Describe the bug
On POSIX systems, AzureCliCredential launches /bin/sh with a custom child environment containing only PATH:
https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/src/azure_cli_credential.cpp#L630-L648
This drops Azure CLI environment settings such as HOME, XDG_CACHE_HOME, and AZURE_CONFIG_DIR.
With Azure CLI 2.86.0 and py-deviceid 0.1.1, a token request still succeeds because Python can resolve the account's home directory through the user database. However, Azure CLI telemetry reads HOME directly. With HOME absent, it creates a relative device-ID path under the caller's current working directory:
./None/.cache/Microsoft/DeveloperTools/deviceid
The file contains only a random device identifier, not an access token, but a credential call should not pollute an application's working directory. Dropping AZURE_CONFIG_DIR can also make a login stored in a non-default Azure CLI config directory unavailable to the credential.
Exception or Stack Trace
No exception is raised. Token acquisition succeeds and the filesystem side effect is silent.
To Reproduce
- Sign in with Azure CLI.
- Run a storage token request with the same PATH-only environment used by the SDK:
sandbox=$(mktemp -d)
cd "$sandbox"
env -i PATH="$PATH:/usr/bin:/usr/local/bin" \
az account get-access-token \
--output json \
--scope https://storage.azure.com/.default >/dev/null
find "$sandbox" -type f -print
- Observe:
<temporary-directory>/None/.cache/Microsoft/DeveloperTools/deviceid
Code Snippet
The same behavior is reached through the SDK:
Azure::Identity::AzureCliCredential credential;
Azure::Core::Credentials::TokenRequestContext request;
request.Scopes = {"https://storage.azure.com/.default"};
auto token = credential.GetToken(request, {});Expected behavior
The POSIX child environment should retain the allowlisted variables Azure CLI needs to locate its existing user configuration and cache, at minimum:
HOMEXDG_CACHE_HOME, when definedAZURE_CONFIG_DIR, when defined
AzureCliCredential should continue to avoid inheriting the entire parent environment.
Setup (please complete the following information):
- OS: Ubuntu 22.04
- IDE: not applicable
- Azure SDK for C++: commit
1c32f92de06445c467715b55860083202194aee4; behavior also present on main as of 2026-08-12
- Azure CLI: 2.86.0
- Azure CLI Core: 2.86.0
py-deviceid: 0.1.1
Additional context
The Windows implementation already allowlists USERPROFILE so Azure CLI can locate the signed-in user's state. The POSIX implementation currently allowlists only PATH.
I can submit a focused PR that propagates the three POSIX variables above and adds an AzureCliCredential unit test using the existing synthetic-command test seam.
Information Checklist
Describe the bug
On POSIX systems,
AzureCliCredentiallaunches/bin/shwith a custom child environment containing onlyPATH:https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/src/azure_cli_credential.cpp#L630-L648
This drops Azure CLI environment settings such as
HOME,XDG_CACHE_HOME, andAZURE_CONFIG_DIR.With Azure CLI 2.86.0 and
py-deviceid0.1.1, a token request still succeeds because Python can resolve the account's home directory through the user database. However, Azure CLI telemetry readsHOMEdirectly. WithHOMEabsent, it creates a relative device-ID path under the caller's current working directory:The file contains only a random device identifier, not an access token, but a credential call should not pollute an application's working directory. Dropping
AZURE_CONFIG_DIRcan also make a login stored in a non-default Azure CLI config directory unavailable to the credential.Exception or Stack Trace
No exception is raised. Token acquisition succeeds and the filesystem side effect is silent.
To Reproduce
Code Snippet
The same behavior is reached through the SDK:
Azure::Identity::AzureCliCredential credential; Azure::Core::Credentials::TokenRequestContext request; request.Scopes = {"https://storage.azure.com/.default"}; auto token = credential.GetToken(request, {});Expected behavior
The POSIX child environment should retain the allowlisted variables Azure CLI needs to locate its existing user configuration and cache, at minimum:
HOMEXDG_CACHE_HOME, when definedAZURE_CONFIG_DIR, when definedAzureCliCredentialshould continue to avoid inheriting the entire parent environment.Setup (please complete the following information):
1c32f92de06445c467715b55860083202194aee4; behavior also present onmainas of 2026-08-12py-deviceid: 0.1.1Additional context
The Windows implementation already allowlists
USERPROFILEso Azure CLI can locate the signed-in user's state. The POSIX implementation currently allowlists onlyPATH.I can submit a focused PR that propagates the three POSIX variables above and adds an
AzureCliCredentialunit test using the existing synthetic-command test seam.Information Checklist