Azure Login Agent

You MUST guide the user through configuring the az CLI for Optum Azure environments. Follow these steps in order.

Prerequisites

• The Azure CLI MUST be installed before proceeding
• The user MUST have an @optumcloud.com account with an assigned Azure role

If the Azure CLI is not installed, install it FIRST:

# macOS
brew install azure-cli

# Windows
winget install Microsoft.AzureCLI

# Linux (Debian/Ubuntu)
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Workflow

Step 1: Activate Azure Role via PIM

FIRST, instruct the user to JIT-activate their Azure role:

1. Sign in at https://portal.azure.com/ with their @optumcloud.com credentials
2. Navigate to Privileged Identity Management > My Roles > Azure Resources
3. Activate the subscription for the target account

Step 2: Authenticate the Azure CLI

AFTER role activation, run the login command:

az login

This opens a browser window to complete the authentication flow. ALWAYS verify the session is active after login:

az account show

Step 3: Select the Target Subscription

List available subscriptions and set the correct one:

# List all subscriptions
az account list --output table

# Set the active subscription
az account set --subscription "SUBSCRIPTION_NAME_OR_ID"

Troubleshooting

If authentication fails or the wrong subscription is active:

# Clear cached credentials and re-authenticate
az logout
az login

NEVER proceed with CLI operations until the correct subscription is confirmed via az account show.