Repository navigation
[Bug] Misleading/Incompolete domain Bug #973
Description
Misleading/Incompolete domain Bug
A typo returned by the login server while logging into azure using az cli. The CLI instructed me to use use-device-code to avoid getting login failure I was having, and the URL it provided was not not working. I had to guess to get the right domain to use in my browser: login.microsoftonline.com rather worked
To Reproduce
Steps to reproduce the behavior:
log into Azure CLi using:
az login --use-device-code
# Output looked like this:
To sign in, use a web browser to open the page https://login.microsoft.com/device and enter the code ....Expected behavior
I expected the URL provided by the CLI to work flawlessly and quick, which couldn't happen
What you see instead
The MSAL Python version
python -c "import msal; print(msal.__version__)"
% az version
{
"azure-cli": "2.90.0",
"azure-cli-core": "2.90.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {}
}
Additional context
After thorough huntinh, I found out that the device code message URL (https://login.microsoft.com/device) is not generated by Azure cli or msal python. It's returned directly by the Microsoft server as the verification_uri field in the device authorization response json. Both Azure CLI and msal just print it as-is (flow["message"])
Activity
basitalisandhu commentedon Oct 20, 2026
Two things, one of them important:
The domain in your report is not Microsoft's.
login.mircosoftonline.com(the "r" and "c" swapped) is a parked look-alike domain:mircosoftonline.comis registered through Dynadot, uses the above.com parking name servers and resolves to103.224.182.251, not to Microsoft's sign-in IPs. If that was only a typo while writing the issue, ignore this. If you really opened that address and typed a code, password or MFA answer there, please treat that account as exposed: change the password and revoke its sessions (Revoke-MgUserSignInSessionor the "Revoke sessions" button on the user in the Entra admin center).The URL the CLI printed is correct. You are right that MSAL does not build it:
initiate_device_flowposts to the device authorization endpoint and returns the JSON as is (oauth2cli/oauth2.py#L362-L391), andazprintsflow["message"]. I checked it just now:https://login.microsoft.com/deviceanswers302tohttps://login.microsoftonline.com/common/oauth2/deviceauth, the real device code page.login.microsoft.comresolves to different addresses (20.190.x) thanlogin.microsoftonline.com(40.126.x), so a proxy, firewall or DNS filter that only allowslogin.microsoftonline.comwould explain the page not loading for you. Openinghttps://login.microsoftonline.com/common/oauth2/deviceauthorhttps://microsoft.com/devicelogindirectly gets you to the same page.So there is nothing to fix in MSAL for the URL itself.
its-ernest commentedon Oct 21, 2026
Thanks for point out my spelling mistake, I didn't realize I had written a wrong word for microsoft:
mircosoft. Spelling is no typed correctly.But the issue is indeed verified to be a true issue with the server response
basitalisandhu commentedon Oct 26, 2026
Agreed on where it comes from:
https://login.microsoft.com/deviceis theverification_urithe Microsoft identity platform returns from the device authorization endpoint, and MSAL andazonly print it. That also means it cannot be fixed in this repository; MSAL has no say in what the server sends.What decides whether it works for you is whether your network lets
login.microsoft.comthrough. It is a separate host name fromlogin.microsoftonline.comwith different addresses, so a proxy or DNS allow-list that only nameslogin.microsoftonline.comblocks the first and allows the second, which matches what you saw. A quick check from the same machine:If the first one fails and the second answers, add
login.microsoft.comto the allow-list (it is in Microsoft's published endpoint list for Entra ID), or keep usinghttps://microsoft.com/devicelogin. If you would like the CLI to print a fallback address next to the server's one, that request belongs in Azure/azure-cli, since it is the CLI that printsflow["message"].