az acs create fails with service principal error

Repro steps:

• Delete ~/.azure/acsServicePrincipal.json
• Try to create a cluster

az group create -n test1 -l eastus
az acs create -n acs-test -g test1 -t Kubernetes

Results:

• Service principal is created
  • CLI spins and waits for service principal propagation before proceeding
  • acsServicePrincipal.json is created with the generated SP info
• Command fails, and nothing is created in the resource group
  • If you run az acs create a second time, the deployment succeeds, using the SP from the JSON file

Deployment failed. Correlation ID: c1cb9379-4dbf-4ac9-ab14-ff4ced046fa6. {
  "error": {
    "code": "BadRequest",
    "message": "The credentials in ServicePrincipalProfile were invalid. Please see https://aka.ms/acs-sp-help for more details. (Details: AADSTS70001: Application with identifier 'e451ac5a-b4da-4393-9315-d3dce6166a46' was not found in the directory 72f988bf-86f1-41af-91ab-2d7cd011db47\r\nTrace ID: 87322fd2-8fc4-412c-b708-429cab160900\r\nCorrelation ID: faf7eee4-322d-4198-b04d-5e41cf8d3b60\r\nTimestamp: 2018-01-03 22:04:29Z)"
  }
}

---

Environment summary

apt-get / 2.0.23 / Windows 10 Enterprise 1709 (16299.125) + Ubuntu 16.04.3 LTS / Bash on Windows

azure-cli (2.0.23)

acr (2.0.17) acs (2.0.22) advisor (0.1.0) appservice (0.1.22) backup (1.0.3) batch (3.1.7) batchai (0.1.3) billing (0.1.6) cdn (0.0.10) cloud (2.0.10) cognitiveservices (0.1.9) command-modules-nspkg (2.0.1) configure (2.0.12) consumption (0.2.0) container (0.1.15) core (2.0.23) cosmosdb (0.1.15) dla (0.0.15) dls (0.0.18) eventgrid (0.1.5) extension (0.0.6) feedback (2.0.6) find (0.2.7) interactive (0.3.11) iot (0.1.15) keyvault (2.0.15) lab (0.0.13) monitor (0.0.13) network (2.0.19) nspkg (3.0.1) profile (2.0.16) rdbms (0.0.9) redis (0.2.10) reservations (0.1.0) resource (2.0.19) role (2.0.15) servicefabric (0.0.7) sql (2.0.17) storage (2.0.21) vm (2.0.20)

Python location ‘/opt/az/bin/python3’ Extensions directory ‘/home/noel/.azure/cliextensions’

Python (Linux) 3.6.1 (default, Dec 15 2017, 17:51:12) [GCC 4.8.4]

[anastasia-lebedeva]

Hi!

Same problem here. Command

$az aks create \                                         
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --node-vm-size Standard_NC6 \
    --node-count 1 --generate-ssh-keys

outputs:

> Finished service principal creation[##################################] 100.0000%Operation failed with status: 'Bad Request'. Details: The credentials in ServicePrincipalProfile were invalid. Please see https://aka.ms/aks-sp-help for more details. (Details: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier 'db3eceed-57c4-4e86-b898-e051d711c761' was not found in the directory '585127aa-8691-4f25-9777-8cb78ccf0d91'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: 81418b4c-ca53-4c3f-beaf-d63ab40fa600\r\nCorrelation ID: 64233089-88b9-4f45-9f31-75ea8adf06a5\r\nTimestamp: 2020-05-12 16:21:41Z","error_codes":[700016],"timestamp":"2020-05-12 16:21:41Z","trace_id":"81418b4c-ca53-4c3f-beaf-d63ab40fa600","correlation_id":"64233089-88b9-4f45-9f31-75ea8adf06a5","error_uri":"https://login.microsoftonline.com/error?code=700016"})

$ az --version
azure-cli                          2.5.1

command-modules-nspkg              2.0.3
core                               2.5.1
nspkg                              3.0.4
telemetry                          1.0.4

Python location '/usr/local/Cellar/azure-cli/2.5.1/libexec/bin/python'
Extensions directory '/Users/lebedana/.azure/cliextensions'

Python (Darwin) 3.8.2 (default, Mar 11 2020, 00:29:50) 
[Clang 11.0.0 (clang-1100.0.33.17)]

[ppanyukov]

Can we re-open this please, because it’s clearly not fixed. Fails for me too with 2.2.0 version. Same issue: propagation completes, then cluster create fails straight away. The same happens if I reset password for an existing SP and try to create AKS.

AAD role propagation done[############################################]  100.0000%
Operation failed with status: 'Bad Request'. Details: The credentials in ServicePrincipalProfile were invalid. 
Please see https://aka.ms/aks-sp-help for more details. 
(Details: adal: Refresh request failed. Status Code = '400'. Response body: 
{
    "error": "unauthorized_client",
    "error_description": "AADSTS700016: Application with identifier 'REDACTED' was not found in the directory 'REDACTED'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: REDACTED\r\nCorrelation ID: REDACTED\r\nTimestamp: 2020-03-31 17:38:47Z",
    "error_codes": [
        700016
    ],
    "timestamp": "2020-03-31 17:38:47Z",
    "trace_id": "REDACTED",
    "correlation_id": "REDACTED",
    "error_uri": "https://login.microsoftonline.com/error?code=700016"
})

$ az --version
azure-cli                          2.2.0 *

command-modules-nspkg              2.0.3
core                               2.2.0 *
nspkg                              3.0.4
telemetry                          1.0.4

Python location '/usr/local/Cellar/azure-cli/2.2.0_1/libexec/bin/python'
Extensions directory '/Users/philippanyukov/.azure/cliextensions'

Python (Darwin) 3.8.2 (default, Mar 11 2020, 00:29:50)
[Clang 11.0.0 (clang-1100.0.33.17)]