[Profile] az login: Add --redirect-port for browser authentication

[rta-kklints]

Related command

az login

Fixes #21934
Fixes #26556

Description

Add az login --redirect-port PORT to select the local callback port used by interactive browser authentication. This lets users configure SSH port forwarding before starting a browser login on a remote machine.

When --redirect-port is specified, az login:

• validates that the port is between 1 and 65535;
• forces interactive browser authentication instead of automatically falling back to device code on headless systems or GitHub Codespaces;
• disables WAM for that invocation so MSAL uses the requested callback port;
• rejects authentication modes that do not use the interactive browser callback; and
• returns an actionable CLI error if the requested port cannot be bound.

Default login behavior is unchanged when the option is omitted. Because browser launch failure is not reliably reported by all Python webbrowser backends, remote users can set BROWSER=echo to print the authorization URL.

Testing Guide

From the machine running the browser, preconfigure forwarding to the remote machine:

ssh -L 40080:localhost:40080 user@remote-host

On the remote machine, print the authorization URL and start login on that fixed callback port:

BROWSER=echo az login --redirect-port 40080

Open the printed URL in the local browser. After authentication, the callback is forwarded to Azure CLI on the remote machine and login completes.

To verify unavailable-port handling, occupy the port before login. The command exits with Redirect port 40080 is unavailable and recommends freeing it or selecting another port.

Automated validation:

• azdev style profile azure-cli-core
• azdev test profile core (400 passed, 23 skipped, 4 subtests passed)
• azdev linter --ci-exclusions --min-severity medium
• azdev latest-index verify
• azdev scan

History Notes

Generated from the PR title.

---

• The PR title and description has followed the guideline in Submitting Pull Requests.
• I adhere to the Command Guidelines.
• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution rta-kklints! We will review the pull request and get back to you soon.

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds az login --redirect-port for fixed-port browser authentication, including validation, WAM/fallback control, bind-error handling, documentation, and tests.

Changes:

• Adds the CLI argument and authentication-mode validation.
• Propagates the port through Profile, Identity, and MSAL.
• Adds documentation and unit tests.

File summaries

File	Description
src/azure-cli/azure/cli/command_modules/profile/tests/latest/test_profile_custom.py	Updated as part of this pull request.
src/azure-cli/azure/cli/command_modules/profile/custom.py	Updated as part of this pull request.
src/azure-cli/azure/cli/command_modules/profile/_help.py	Updated as part of this pull request.
src/azure-cli/azure/cli/command_modules/profile/init.py	Updated as part of this pull request.
src/azure-cli-core/azure/cli/core/tests/test_profile.py	Updated as part of this pull request.
src/azure-cli-core/azure/cli/core/auth/tests/test_identity.py	Updated as part of this pull request.
src/azure-cli-core/azure/cli/core/auth/identity.py	Updated as part of this pull request.
src/azure-cli-core/azure/cli/core/_profile.py	Updated as part of this pull request.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rta-kklints]

@microsoft-github-policy-service agree

[Yong Zhang (yonzhan)]

az login