feat: Add Azure CLI auth source

.changes/unreleased/added-20260812-122446.yaml

@@ -0,0 +1,6 @@
+kind: added
+body: Add support for Azure CLI authentication source
+time: 2026-08-12T12:24:46.8603823+03:00
+custom:
+    Author: shirasassoon
+    AuthorLink: https://github.com/shirasassoon

docs/commands/auth/index.md

@@ -8,11 +8,11 @@ Not resource-specific; applies to CLI authentication context.
 
 ## Available Commands
 
-| Command        | Description                | Usage                                                                 |
-|----------------|---------------------------|-----------------------------------------------------------------------|
-| `auth login`   | Log in to Fabric CLI      | `auth login [parameters]`                                                |
-| `auth logout`  | Log out of current session| `auth logout`                                                         |
-| `auth status`  | Show authentication status| `auth status`                                                         |
+| Command | Description | Usage |
+| --- | --- | --- |
+| `auth login` | Log in to Fabric CLI | `auth login [parameters]` |
+| `auth logout` | Log out of current session | `auth logout` |
+| `auth status` | Show authentication status | `auth status` |
 
 ---
 
@@ -22,8 +22,28 @@ Authenticate with Fabric CLI.
 
 **Usage:**
 
+#### Interactive login
 ```
-fab auth login [-u <client_id>] [-p <client_secret>] [--federated-token <token>] [--certificate </path/to/certificate.[pem|p12|pfx]>] [--tenant <tenant_id>]
+fab auth login
+```
+
+#### Azure CLI
+```
+fab auth login --azure-cli
+```
+
+#### Service principal
+```
+# Service principal with secret
+fab auth login -u <client_id> -p <client_secret> --tenant <tenant_id>
+
+# Service principal with certificate
+fab auth login -u <client_id> --certificate <path> --tenant <tenant_id>
+```
+
+#### Workload identity
+```
+fab auth login -u <client_id> --federated-token <token> --tenant <tenant_id>
 ```
 
 **Parameters:**
@@ -32,6 +52,7 @@ fab auth login [-u <client_id>] [-p <client_secret>] [--federated-token <token>]
 - `-p, --password`: Client secret for service principal. Optional.
 - `--federated-token`: Federated token for workload identity. Optional.
 - `--certificate`: Path to certificate file. Optional.
+- `--azure-cli`: Use an existing Azure CLI login session as the token provider. Requires Azure CLI to be installed and logged in (`az login`). Optional.
 - `--tenant`: Tenant ID. Optional.
 
 ---
@@ -60,4 +81,4 @@ fab auth status
 
 ---
 
-For more examples and detailed scenarios, see [Authentication Examples](../../examples/auth_examples.md).
+For more examples and detailed scenarios, see [Authentication Examples](../../examples/auth_examples.md).

docs/examples/auth_examples.md

@@ -25,6 +25,25 @@ fab auth login
 ```
 
 
+### Azure CLI Authentication
+
+Reuse an _existing_ Azure CLI session instead of requiring a separate Fabric CLI login. Useful when tools or scripts already have `az login` done (e.g., in development environments or CI/CD pipelines with Azure CLI pre-authenticated).
+
+!!! info "Requires Azure CLI to be installed and logged in (`az login`)"
+
+#### Log in using Azure CLI in interactive mode
+
+```
+fab auth login
+? How would you like to authenticate Fabric CLI? Azure CLI (existing 'az login' session)
+```
+
+#### Log in using Azure CLI directly from command line
+
+```
+fab auth login --azure-cli
+```
+
 ### Service Principal Authentication
 
 !!! info "Requires 'Allow service principals to use Fabric APIs' tenant switch to be enabled in the admin portal"

pyproject.toml

@@ -20,6 +20,7 @@ dependencies = [
     "msal>=1.34,<2",
     "msal_extensions",
     "azure-core>=1.29.0",
+    "azure-identity>=1.25.0",
     "questionary",
     "prompt_toolkit>=3.0.41",
     "cachetools>=5.5.0",

src/fabric_cli/commands/auth/fab_auth.py

@@ -16,26 +16,32 @@
 def init(args: Namespace) -> Any:
     auth_options = [
         "Interactive with a web browser",
+        "Azure CLI (existing 'az login' session)",
         "Service principal authentication with secret",
         "Service principal authentication with certificate",
         "Service principal authentication with federated credential",
         "Managed identity authentication",
     ]
 
+    _validate_auth_args(args)
+
     utils_mem_store.clear_caches()
 
     # Clean up stale context files when logging in
     Context().cleanup_context_files(cleanup_all_stale=True, cleanup_current=False)
 
-    if args.identity:
+    if getattr(args, "azure_cli", False):
+        FabAuth().set_access_mode("azure_cli")
+        _acquire_default_access_tokens(FabAuth())
+        Context().context = FabAuth().get_tenant()
+
+    elif args.identity:
         FabAuth().set_access_mode("managed_identity")
         FabAuth().set_managed_identity(args.username)
-        FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
-        FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
-        FabAuth().get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)
+        _acquire_default_access_tokens(FabAuth())
         Context().context = FabAuth().get_tenant()
 
-    elif any([args.username, args.password]):
+    elif any([args.username, args.password, args.certificate, args.federated_token]):
         if not (
             all([args.username, args.tenant])
             and any([args.password, args.certificate, args.federated_token])
@@ -54,9 +60,7 @@ def init(args: Namespace) -> Any:
                 FabAuth().set_spn(args.username, password=args.password)
             elif args.federated_token:
                 FabAuth().set_spn(args.username, client_assertion=args.federated_token)
-            FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
-            FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
-            FabAuth().get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)
+            _acquire_default_access_tokens(FabAuth())
             Context().context = FabAuth().get_tenant()
     else:
         selected_auth = fab_ui.prompt_select_item(
@@ -69,9 +73,11 @@ def init(args: Namespace) -> Any:
         try:
             if selected_auth == "Interactive with a web browser":
                 FabAuth().set_access_mode("user", args.tenant)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)
+                _acquire_default_access_tokens(FabAuth())
+                Context().context = FabAuth().get_tenant()
+            elif selected_auth.startswith("Azure CLI"):
+                FabAuth().set_access_mode("azure_cli")
+                _acquire_default_access_tokens(FabAuth())
                 Context().context = FabAuth().get_tenant()
             elif selected_auth.startswith("Service principal authentication"):
                 fab_logger.log_warning(
@@ -174,9 +180,7 @@ def init(args: Namespace) -> Any:
                     FabAuth().set_spn(client_id, password=client_secret)
                 elif federated_token:
                     FabAuth().set_spn(client_id, client_assertion=federated_token)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)
+                _acquire_default_access_tokens(FabAuth())
                 Context().context = FabAuth().get_tenant()
             elif selected_auth == "Managed identity authentication":
                 fab_logger.log_warning(
@@ -191,9 +195,7 @@ def init(args: Namespace) -> Any:
 
                 FabAuth().set_access_mode("managed_identity")
                 FabAuth().set_managed_identity(client_id)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
-                FabAuth().get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)
+                _acquire_default_access_tokens(FabAuth())
                 Context().context = FabAuth().get_tenant()
 
         except KeyboardInterrupt:
@@ -217,6 +219,7 @@ def logout(args: Namespace) -> None:
 
 def status(args: Namespace) -> None:
     auth = FabAuth()
+    identity_type = auth.get_identity_type()
     tenant_id = auth.get_tenant_id()
 
     def __get_token_info(scope):
@@ -273,21 +276,80 @@ def __mask_token(scope):
     )
     fab_ui.print_grey(login_status)
 
-    auth_data = {
-        "logged_in": is_logged_in,
-        "account": upn,
-        "principal_id": oid,
-        "tenant_id": tid,
-        "app_id": appid,
-        "token_fabric_powerbi": fabric_secret,
-        "token_storage": storage_secret,
-        "token_azure": azure_secret,
-    }
+    auth_data = {}
+    if identity_type == "azure_cli":
+        auth_data.update(
+            {
+                "authentication_mode": "Azure CLI",
+                "azure_cli_session": "Available" if is_logged_in else "Unavailable",
+            }
+        )
+    auth_data.update(
+        {
+            "logged_in": is_logged_in,
+            "account": upn,
+            "principal_id": oid,
+            "tenant_id": tid,
+            "app_id": appid,
+            "token_fabric_powerbi": fabric_secret,
+            "token_storage": storage_secret,
+            "token_azure": azure_secret,
+        }
+    )
     fab_ui.print_output_format(args, data=auth_data, show_key_value_list=True)
 
 
 # Utils
+def _validate_auth_args(args: Namespace) -> None:
+    auth_args = {
+        "azure_cli": "--azure-cli",
+        "identity": "--identity",
+        "username": "--username",
+        "password": "--password",
+        "tenant": "--tenant",
+        "certificate": "--certificate",
+        "federated_token": "--federated-token",
+    }
+    specified_args = [
+        attribute for attribute in auth_args if getattr(args, attribute, None)
+    ]
+
+    incompatible: list[str] = []
+    if "azure_cli" in specified_args:
+        incompatible = specified_args if len(specified_args) > 1 else []
+    elif "identity" in specified_args:
+        incompatible = [
+            attribute
+            for attribute in specified_args
+            if attribute not in {"identity", "username"}
+        ]
+        if incompatible:
+            incompatible.insert(0, "identity")
+    elif "federated_token" in specified_args:
+        incompatible = [
+            attribute
+            for attribute in specified_args
+            if attribute in {"password", "certificate"}
+        ]
+        if incompatible:
+            incompatible.append("federated_token")
+
+    if incompatible:
+        raise FabricCLIError(
+            ErrorMessages.Auth.incompatible_authentication_arguments(
+                [auth_args[attribute] for attribute in incompatible]
+            ),
+            fab_constant.ERROR_INVALID_INPUT,
+        )
+
+
 def _get_token_info_from_bearer_token(bearer_token: str) -> Optional[dict[str, str]]:
     return FabAuth()._get_claims_from_token(
         bearer_token, ["upn", "oid", "tid", "appid"]
     )
+
+
+def _acquire_default_access_tokens(auth: FabAuth) -> None:
+    auth.get_access_token(scope=fab_constant.SCOPE_FABRIC_DEFAULT)
+    auth.get_access_token(scope=fab_constant.SCOPE_ONELAKE_DEFAULT)
+    auth.get_access_token(scope=fab_constant.SCOPE_AZURE_DEFAULT)