How do I install the Azd Terraform Auth Alignment skill?

Run npx skillmds@latest add azure-samples/azd-terraform-auth-alignment in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Azd Terraform Auth Alignment skill do?

Skill: azd + Terraform Auth Alignment Diagnostic It is listed under DevOps & Infra on SkillMD.

Is Azd Terraform Auth Alignment safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Azd Terraform Auth Alignment?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Azd Terraform Auth Alignment free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Azd Terraform Auth Alignment?

Azure-Samples (@azure-samples) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Azd Terraform Auth Alignment by azure-samples

Name: Azd Terraform Auth Alignment
Author: Azure-Samples

File contents

Skill: azd + Terraform Auth Alignment Diagnostic

Problem

When using azd with Terraform as the IaC provider, Terraform providers (azurerm, azuread) default to az CLI authentication, NOT azd authentication. If the two CLIs are logged into different tenants, Terraform operations fail with cross-tenant auth errors like AADSTS530084 (Conditional Access Policy violation).

Diagnostic Pattern

Step 1: Check azd Identity

azd auth login --check-status

Look for: Logged in to Azure as <user@domain>

Step 2: Check az CLI Identity

az account show

Look for: tenantId field (e.g., 99e1e9a1-3a8f-4088-ad5d-60be65ecc59a)

Step 3: Check azd Environment Tenant

cat .azure/{env-name}/.env | grep ENTRA_ID_TENANT_ID

Or on Windows:

Get-Content .azure\{env-name}\.env | Select-String ENTRA_ID_TENANT_ID

Step 4: Verify Alignment

All three must match:

azd user's tenant (from Step 1)
az CLI tenantId (from Step 2)
ENTRA_ID_TENANT_ID from azd env (from Step 3)

Fix

If misaligned, run:

az login

Then select the same tenant/subscription that azd is using.

Optionally set the subscription explicitly:

az account set --subscription <subscription-id-from-azd-env>

Why This Matters

azd manages environment variables, orchestrates deployment workflows
Terraform providers use az CLI credentials by default (via DefaultAzureCredential)
If they're on different tenants, Terraform tries to create resources in subscription A (tenant X) using credentials from tenant Y → cross-tenant token request → CAP violation

Key Learning

When using azd + Terraform:

Always check auth alignment BEFORE running azd provision or azd up
Both azd AND az CLI must be logged into the SAME tenant
Cross-tenant auth fails even if both identities have access to the target subscription

When to Apply

Use this diagnostic when you see:

AADSTS530084 errors during azd provision
"Failed to authenticate" errors from Terraform providers
"Conditional Access Policy" violations during infrastructure provisioning
Any cross-tenant auth errors when using azd + Terraform

Verification

After aligning auth:

azd provision --preview

Should succeed without auth errors. Terraform plan should generate successfully.

---name: azd-terraform-auth-alignmentdescription: Skill: azd + Terraform Auth Alignment Diagnostic---# Skill: azd + Terraform Auth Alignment Diagnostic## ProblemWhen using `azd` with Terraform as the IaC provider, Terraform providers (azurerm, azuread) default to `az` CLI authentication, NOT azd authentication. If the two CLIs are logged into different tenants, Terraform operations fail with cross-tenant auth errors like AADSTS530084 (Conditional Access Policy violation).## Diagnostic Pattern### Step 1: Check azd Identity```bashazd auth login --check-status```Look for: `Logged in to Azure as <user@domain>`### Step 2: Check az CLI Identity```bashaz account show```Look for: `tenantId` field (e.g., `99e1e9a1-3a8f-4088-ad5d-60be65ecc59a`)### Step 3: Check azd Environment Tenant```bashcat .azure/{env-name}/.env | grep ENTRA_ID_TENANT_ID```Or on Windows:```powershellGet-Content .azure\{env-name}\.env | Select-String ENTRA_ID_TENANT_ID```### Step 4: Verify AlignmentAll three must match:- azd user's tenant (from Step 1)- az CLI tenantId (from Step 2)- ENTRA_ID_TENANT_ID from azd env (from Step 3)## FixIf misaligned, run:```bashaz login```Then select the same tenant/subscription that azd is using.Optionally set the subscription explicitly:```bashaz account set --subscription <subscription-id-from-azd-env>```## Why This Matters- **azd** manages environment variables, orchestrates deployment workflows- **Terraform providers** use `az` CLI credentials by default (via DefaultAzureCredential)- If they're on different tenants, Terraform tries to create resources in subscription A (tenant X) using credentials from tenant Y → cross-tenant token request → CAP violation## Key LearningWhen using azd + Terraform:- Always check auth alignment BEFORE running `azd provision` or `azd up`- Both azd AND az CLI must be logged into the SAME tenant- Cross-tenant auth fails even if both identities have access to the target subscription## When to ApplyUse this diagnostic when you see:- AADSTS530084 errors during `azd provision`- "Failed to authenticate" errors from Terraform providers- "Conditional Access Policy" violations during infrastructure provisioning- Any cross-tenant auth errors when using azd + Terraform## VerificationAfter aligning auth:```bashazd provision --preview```Should succeed without auth errors. Terraform plan should generate successfully.

Frequently asked questions

Azd Terraform Auth Alignment