Login error

[JoeKenney]

Describe the bug

I'm trying to use EV2 in the fairfax environment. I get the error below when I try to login.

Related command

.\ev2.exe service get -s af276c13-ac25-4bc9-b4c5-79aca07df24a --rolloutinfra fairfax --forceprompt

Errors

Authentication failed
invalid_request: AADSTS65002: Consent between first party application '04b07795-8ddb-461a-bbee-02f9e1bf7b46' and first party resource '5b306cba-9c71-49db-96c3-d17ca2379c4d' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID: a62b8e99-eb05-4a6b-80c5-3200f8390a00 Correlation ID: 42afffa9-21b2-4aa7-8bf3-5f090b89efbf Timestamp: 2026-07-16 19:59:42Z. (https://login.microsoftonline.us/error?code=65002)

You can log an issue at Azure CLI GitHub Repository and we will assist you in resolving it.

Issue script & Debug output

az login --scope https://azureservicedeploy.usgovcloudapi.net/user_impersonation

Expected behavior

Login

Environment Summary

aa

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[azure-client-tools-agent]

Hi @JoeKenney, thanks for the report. Before we can investigate, could you please share the following?

• Output of az --version (so we know the exact CLI/core/msal version involved)
• The exact az login command and any preceding az cloud set command you used to target Azure Government (Fairfax)
• Whether az login --scope https://azureservicedeploy.usgovcloudapi.net/user_impersonation fails on its own (without EV2), i.e. a minimal repro that doesn't depend on ev2.exe
• A filled-in "Environment Summary" section (OS, shell, install method)

Note: the AADSTS65002 error indicates the first-party application 04b07795-8ddb-461a-bbee-02f9e1bf7b46 lacks pre-authorization/consent for the resource 5b306cba-9c71-49db-96c3-d17ca2379c4d in your tenant/cloud - this is typically an Azure AD app consent/configuration issue rather than an azure-cli code defect, so the extra details above will help confirm whether there's something we can fix in the CLI.

I'll pick this up automatically once you reply.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[JoeKenney]

AZ version:

PS C:\source\quickstart\Ev2_CLI\windows> az version
{
"azure-cli": "2.70.0",
"azure-cli-core": "2.70.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"datafactory": "1.0.3",
"fleet": "1.5.2",
"nsp": "1.0.0b3",
"providerhub": "1.0.0b1"
}
}

AZ Cloud setting:

az cloud set --name AzureUSGovernment

[JoeKenney]

This is an authorization issue between an ev2 resource and application. I've filed a ticket with that team. Thanks for the investigation!