执行Azure PowerShell脚本遇认证失败与订阅问题，求解决方案

问题场景 #

我有一段用于获取Azure私有端点数据并导出至CSV的PowerShell脚本：

Connect-AzAccount -Tenant 'xxxxx' -SubscriptionId 'xxxx'

# Get the Resource Group Name
$resourceGroupName = "city-app-rg-xx-uat"

# Get all Private Endpoints in the Resource Group
$privateEndpoints = Get-AzPrivateEndpoint -ResourceGroupName $resourceGroupName

# Create a list to store the data
$data = @()

# Loop through each Private Endpoint
foreach ($privateEndpoint in $privateEndpoints) {
    $fqdn = $privateEndpoint.PrivateDnsZoneGroup.Name
    $ipAddresses = $privateEndpoint.PrivateIPAddresses -join ","
    $name = $privateEndpoint.Name

    $data += [PSCustomObject]@{
        FQDN = $fqdn
        IPAddress = $ipAddresses
        Name = $name
    }
}

# Export the data to a CSV file
$data | Export-Csv -Path "PrivateEndpointDetails.csv" -NoTypeInformation

执行错误信息 #

在VS Code中执行脚本时出现以下错误：

PS C:\Users\User5574\source\repos\Automations> .\GetPrvEPsData.ps1
Please select the account you want to login with.

Connect-AzAccount: C:\Users\User5574\source\repos\Automations\GetPrvEPsData.ps1:1:1
Line |
   1 |  Connect-AzAccount -Tenant 'xxxxx' -Sub …
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | InteractiveBrowserCredential authentication failed: User canceled authentication.  Could not find tenant id for provided tenant domain
     | 'xxxxx'. Please ensure that the provided user is found in the provided tenant domain.
Get-AzPrivateEndpoint: C:\Users\User5574\source\repos\Automations\GetPrvEPsData.ps1:7:21
Line |
   7 |  … Endpoints = Get-AzPrivateEndpoint -ResourceGroupName $resourceGroupNa …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No subscription found in the context.  Please ensure that the credentials you provided are authorized to access an Azure subscription, then run Connect-AzAccount to login.

已尝试的排查步骤 #

• 以管理员身份运行VS Code
• 使用有权限访问Azure资源的账号通过Azure Sign in登录VS Code
• 将执行策略设置为RemoteSigned
• 更新VS Code中的Azure PowerShell模块

解决方案 #

1. 修正租户参数的有效性 #

错误核心提示租户ID/域名无效，需确保脚本中-Tenant参数值正确：

• 替换xxxxx为真实的租户ID（GUID格式）或租户域名（如yourcompany.onmicrosoft.com）
• 可通过Azure Portal进入Azure Active Directory -> 概览，查看租户ID和域名信息

2. 解决交互式登录冲突 #

若已通过VS Code Azure扩展登录，脚本内的Connect-AzAccount会触发重复认证，可二选一处理：

• 直接移除脚本中的Connect-AzAccount行，复用VS Code已登录的Azure上下文
• 或添加-UseDeviceAuthentication参数，改用设备码登录避免浏览器弹窗冲突：

Connect-AzAccount -Tenant '真实租户ID' -SubscriptionId '真实订阅ID' -UseDeviceAuthentication

3. 显式指定订阅上下文 #

即使登录成功，也需确保当前上下文指向目标订阅，避免“无订阅”错误，在Connect-AzAccount后添加：

Set-AzContext -SubscriptionId '真实订阅ID'

4. 验证账号的租户归属与权限 #

• 确认使用的账号确实属于指定租户：在Azure Portal的Azure AD -> 用户 -> 目标账号 -> 配置文件中查看租户信息
• 检查账号在目标资源组的权限：进入资源组的访问控制(IAM)，确认账号拥有Reader或更高权限

5. 修复脚本中FQDN的错误取值 #

原脚本中$privateEndpoint.PrivateDnsZoneGroup.Name无法正确获取FQDN，需从关联的私有DNS区域提取，修改循环逻辑如下：

foreach ($privateEndpoint in $privateEndpoints) {
    $dnsZoneGroups = Get-AzPrivateEndpointDnsZoneGroup -ResourceGroupName $resourceGroupName -PrivateEndpointName $privateEndpoint.Name
    $fqdnList = @()
    foreach ($zoneGroup in $dnsZoneGroups) {
        foreach ($zoneConfig in $zoneGroup.PrivateDnsZoneConfigs) {
            # 按资源名称+DNS区域域名拼接FQDN，可根据实际场景调整
            $fqdnList += "$($privateEndpoint.Name).$($zoneConfig.PrivateDnsZoneId.Split('/')[-1])"
        }
    }
    $fqdn = $fqdnList -join ","
    $ipAddresses = $privateEndpoint.PrivateIPAddresses -join ","
    $name = $privateEndpoint.Name

    $data += [PSCustomObject]@{
        FQDN = $fqdn
        IPAddress = $ipAddresses
        Name = $name
    }
}

内容的提问来源于stack exchange，提问作者Vaishnavi Vaishu