What causes "failed to initialize Azure authentication: %w" in wtfutil/wtf?

Run `az login` locally (or `az login --service-principal` with valid credentials)

failed to initialize Azure authentication: %w

Error message

failed to initialize Azure authentication: %w

What it means

Init in modules/azurelogs/session.go:24 wraps any error from InitializeAzureAuthentication with this message. The Azure SDK's credential chain (DefaultAzureCredential or equivalent) failed to produce usable credentials, so no session can be built. The wrapped error carries the specific cause.

Source

Thrown at modules/azurelogs/session.go:24

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/monitor/azquery"
	"os"
)

const (
	envAzureClientID     = "AZURE_CLIENT_ID"
	envAzureClientSecret = "AZURE_CLIENT_SECRET"
	envAzureTenantID     = "AZURE_TENANT_ID"
)

// Init initializes a new Azure session with the specified query file
func Init(queryPath *string) (*Session, error) {
	sess := &Session{}
	sess.Azure = &AZSession{}

	// Initialize Azure authentication using modern non-deprecated libraries
	if err := InitializeAzureAuthentication(sess); err != nil {
		return nil, fmt.Errorf("failed to initialize Azure authentication: %w", err)
	}

	err := readQueryFile(sess, *queryPath)
	if err != nil {
		return nil, fmt.Errorf("failed to read query file %s: %w", *queryPath, err)
	}

	return sess, nil
}

// Session holds the configuration and state for an Azure Log Analytics session
type Session struct {
	App struct {
		SemVer string
	}

	Azure       *AZSession
	QueriesPath string

View on GitHub (pinned to bb838c1ccb)

Solutions

Run `az login` locally (or `az login --service-principal` with valid credentials)
Set AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars for service-principal auth
Check the wrapped error for which credential in the chain failed and fix that source
For Azure-hosted workloads, verify the managed identity is enabled and has permissions
Rotate expired service-principal secrets/certificates

Example fix

// before: docker run azurelogs-app  (no credentials mounted)
// after
// shell: az login
// shell: docker run -e AZURE_TENANT_ID=... -e AZURE_CLIENT_ID=... -e AZURE_CLIENT_SECRET=... azurelogs-app

Defensive patterns

Strategy: try-catch

Validate before calling

cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
    return fmt.Errorf("no Azure credential chain available (run az login or set AZURE_* env vars): %w", err)
}

Try / catch

sess, err := azurelogs.Init(&queryPath)
if err != nil {
    var ae *azidentity.AuthenticationFailedError
    if errors.As(err, &ae) || strings.Contains(err.Error(), "initialize Azure authentication") {
        return fmt.Errorf("auth failed: run 'az login' or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET: %w", err)
    }
    return err
}

Prevention

Run `az login` before local runs; document it in onboarding/README
Inject AZURE_* env vars via secret management in CI, never hardcode
Alert on service-principal secret expiry well before the deadline
Health-check credentials at startup with a lightweight token request

When it happens

Trigger: Calling Init with a valid query path but no usable Azure credential: az CLI not installed/logged in, AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET unset or wrong, managed identity unavailable, or an invalid AZURE_AUTHORITY_HOST.

Common situations: Running locally for the first time without `az login`, CI pipelines missing secret env vars, service principal secret expired or client ID deleted, or running outside Azure where a managed identity was assumed.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of wtfutil/wtf@bb838c1ccb (2026-09-03). Data as JSON: /api/errors/7efa1fad4ee70351. Report an issue: GitHub.