Azurestorageexplorer: Azure Storage Explorer is unusable due to AAD guest accounts (improve multi tenant sign in experience)

[ziesemer]

Storage Explorer Version: Using the latest 1.12.0.
Build Number: 20200116.10
Platform/OS: Windows 10
Architecture: x64
Regression From: Unknown

Same results on multiple machines, with or without using the Microsoft Authentication Library (MSAL Preview).

Bug Description

Guest membership in other AAD tenants can make it impossible (or at least nearly so) to use Azure Storage Explorer.

Steps to Reproduce

1. From the "Account Management" screen, click "Add an account...".
2. Choose to "Add an Azure Account" from the "Azure" Azure environment.
3. Login once as my AAD login, including MFA.
4. Be continuously prompted a 10+ times for logins into additional AAD tenants where I've been added as a guest account, due to having their own MFA requirements set, Conditional Access Policies, etc. It is not even clear what tenant I'm being prompted for (no tenant name or ID shown), unless indicated by custom tenant branding (background picture, etc.). Many of these tenants do not even have Azure subscriptions. Some logins may produce failures, due to the guest account being blocked or considered "at risk", etc.

This is the using same Microsoft Partner account that I've been using daily and elsewhere (Azure Portal, Azure CLI, PowerShell, etc.) for over 2 years without similar issues elsewhere, even with the contributing factors listed above (account is blocked in one or more directories). These issues are specific to using Azure Storage Explorer.

Expected Experience

Azure Storage Explorer needs to provide an option to select which tenant(s) to attempt to login to. Even if only as a supported configuration file.

Actual Experience

Any failure on any login to any tenant results in either the account failing to be added, or the error flow where "subscriptions for one or more tenants could not be retrieved" - in which case the filter checkboxes underneath the account are not even displayed. Instead, only a "Reenter credentials" link is displayed, below "Subscriptions could not be loaded. Please try reentering credentials or removing and readding the account."

Furthermore, the "Explorer" view get stuck in a state where it does list one or more subscriptions, though not even the ones I need. A "Load more" link is available - but when clicked, I get 2 pop-up error dialogs:

• Unable to retrieve child resources.
• The requested action could not be completed.

... both with "Details: [{}]".

Additional Context

Prior research / related tickets:

• #159
  
  
  
  • Note Jouni's comment specifically about this practically being a denial-of-service issue.
  
  
• #153
  
  
  
  • Not the most critically related to this, but the "use the account panel to filter out the subscriptions you aren't working with" proposed there is part of what disappears with the issues mentioned above.
  
  
• #74
• #2570

[MRayermannMSFT]

Hey @ziesemer , we are aware of the uptick in users who are guests in large numbers of tenants, each of which has their own variety of conditional access policies (including MFA). We have plans in the future for providing the experience you suggest, specifically being able to filter out tenants, and making it more clear which ones require MFA and letting you perform that MFA at a time of your choosing.

Unfortunately the auth libraries haven't quite caught up to this need, so for now providing such an experience is not possible for us. Once it is available we'll get that work done. Thanks for the patience!

[benederke]

Same issue here, please fix this 👍

[MikeYeager]

I've been involved with this issue for a while. I have multiple accounts with multiple tenants each and MFA on several of them. I would love to see this feature. One thing that helps me is going into Settings --> Sign-In and enabling Microsoft Authentication Library (Preview). I did have to log in to each account/tenant again, but it does a MUCH better job of not making me repeat each login multiple times.