Azure `aspire deploy` auth issue

[IEvangelist]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When attempting to call aspire deploy after having successfully authenticated (and logged in) with az login, deploy fails:

08:56:37 (pipeline execution) → Starting pipeline execution...
08:56:37 (build-prereq) → Starting build-prereq...
08:56:37 (deploy-prereq) → Starting deploy-prereq...
08:56:37 (build-prereq) ✓ build-prereq completed successfully
08:56:37 (deploy-prereq) i [INF] Initializing deployment for environment 'Production'
08:56:37 (deploy-prereq) i [INF] Setting default deploy tag 'aspire-deploy-20251110145637' for compute resource(s).
08:56:37 (deploy-prereq) ✓ deploy-prereq completed successfully
08:56:37 (validate-azure-login) → Starting validate-azure-login...
08:56:37 (build-frontend) → Starting build-frontend...
08:56:37 (build-frontend) i [INF] Building container image for resource frontend
08:56:37 (build-frontend) i [INF] Building image: frontend
08:56:39 (validate-azure-login) ✓ Azure CLI authentication validated successfully
08:56:39 (create-provisioning-context) → Starting create-provisioning-context...
08:56:39 (fetch-regions) → Starting fetch-regions...
08:56:39 (fetch-regions) → Fetching supported regions
08:56:41 (build-frontend) i [INF] docker buildx for frontend:3acce30c607ed85faf564378c9463c88d8aa3b88 succeeded.
08:56:41 (build-frontend) i [INF] Building image for frontend completed
08:56:41 (build-frontend) ✓ build-frontend completed successfully
08:56:41 (build-app) → Starting build-app...
08:56:41 (build-app) i [INF] Building container image for resource app
08:56:41 (build-app) i [INF] Building image: app
08:56:41 (fetch-regions) ✓ Fetching supported regions (2.8s)
08:56:41 (fetch-regions) ✓ Found 101 available region(s)
Select your Azure location and specify resource group:
Location:  Central US
Resource group: (rg-aspire-apphost): pinethon-rg
08:56:55 (build-app) i [INF] docker buildx for app:9aea03cc6ced1cd9e14138c52f019268739ef19f succeeded.
08:56:55 (build-app) i [INF] Building image for app completed
08:56:55 (build-app) ✓ build-app completed successfully
08:56:55 (create-provisioning-context) i [INF] Using DefaultAzureCredential for provisioning.
08:56:56 (create-provisioning-context) i [INF] Default subscription: TEST subscription (/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
08:56:56 (create-provisioning-context) i [INF] Tenant: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
08:56:56 (create-provisioning-context) i [INF] Creating resource group pinethon-rg in centralus...
08:56:57 (create-provisioning-context) i [INF] Resource group pinethon-rg created.
08:57:00 (create-provisioning-context) ✓ create-provisioning-context completed successfully
08:57:00 (provision-env) → Starting provision-env...
08:57:00 (provision-env) → Deploying env
09:00:21 (provision-env) ✓ Successfully provisioned env (200.2s)
09:00:21 (provision-env) ✓ provision-env completed successfully
09:00:21 (login-to-acr-env) → Starting login-to-acr-env...
09:00:21 (login-to-acr-env) → Logging in to envacrkolahqusw5xw6
09:00:23 (login-to-acr-env) ✗ Login to ACR envacrkolahqusw5xw6.azurecr.io failed: VisualStudioCredential authentication failed: Process "C:\Program Files\Microsoft Visual
Studio\18\Insiders\Common7\IDE\CommonExtensions\Microsoft\Asal\TokenService\Microsoft.Asal.TokenService.exe" has failed with unexpected error: TS003: Error, TS004: Unable to get
access token.  'Consent between first party application '04f0c124-f2bc-4f59-8241-bf6df9866bbd' and first party resource 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' must be configured
via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID:
ef05c680-46bc-4e19-834b-2ed75de40000 Correlation ID: becb77fa-a6ec-45a2-b990-b0f69f3d1d87 Timestamp: 2025-11-10 15:00:22Z
09:00:23 (login-to-acr-env) ✗ For potential mitigation and additional information go to the following url: 'https://aka.ms/vspreautherror''. (2.2s)
09:00:23 (login-to-acr-env) ✗ [ERR] Step 'login-to-acr-env' failed.
09:00:23 (login-to-acr-env) ✗ Step 'login-to-acr-env' failed: VisualStudioCredential authentication failed: Process "C:\Program Files\Microsoft Visual
Studio\18\Insiders\Common7\IDE\CommonExtensions\Microsoft\Asal\TokenService\Microsoft.Asal.TokenService.exe" has failed with unexpected error: TS003: Error, TS004: Unable to get
access token.  'Consent between first party application '04f0c124-f2bc-4f59-8241-bf6df9866bbd' and first party resource 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' must be configured
via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID:
ef05c680-46bc-4e19-834b-2ed75de40000 Correlation ID: becb77fa-a6ec-45a2-b990-b0f69f3d1d87 Timestamp: 2025-11-10 15:00:22Z
09:00:23 (login-to-acr-env) ✗ For potential mitigation and additional information go to the following url: 'https://aka.ms/vspreautherror''.
09:00:23 (pipeline execution) ✗ [ERR] Step 'login-to-acr-env' failed: VisualStudioCredential authentication failed: Process "C:\Program Files\Microsoft Visual
Studio\18\Insiders\Common7\IDE\CommonExtensions\Microsoft\Asal\TokenService\Microsoft.Asal.TokenService.exe" has failed with unexpected error: TS003: Error, TS004: Unable to get
access token.  'Consent between first party application 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' and first party resource 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' must be configured
via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID:
ef05c680-46bc-4e19-834b-2ed75de40000 Correlation ID: becb77fa-a6ec-45a2-b990-b0f69f3d1d87 Timestamp: 2025-11-10 15:00:22Z
09:00:23 (pipeline execution) ✗ For potential mitigation and additional information go to the following url: 'https://aka.ms/vspreautherror''.
09:00:23 (pipeline execution) ✗ Failed
------------------------------------------------------------
✓ 8/10 steps succeeded • ✗ 2 failed • Total time: 225.4s

Steps Summary:
  225.4 s  ✗ pipeline execution
  200.2 s  ✓ provision-env
  21.9 s  ✓ create-provisioning-context
  14.2 s  ✓ build-app
   3.2 s  ✓ build-frontend
   2.8 s  ✓ fetch-regions
   2.2 s  ✗ login-to-acr-env — Login to ACR envacrkolahqusw5xw6.azurecr.io failed: VisualStudioCredential authentication failed: Process "C:\Program Files\Microsoft Visual
Studio\18\Insiders\Common7\IDE\CommonExtensions\Microsoft\Asal\TokenService\Microsoft.Asal.TokenService.exe" has failed with unexpected error: TS003: Error, TS004: Unable to get
access token.  'Consent between first party application 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' and first party resource 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' must be configured
via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. Trace ID:
ef05c680-46bc-4e19-834b-2ed75de40000 Correlation ID: becb77fa-a6ec-45a2-b990-b0f69f3d1d87 Timestamp: 2025-11-10 15:00:22Z
For potential mitigation and additional information go to the following url: 'https://aka.ms/vspreautherror''.
   1.1 s  ✓ validate-azure-login
   0.0 s  ✓ deploy-prereq
   0.0 s  ✓ build-prereq

✗ PIPELINE FAILED
For more details, add --log-level debug/trace to the command.
------------------------------------------------------------

Expected Behavior

It should deploy.

Steps To Reproduce

1. aspire new aspire-py-starter -n aspire-app -o aspire-app
2. aspire add azure-appcontainer
3. Add builder.AddAzureContainerAppEnvironment("env"); to AppHost
4. az login
   • Have Visual Studio signed in as well.
5. aspire deploy

A workaround is to explicitly set the desired auth target:

[System.Environment]::SetEnvironmentVariable("AZURE_TOKEN_CREDENTIALS", "AzureCliCredential")

Exceptions (if any)

No response

.NET Version info

aspire --version
13.0.0-preview.1.25556.12+8ae616d1395d4e23e424673e2db0a0485bb53d95

Anything else?

No response

[captainsafia]

@davidfowl The case for just using az acr login to authenticate with ACR 😄

[davidfowl]

No it's a case for defauling to AzureCliCredential in publish mode 😄