The access token is from the wrong issuer

Question

I am getting this error while deploying container apps environment through terraform, all the other resources are created on the right subscription as well as tenant id but for container apps only I'm not able to make them up.

RESPONSE 401: 401 Unauthorized

│ ERROR CODE: InvalidAuthenticationTokenTenant

│ --------------------------------------------------------------------------------

│ {

│ "error": {

│ "code": "InvalidAuthenticationTokenTenant",

│ "message": "The access token is from the wrong issuer 'https://sts.windows.net/tenant-id/'. It must match one of the tenants https://sts.windows.net/tenant-id/' associated with this subscription. Please use any authority (URL) from 'https://login.windows.net/tenant-id' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."

Answer

I had a similar problem when creating new resources in terraform using the azurerm provider.

provider "azurerm" {
  features {}
  subscription_id            = var.parent_tenant_subscription_id
  skip_provider_registration = true
}

data "azurerm_billing_enrollment_account_scope" {
  billing_account_name    = var.billing_account_name
  enrollment_account_name = var.enrollment_account_name # this is from the child_tenant
}

resource "azurerm_subscription" "child_tenant" {
  subscription_name = "my_child_subscription"
  billing_scope_id  = data.azurerm_billing_enrollment_account_scope.parent.id
}

When creating the subscription, I had to reference the subscription_id from a parent account. Once that is created, I reference the new subscription id in a new provider for creating my resource where I previously encountered the error you received.

provider "azurerm" {
  features {}
  alias                      = "child"
  subscription_id            = azurerm_subscription.child_tenant.subscription_id
  skip_provider_registration = true
}

resource "azurerm_resource_group" "logging" {
  provider = azurerm.child
  name     = "child_logging"
  location = "East US"
}

Share via

The access token is from the wrong issuer

1 answer