I am unable to login via Azure CLI

[lipsachhotray014]

Describe the bug

In Windows Azure SDK environment, I have typed "az login", command

That is asking me to select a tenant and then after selecting the default tenant the login is failing.

Related command

az login

Errors

Authentication failed against tenant 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin': SubError: message_only V2Error: invalid_grant AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. Trace ID: 5f11e3a3-90c5-4465-a60f-4ea7f8bb3a00 Correlation ID: dfd11e0b-beac-486c-8f5b-4051560eb531 Timestamp: 2025-12-15 15:16:48Z. Status: Response_Status.Status_InteractionRequired, Error code: 3399614476, Tag: 557973645
If you need to access subscriptions in the following tenants, please use az login --tenant TENANT_ID.
1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin'

Issue script & Debug output

Select a subscription and tenant (Type a number or Enter for no changes): az login --debug
Invalid selection.
Select a subscription and tenant (Type a number or Enter for no changes):

Tenant: Microsoft
Subscription: Service 360 Test (8cff5c8a-98f3-44ad-b300-2d44716c802c)

[Announcements]
With the new Azure CLI login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271236

If you encounter any problem, please open an issue at https://aka.ms/azclibug

[Warning] The login output has been updated. Please be aware that it no longer displays the full list of available subscriptions by default.

Expected behavior

I should be able to login

Environment Summary

C:\Program Files\Microsoft SDKs\Azure.NET SDK\v2.9>

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[jiasli]

The error message is clear. Azure CLI cannot get an access token for 1a092f68-5741-455a-8057-2acdb897a850 'HMGAdmin' tenant with silent authentication.

You need to directly log into 1a092f68-5741-455a-8057-2acdb897a850:

az login --tenant 1a092f68-5741-455a-8057-2acdb897a850