/flags/entra-id/az-login-allow-no-subscriptions
az login --allow-no-subscriptions: sign in to an Entra tenant without Azure subscriptions
- tool
- Microsoft Entra ID
- command
- az login
- flag
- --allow-no-subscriptions
- default
- False (az login looks for subscriptions and treats a tenant without any as an error)
az login --allow-no-subscriptions signs in to the Azure CLI even if the account has no Azure subscription in the tenant. That is common for Microsoft Entra ID administrators: a Microsoft 365 tenant, a B2C directory or a test tenant often has no subscription at all. Without the flag, az login succeeds in the browser but the CLI then reports that no subscriptions were found, and the session is unusable. The Azure CLI reference: "Support accessing tenants without subscriptions. It's useful to run tenant-level commands, such as 'az ad'."
az login --tenant contoso.onmicrosoft.com --allow-no-subscriptions
az ad user show --id anna@contoso.com --query "{upn:userPrincipalName, enabled:accountEnabled}"
az ad app list --display-name "My API" --query "[].appId"Related az login options
| Option | Effect |
|---|---|
| --allow-no-subscriptions | accept tenants without subscriptions (default False) |
| --tenant, -t | the Microsoft Entra tenant to sign in to; required for service principals |
| --skip-subscription-discovery | skip listing subscriptions during login; requires --tenant |
| --use-device-code | device code flow; also used automatically when no browser can be launched |
| --service-principal | sign in as an app registration (with --username APP_ID and a secret or --certificate) |
| --identity | sign in with a managed identity |
On Windows the CLI uses Web Account Manager (WAM) by default; on Linux and macOS a browser. If neither is available it falls back to the device code flow.
What works after login
Tenant-level commands, which call Microsoft Graph or other directory APIs: az ad user, az ad group, az ad app, az ad sp, and az rest calls to https://graph.microsoft.com. Commands that manage Azure resources need a subscription and still fail. What you can change depends on your Entra role and on the Graph permissions behind the CLI, not on the flag (Graph permission vs Entra role).
Pitfalls
- Guest accounts. Signing in to another organization's tenant as a guest can fail with AADSTS50020 if the account is not in that directory; pass
--tenantexplicitly. - Service principals.
az login --service-principal ... --allow-no-subscriptionsis the way to runaz adin automation for a tenant without subscriptions; an app ID that does not exist in the tenant fails with AADSTS700016. - Several tenants.
az account listshows every tenant and subscription the session knows;az account setpicks one. - Not a Graph replacement.
az adcovers common objects; for full Entra ID management use Microsoft Graph PowerShell. The difference between app registrations and enterprise applications is on App registration vs enterprise application.
FAQ
Do I need --tenant with --allow-no-subscriptions?
Not strictly, but it is the usual combination. If your account belongs to several tenants, --tenant TENANT_ID (or the domain name) makes sure the session is for the directory you want to manage.
What do I see in az account list afterwards?
An entry for the tenant itself, which you can use for tenant-level commands. It is not an Azure subscription, so commands that need a subscription (az group, az vm and so on) still fail.
Is --skip-subscription-discovery the same thing?
It is related. --skip-subscription-discovery skips listing subscriptions during login and requires --tenant; the reference shows it for tenant-level operations such as az ad. --allow-no-subscriptions accepts a tenant that has no subscriptions at all.