az login with SP

[Sas002]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

[Sas002]

I am trying use az login with SP . I am using on Suse Linux using export . Problem is az vm list or any az command is not working unless, I authenticate with az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID

Which is fine but after az login , it is generating .azure/accessTokens.json on home directory and SP credential information are on clear text , which is a big risk for security.

How it should work : After export , az login should work but without generating any .azure/accessTokens.json in clear text. Same login concept is working for AWS . When aws credentials are export then just aws s3 ls or similar command work without generating Key and secret in clear text.

Example:

export AZURE_CLIENT_ID=xxxxxxx
export AZURE_CLIENT_SECRET=xxxxxxx
export AZURE_TENANT_ID=xxxxxxx
export AZURE_SUBSCRIPTION_ID=xxxxxx
az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID
az vm list

[yugangw-msft]

Thanks @Sas002 for the feedback. Right now this is by-design. Also ~/.azure is being ACL'd correctly for protection. For record, AWS also saves secret in plain text, or if that been changed, please let me know.
For secret free solution, I very much suggest you go with the managed service identity
Any questions/suggestion, let us know

[yugangw-msft]

Closing as we don't have outstanding bugs

[jiasli]

Let's discuss this further in #10241.