personal access token, or on Azure DevOps Services with your Azure CLI sign-in (az login), for organizations that restrict tokens. The review inbox is free; voting, commenting, completing and creating are Pro, with a 30-day trial. For the same tasks from a terminal, see az repos pr and the Azure CLI.

Get it on JetBrains Marketplace

Azure, Azure DevOps and Azure Pipelines are trademarks of Microsoft Corporation; IntelliJ IDEA, PyCharm and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: AADSTS7000215 and AADSTS7000222: the service connection secret · az repos pr and the Azure CLI · TF401027: GenericContribute permission · This pipeline needs permission to access a resource · 日本語