Azure CLI 'AADSTS' errors after tenant MFA or Conditional Access changes (AADSTS50076, AADSTS50079, AADSTS53003, AADSTS700082, 'Interactive authentication is needed', 'Authentication failed against tenant') - what do I do with az login --tenant?

Cause: The sign-in succeeded in part but the Microsoft Entra tenant now requires something the CLI did not provide. Meanings from Microsoft's error reference: AADSTS50076 and AADSTS50079 mean a configuration change (such as a Conditional Access policy or per-user enforcement) or a new location now requires multifactor authentication, and the user must complete or register MFA. AADSTS53003 means a Conditional Access policy blocked token issuance. AADSTS700082 means the refresh token expired from inactivity, and AADSTS70043 means it expired due to a sign-in frequency policy; both are normal token lifecycle events. Separately, Microsoft requires MFA for Azure CLI and other command-line tools for user identities (this began in September 2025), which does not apply to service principals or managed identities. If one user belongs to several tenants, the CLI loops through them and can report 'Authentication failed against tenant'. Fix: 1. Sign in again interactively against the right tenant: az login --tenant TENANT_ID_OR_DOMAIN (a .onmicrosoft.com domain or the tenant ID). On recent CLI versions with the subscription selector, you may first need az config set core.login_experience_v2=off. Re-enable later with az config set core.login_experience_v2=on. 2. Complete the MFA prompt in the browser. If no browser is available, use az login --use-device-code. If prompted to register MFA, complete registration first. 3. Clear stale state if needed: az account clear, then az login. 4. For AADSTS53003, review which Conditional Access policy applied (the sign-in logs show it) or ask your tenant administrator; do not try to bypass it. Compliant device or location requirements may mean you need to sign in from a managed device. 5. For scripts and CI that used az login with a username and password: this no longer works with MFA ('Interactive authentication is needed'). Migrate to a workload identity: a service principal (preferably with federated credentials) or a managed identity. 6. Pick the subscription afterwards: az account set --subscription SUBSCRIPTION_ID. Verify: az account show prints the expected tenant and subscription, and az account get-access-token returns without an AADSTS error (do not paste the token anywhere). Sources: https://learn.microsoft.com/en-us/cli/azure/authenticate-azure-cli-interactively https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes