Sign in interactively with az login on your own laptop, use a service principal for scripts, and use a managed identity for code running on Azure. Microsoft's documentation also says it started requiring multifactor authentication for user identities in Azure CLI from September 2025, so password based script logins need to move.
The four options
Microsoft lists four ways to authenticate the Azure CLI:
| Method | Best for | Notes |
|---|---|---|
| Azure Cloud Shell | Getting started | Logs you in automatically |
| Interactive sign in | Learning and local work | Browser based; picks a default subscription |
| Managed identity | Applications on Azure | Removes the need to manage secrets, credentials, certificates and keys |
| Service principal | Scripts and automation | Documented as the recommended approach for scripts |
The documentation also says to restrict sign in permissions for your use case, which means granting only what the task needs.
What gets stored on a laptop
When you sign in with a user account, the CLI generates and stores an authentication refresh token. Access tokens are short lived, and the refresh token is used to get new ones. A refresh token is a longer lived secret, so treat the machine and its profile directory accordingly. The command az account get-access-token prints a live access token, so avoid pasting that output into tickets or chats.
The MFA change
The docs state that starting September 2025 Microsoft requires MFA for Azure CLI and other command line tools, and that this applies to Microsoft Entra ID user identities but not to workload identities such as service principals and managed identities. If a pipeline or script logs in with a username and password, the documentation says to migrate it to a workload identity.
Decision guide
- Working by hand on your own machine: interactive login with MFA.
- A script on your laptop that you run often: still prefer interactive login, or a service principal scoped to one resource group.
- CI or scheduled jobs: a workload identity, with short lived credentials if your CI supports federation. See GitHub Actions OIDC for AWS without access keys for the same pattern on another cloud.
- Code running on Azure: a managed identity. See system assigned or user assigned managed identity.
Steps to tidy an existing setup
- Run
az account listandaz account showto see what is signed in. - Sign out of profiles you no longer use with
az logout. - Search scripts for
az logincalls with a username and password and plan their replacement. - Give each service principal the least role on the smallest scope.
- Rotate or remove any service principal secret older than your policy allows.
Safeguard's compliance and evidence automation can help you show how access is controlled, and a free dependency scan is at gold.safeguard.sh/scan.
Quick check
Does MFA apply to service principals?
Per Microsoft's documentation, no. The requirement covers user identities, not workload identities.
Is a refresh token as sensitive as a password?
Treat it that way. It can be exchanged for new access tokens until it expires or is revoked.
Sources
Last reviewed: 19 October 2026.
