hashicorp/terraform · error

mismatch between supplied Tenant ID and that provided by AKS

Error message

mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity

What it means

In the AKS-workload-identity branch of getTenantId (helpers.go:141), if a tenant_id was already resolved and differs from the `AZURE_TENANT_ID` env var injected by the workload-identity webhook, the backend aborts rather than silently switching tenant.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:141

		fileSecret := strings.TrimSpace(string(fileSecretRaw))

		if clientSecret != "" && clientSecret != fileSecret {
			return nil, fmt.Errorf("mismatch between supplied Client Secret and supplied Client Secret file contents - please either remove one or ensure they match")
		}

		clientSecret = fileSecret
	}

	return &clientSecret, nil
}

func getTenantId(d *backendbase.SDKLikeData) (*string, error) {
	tenantId := strings.TrimSpace(d.String("tenant_id"))

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_TENANT_ID") != "" {
		aksTenantId := os.Getenv("AZURE_TENANT_ID")
		if tenantId != "" && tenantId != aksTenantId {
			return nil, fmt.Errorf("mismatch between supplied Tenant ID and that provided by AKS Workload Identity - please remove, ensure they match, or disable use_aks_workload_identity")
		}
		tenantId = aksTenantId
	}

	return &tenantId, nil
}

View on GitHub (pinned to c9def3e214)

Solutions

1. Remove tenant_id when using AKS workload identity and let AZURE_TENANT_ID be authoritative.
2. Ensure the configured tenant_id equals the tenant of the federated identity credential.
3. Disable use_aks_workload_identity if you want the inline tenant_id to win.

Example fix

# before
backend "azurerm" {
  use_aks_workload_identity = true
  tenant_id                 = "33333333-3333-3333-3333-333333333333"
}
# after
backend "azurerm" {
  use_aks_workload_identity = true
}

# ensure no conflicting tenant_id when AKS workload identity is used
if [ "${TF_VAR_use_aks_workload_identity:-false}" = "true" ] && [ -n "${AZURE_TENANT_ID:-}" ]; then
  [ -z "${TF_VAR_tenant_id:-}" ] || [ "$TF_VAR_tenant_id" = "$AZURE_TENANT_ID" ] \
    || { echo "tenant_id conflicts with AZURE_TENANT_ID" >&2; exit 1; }
fi

When it happens

Trigger: use_aks_workload_identity=true, AZURE_TENANT_ID is set, and an inline tenant_id that does not match it is also configured.

Common situations: Left-over tenant_id from a previous setup; cross-tenant confusion; the federated credential lives in a different tenant than the configured value.

Related errors

• mismatch between supplied OIDC token and OIDC token file con
• mismatch between supplied Client ID and that provided by AKS
• reading OIDC Token from file %q provided by AKS Workload Ide
• sasToken cannot be empty
• subscription id not specified

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/a7c9e4dfabe29947. Report an issue: GitHub.