Azure DevOps Ubuntu代理中Pulumi服务主体认证失败问题

我在Azure DevOps发布管道的AzureCLI任务中创建了一个最小化Pulumi任务，本地运行正常，但在Azure DevOps Ubuntu代理上执行时崩溃。执行的脚本如下：

#!/bin/bash
cat > __main__.py <<EOF
import pulumi_azure_native as azure; sa = azure.storage.StorageAccount("testsa", resource_group_name="rg_test", sku=azure.storage.SkuArgs(name="Standard_LRS"), kind="StorageV2", location="westus")
EOF
#import pulumi_azure_native as azure; rg = azure.resources.ResourceGroup("rg_test_pulumi", location="eastus")
cat > Pulumi.yaml <<EOF
name: test
description: A minimal Azure DevOps Python Pulumi program to create an AzureDevOps Project
runtime:
  name: python
  options:
    toolchain: pip
    virtualenv: venv.test_pulumi
config:
  pulumi:tags:
    value:
      pulumi:template: azuredevops-python
EOF
if [ "$(pulumi stack ls -j | jq 'length')" -eq 1 ]; then
    pulumi stack rm dev -y
fi
PULUMI_CONFIG_PASSPHRASE=TESTPASSWORD pulumi stack init dev --secrets-provider=passphrase --non-interactive
python3 -m venv venv.test_pulumi
source venv.test_pulumi/bin/activate
python3 -m pip install pulumi pulumi-azure-native
PULUMI_CONFIG_PASSPHRASE=TESTPASSWORD pulumi preview

已知当前通过服务主体进行认证（Azure任务自动以服务主体登录），但收到错误：

2025-06-30T22:46:36.7982751Z  +  pulumi:pulumi:Stack test-dev create 
2025-06-30T22:46:38.9001154Z @ Previewing update.....
2025-06-30T22:46:38.9001747Z     azure-native:storage:StorageAccount testsa  error: Authenticating using the Azure CLI is only supported as a User (not a Service Principal).

我尝试在脚本开头添加echo "$(System.AccessToken)" | az devops login --organization <myorg>但无效，希望避免设置ARM_CLIENT_ID和ARM_CLIENT_SECRET环境变量，尽量使用代理内获取的凭据解决问题。

内容的提问来源于stack exchange，提问作者martin