MFA login error attempting az cli command after successful MFA login

Hey! That error message:

(RequestDisallowedByAzure) Resource … was disallowed by Azure: … creating, update or delete Azure resources without authenticating through MFA

isn’t really saying “you didn’t successfully do MFA at all.” It usually means Azure/your tenant’s Conditional Access policy is requiring an MFA “claims” context for resource management operations, and the token you used for the CLI call doesn’t satisfy that requirement.

Below are the most relevant things to check and the common fixes.

1) Confirm MFA is actually enforced for your user (Conditional Access / Security defaults)

Per the MFA troubleshooting guidance, Entra ID MFA prompting can depend on how it’s enforced:

• Check whether the tenant has Security defaults enabled (MFA is prompted only in certain scenarios, not always).
• If you have Conditional Access, verify there is a policy with “Multifactor authentication” grant control that applies to the user.
• Also check if the user is excluded from the relevant Conditional Access policy.
• If you have per-user MFA or managed policies, make sure the user isn’t excluded.

If the policy requires MFA for “create/update/delete resources” (which can include your az containerapp update), then an interactive login that doesn’t include the required MFA claim may still fail the management call.

2) Use the interactive claims-challenge flow in Azure CLI

The Azure CLI MFA troubleshooting guidance specifically calls out cases where you can log in interactively, but later resource operations are blocked by policy until the CLI login is performed with the correct interactive MFA challenge.

Try this approach:

1. Sign out
2. Re-authenticate with MFA claims-challenge

The doc provides this pattern:

az logout

az login --tenant "<TENANT_ID>" \

  --scope "https://management.core.windows.net//.default" \

  --claims-challenge "<claims-challenge-token>"

Note: The "<claims-challenge-token>" value is generated by the environment/policy flow—your tenant admin may need to help obtain it, or you may be able to capture it from the error details. The key point is: you need an Azure CLI auth session that satisfies the Conditional Access MFA requirement for management-plane calls.

3) Check for “stale” / method registration edge cases

Even when MFA is configured, prompting/verification can fail due to stale authentication methods. The MFA guide suggests:

• Review the user’s registered authentication methods (for example, ensure the methods the user uses are actually present and valid).
• If needed, force re-registration of MFA methods in the Entra admin portal (so the next sign-in redoes registration).

4) If your tenant admin can enforce MFA at sign-in, that’s often the cleanest fix

The CLI troubleshooting doc lists a resolution option:

• Ask your Azure admin to enforce MFA at sign-in so the session meets Conditional Access requirements without extra steps.

Follow-up questions (so we can pinpoint the exact cause)

1. In Entra ID, do you use Conditional Access to require MFA for “Azure management” / “create/update/delete” scenarios? If yes, what is the policy name (or the scope conditions) that matches this user?
2. When you run az login and then the failing az containerapp update, does the CLI error include any policy resource IDs or details about the policy?
3. What Azure CLI version are you using on the machine where the failure happens?
4. Are you running this from a normal terminal, or from a constrained environment (for example, automation, Cloud Shell, WSL, CI/CD)? (This can affect how tokens are cached.)
5. Does az group list succeed in the same session where az containerapp update fails—i.e., is it only management updates that fail?

Reference list (all relevant documentation provided)

• Troubleshooting Azure CLI (including MFA-required-by-Conditional-Access and --claims-challenge guidance): https://learn.microsoft.com/cli/azure/use-azure-cli-successfully-troubleshooting?view=azure-cli-latest&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#troubleshooting-multifactor-authentication-mfa
• Impact of multifactor authentication on Azure CLI in automation scenarios (ROPС/MFA incompatibilities): https://learn.microsoft.com/cli/azure/authenticate-azure-cli-mfa?view=azure-cli-latest&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#troubleshooting
• Troubleshooting the Az PowerShell module (similar “Resource was disallowed by policy / ClaimsChallenge” pattern): https://learn.microsoft.com/powershell/azure/troubleshooting?view=azps-16.0.0&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#troubleshooting-multifactor-authentication-mfa

Hope this helps—if you share the missing claims-challenge context (or any policy details included in the error), we can narrow it down to the exact Conditional Access requirement that’s blocking the az containerapp update call.

Note: This content was drafted with the help of an AI system.

1. We don't use Conditional Access.
2. It does not contain any other details or policy IDs.
3. 2.87.0
4. Normal terminal.
5. Succeeds in same session.

My previous reply to your response had more detail, but was deleted.

Hello @robertmglynn

Could you ask your tenant administrator to verify the following:

1. Whether MFA enforcement for Azure resource management has been enabled at the tenant level.
2. Whether there are any tenant-wide security settings or policies requiring MFA for create/update/delete operations.
3. Whether the affected account's sign-in logs show a failed authorization event or claims challenge at the time the az containerapp update command is executed.

Additionally, please capture the output of:

az account show
az containerapp update --debug

az account show results in:

{
  "environmentName": "AzureCloud",
  "homeTenantId": "ID-starting-with-4",
  "id": "ID-starting-with-b",   
  "isDefault": true,   
  "managedByTenants": [],   
  "name": "Pay-As-You-Go",   
  "state": "Enabled",   
  "tenantDefaultDomain": "ourdefaultdomain.onmicrosoft.com",   
  "tenantDisplayName": "Default Directory",   
  "tenantId": "same-ID-starting-with-4",   
  "user": {     
        "name": "******@domain.tld",     
        "type": "user"   
  } 
} 

az containerapp update --debug gives me:

cli.azure.cli.core.azclierror: (--name --resource-group | --ids) are requiredaz_command_data_logger: (--name --resource-group | --ids) are required

adding --debug onto my previous az containerapp update command with all the parameters results in tons of text, all of which seems normal, but results in the same error message as I started with, no additional details related to the error. I'm not sure you want me to post the entire text, it's a lot.

I will definitely ask my tenant administrator about what you've listed, but unfortunately they are not available until Monday.