{"record":{"id":"710f906ae964cc8f","repo":"microsoft/aspire","slug":"could-not-find-tenant-id-subscriptionresource-tenantid-for","errorCode":null,"errorMessage":"Could not find tenant id {subscriptionResource.TenantId} for subscription {subscriptionResource.DisplayName}.","messagePattern":"Could not find tenant id (.+?) for subscription (.+?)\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultArmClientProvider.cs","lineNumber":79,"sourceCode":"        public async Task<(ISubscriptionResource subscription, ITenantResource tenant)> GetSubscriptionAndTenantAsync(CancellationToken cancellationToken = default)\n        {\n            var subscription = await armClient.GetDefaultSubscriptionAsync(cancellationToken).ConfigureAwait(false);\n            var subscriptionResource = new DefaultSubscriptionResource(subscription);\n\n            ITenantResource? tenantResource = null;\n\n            await foreach (var tenant in armClient.GetTenants().GetAllAsync(cancellationToken: cancellationToken).ConfigureAwait(false))\n            {\n                if (tenant.Data.TenantId == subscriptionResource.TenantId)\n                {\n                    tenantResource = new DefaultTenantResource(tenant);\n                    break;\n                }\n            }\n\n            if (tenantResource is null)\n            {\n                throw new InvalidOperationException($\"Could not find tenant id {subscriptionResource.TenantId} for subscription {subscriptionResource.DisplayName}.\");\n            }\n\n            return (subscriptionResource, tenantResource);\n        }\n\n        public async Task<IEnumerable<ITenantResource>> GetAvailableTenantsAsync(CancellationToken cancellationToken = default)\n        {\n            var tenants = new List<ITenantResource>();\n\n            await foreach (var tenant in armClient.GetTenants().GetAllAsync(cancellationToken: cancellationToken).ConfigureAwait(false))\n            {\n                tenants.Add(new DefaultTenantResource(tenant));\n            }\n\n            return tenants;\n        }\n\n        public async Task<IEnumerable<ISubscriptionResource>> GetAvailableSubscriptionsAsync(CancellationToken cancellationToken = default)","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultArmClientProvider.cs#L61-L97","documentation":"During Azure provisioning, Aspire resolves the default subscription and its tenant by enumerating the tenants visible to the logged-in credential and matching the subscription's TenantId. This error means no tenant in that enumeration matched the subscription's tenant id, so the (subscription, tenant) pair cannot be returned. It is thrown as an InvalidOperationException because the ARM account state is inconsistent with the subscription lookup.","triggerScenarios":"Calling GetSubscriptionAndTenantAsync when the credential can list tenants but none has TenantId equal to the default subscription's TenantId — e.g. the subscription belongs to a tenant the principal is not a member of, the tenant listing was filtered/partial, or the default subscription resolved to an unexpected entry (stale Azure CLI account cache, guest access, cross-tenant subscription).","commonSituations":"Developers hit this after switching az accounts with `az login` while a different subscription is default, when using a service principal with access to a subscription in another tenant but no membership there, when tenant-level permissions block listing the tenant resource, or after subscription moves between tenants.","solutions":["Run `az login` (or re-authenticate the credential) ensuring the account is a member of the tenant that owns the target subscription.","Run `az account list` / `az account set --subscription <id>` to make the intended subscription the default and confirm its tenantId matches your login tenant.","If using a service principal, grant it a role in the owning tenant and ensure it authenticates against that tenant (AZURE_TENANT_ID set correctly).","Verify no tenant filters or ARM client options restrict GetTenants() results; retry after clearing cached Azure CLI tokens (`az account clear` then `az login`)."],"exampleFix":"// before\naz login --tenant 11111111-1111-1111-1111-111111111111  // tenant that does not own the subscription\n// after\naz login --tenant 22222222-2222-2222-2222-222222222222  // tenant owning the subscription\naz account set --subscription 33333333-3333-3333-3333-333333333333","handlingStrategy":"validation","validationCode":"var sub = await armClient.GetDefaultSubscriptionAsync(ct);\nvar tenantVisible = false;\nawait foreach (var t in armClient.GetTenants().GetAllAsync(cancellationToken: ct))\n    if (t.Data.TenantId == sub.Data.TenantId) { tenantVisible = true; break; }\nif (!tenantVisible)\n    throw new InvalidOperationException($\"Login tenant does not own subscription '{sub.Data.DisplayName}'; re-authenticate with 'az login --tenant <tenantId>'.\");","typeGuard":"bool TenantMatchesSubscription(string? subscriptionTenantId, IEnumerable<string> visibleTenantIds) =>\n    subscriptionTenantId is not null && visibleTenantIds.Contains(subscriptionTenantId, StringComparer.OrdinalIgnoreCase);","tryCatchPattern":"try\n{\n    var (subscription, tenant) = await client.GetSubscriptionAndTenantAsync(ct);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"Could not find tenant id\"))\n{\n    // re-authenticate against the subscription's owning tenant, then retry\n}","preventionTips":["After any az login/account switch, confirm `az account show` tenantId matches the subscription's tenant.","Pin the intended default subscription with az account set --subscription.","For service principals, verify membership/role in the owning tenant and set AZURE_TENANT_ID correctly.","Clear stale Azure CLI token caches (`az account clear`) when switching identities."],"tags":["azure","arm","tenant","subscription","authentication"],"backgroundTag":"resource-not-found","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}