{"record":{"id":"a7c9e4dfabe29947","repo":"hashicorp/terraform","slug":"mismatch-between-supplied-tenant-id-and-that-provi","errorCode":null,"errorMessage":"mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity","messagePattern":"mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/helpers.go","lineNumber":141,"sourceCode":"\t\tfileSecret := strings.TrimSpace(string(fileSecretRaw))\n\n\t\tif clientSecret != \"\" && clientSecret != fileSecret {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match\")\n\t\t}\n\n\t\tclientSecret = fileSecret\n\t}\n\n\treturn &clientSecret, nil\n}\n\nfunc getTenantId(d *backendbase.SDKLikeData) (*string, error) {\n\ttenantId := strings.TrimSpace(d.String(\"tenant_id\"))\n\n\tif d.Bool(\"use_aks_workload_identity\") && os.Getenv(\"AZURE_TENANT_ID\") != \"\" {\n\t\taksTenantId := os.Getenv(\"AZURE_TENANT_ID\")\n\t\tif tenantId != \"\" && tenantId != aksTenantId {\n\t\t\treturn nil, fmt.Errorf(\"mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity\")\n\t\t}\n\t\ttenantId = aksTenantId\n\t}\n\n\treturn &tenantId, nil\n}\n","sourceCodeStart":123,"sourceCodeEnd":148,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/helpers.go#L123-L148","documentation":"In the AKS-workload-identity branch of getTenantId (helpers.go:141), if a tenant_id was already resolved and differs from the `AZURE_TENANT_ID` env var injected by the workload-identity webhook, the backend aborts rather than silently switching tenant.","triggerScenarios":"use_aks_workload_identity=true, AZURE_TENANT_ID is set, and an inline tenant_id that does not match it is also configured.","commonSituations":"Left-over tenant_id from a previous setup; cross-tenant confusion; the federated credential lives in a different tenant than the configured value.","solutions":["Remove tenant_id when using AKS workload identity and let AZURE_TENANT_ID be authoritative.","Ensure the configured tenant_id equals the tenant of the federated identity credential.","Disable use_aks_workload_identity if you want the inline tenant_id to win."],"exampleFix":"# before\nbackend \"azurerm\" {\n  use_aks_workload_identity = true\n  tenant_id                 = \"33333333-3333-3333-3333-333333333333\"\n}\n# after\nbackend \"azurerm\" {\n  use_aks_workload_identity = true\n}","handlingStrategy":"validation","validationCode":"# ensure no conflicting tenant_id when AKS workload identity is used\nif [ \"${TF_VAR_use_aks_workload_identity:-false}\" = \"true\" ] && [ -n \"${AZURE_TENANT_ID:-}\" ]; then\n  [ -z \"${TF_VAR_tenant_id:-}\" ] || [ \"$TF_VAR_tenant_id\" = \"$AZURE_TENANT_ID\" ] \\\n    || { echo \"tenant_id conflicts with AZURE_TENANT_ID\" >&2; exit 1; }\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not set tenant_id when using AKS workload identity.","Confirm the federated identity's tenant matches the configured value."],"tags":["azure","tenant-id","aks","workload-identity","config"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}