{"record":{"id":"84d3913449799375","repo":"hashicorp/terraform","slug":"subscription-id-not-specified","errorCode":null,"errorMessage":"subscription id not specified","messagePattern":"subscription id not specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":92,"sourceCode":"\t}\n\n\tif armAuthRequired {\n\t\tresourceManagerAuth, err := auth.NewAuthorizerFromCredentials(ctx, *config.AuthConfig, config.AuthConfig.Environment.ResourceManager)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to build authorizer for Resource Manager API: %+v\", err)\n\t\t}\n\n\t\t// When using Azure CLI to auth, the user can leave the \"subscription_id\" unspecified. In this case the subscription id is inferred from\n\t\t// the Azure CLI default subscription.\n\t\tif config.SubscriptionID == \"\" {\n\t\t\tif cachedAuth, ok := resourceManagerAuth.(*auth.CachedAuthorizer); ok {\n\t\t\t\tif cliAuth, ok := cachedAuth.Source.(*auth.AzureCliAuthorizer); ok && cliAuth.DefaultSubscriptionID != \"\" {\n\t\t\t\t\tconfig.SubscriptionID = cliAuth.DefaultSubscriptionID\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif config.SubscriptionID == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"subscription id not specified\")\n\t\t}\n\n\t\t// Setup the SA client.\n\t\tclient.storageAccountsClient, err = storageaccounts.NewStorageAccountsClientWithBaseURI(config.AuthConfig.Environment.ResourceManager)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"building Storage Accounts client: %+v\", err)\n\t\t}\n\t\tclient.configureClient(client.storageAccountsClient.Client, resourceManagerAuth)\n\n\t\t// Populating the storage account detail\n\t\tstorageAccountId := commonids.NewStorageAccountID(config.SubscriptionID, config.ResourceGroupName, client.storageAccountName)\n\t\tresp, err := client.storageAccountsClient.GetProperties(ctx, storageAccountId, storageaccounts.DefaultGetPropertiesOperationOptions())\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"retrieving %s: %+v\", storageAccountId, err)\n\t\t}\n\t\tif resp.Model == nil {\n\t\t\treturn nil, fmt.Errorf(\"retrieving %s: model was nil\", storageAccountId)\n\t\t}","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/api_client.go#L74-L110","documentation":"Returned by buildClient when ARM auth is required and a subscription ID cannot be found anywhere: it is not in the backend config and the Azure CLI default subscription could not be inferred from a CachedAuthorizer/AzureCliAuthorizer. The ARM Storage Accounts client and key-listing calls all require a subscription ID.","triggerScenarios":"No access key/SAS/AAD provided (so ARM auth path is taken), subscription_id omitted from the backend block and env, and either not using Azure CLI auth or the CLI has no default subscription set. Fails during client construction.","commonSituations":"Forgetting ARM_SUBSCRIPTION_ID in env-based auth; using service-principal auth without a subscription; 'az account set' not run so no default subscription; copy-paste config missing the subscription_id field.","solutions":["Set subscription_id in the azurerm backend block, or export ARM_SUBSCRIPTION_ID.","If using Azure CLI auth, run 'az account set --subscription <id>' so a default subscription is available.","Provide an explicit access_key or sas_token to bypass the ARM/subscribed path entirely."],"exampleFix":"# before\nexport ARM_CLIENT_ID=...\nexport ARM_CLIENT_SECRET=...\nexport ARM_TENANT_ID=...\n# subscription missing!\n# after\nexport ARM_SUBSCRIPTION_ID=12345678-aaaa-bbbb-cccc-dddddddddddd","handlingStrategy":"validation","validationCode":"// Require a subscription id for ARM-based auth paths.\nif config.AccessKey == \"\" && config.SasToken == \"\" && !config.UseAzureADAuthentication && config.SubscriptionID == \"\" {\n    return errors.New(\"subscription_id (ARM_SUBSCRIPTION_ID) is required when using ARM auth\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set ARM_SUBSCRIPTION_ID in env-based auth.","Run 'az account set --subscription <id>' when using CLI auth so a default is inferable.","Provide an explicit access_key or SAS to avoid the ARM path entirely."],"tags":["azure","backend","auth","subscription","config","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}