Tenant switching

[07JP27]

Hi team,

I have joined multiple tenants. When I try to run a prompty file in VS Code, the default tenant is selected automatically. However, the Azure OpenAI model I am trying to use is deployed in another tenant, so I cannot authenticate with AAD.

Is there any way to switch tenants when running a prompt or a workaround for this issue?

[sethjuarez]

Great question - the extension relies on the underlying system settings when it comes to identity. My go to approach is to use the az login approach to sign in to the right places. Let me know what you think.

[07JP27]

I also confirmed that vscode.authentication.getSession() is used in the prompty extension's code.

Creating and using the CLI is a good idea to realize this issue, and it allows execution in other IDEs or shells. If you still keep the VS Code extension, you can emit the CLI command behind the GUI action.

The CLI command I hope:

prompty login --tenant xxxxxxxxxxxxxx (-> Browser poping up)
prompty create --file xxxxx.prompty
prompty run --file xxxxx.prompty
prompty generate --lang-chain --file xxxxx.prompty
prompty generate --semantic-kernel --file xxxxx.prompty
prompty generate --prompt-flow --file xxxxx.prompty

[sethjuarez]

Interesting idea!! I will label this as a feature request.

[pelikhan]

vscode 1.93 added support for choosing accounts when getting a session

[DavidBurela]

I am stuck at this point now. I did my auth login for prompty, but it is not using my correct tenant. I've tried authenticating with az login but Prompty still tries to run against the wrong tenant.

[sethjuarez]

Ugh - I am sorry! In general the AOAI prompty executor uses the currently logged in tenant if the key is not specified. Usually something like:

az login

sould fix the issue. You can also switch the tenant using:

az login --tenant <tenant_id>

Hopefully this works.

[lisaWolffhugelMS]

Hi there, I also have a similar issue. I'm connected with my one of the MS tenant which is not the default one. I have used the cmd az login --tenat <tenant_id> as you suggested @sethjuarez to authenticate in the correct tenant but still prompty is trying to generate the AAD auth token with the MS principal tenant (not where the resources are deployed).

Here is the error I get :

prompty extension version : v0.1.2024092301 (pre-release)

I can only make it work if I use the API_key.

any suggestion ? I think it would be great to switch tenant to use in prompty as suggested by @07JP27.

[pamelafox]

Can we have a way to specify the tenant ID in the settings? You could see how the GitHub Copilot for Azure does it - they added a /changeTenant command to make it easy to switch tenants.

[kristapratico]

Running into this issue when trying to use prompty in Azure DevOps:

Using the Azure CLI task to login with my service connection and it seems to pick the wrong tenant.

    - task: AzureCLI@2
      displayName: Run (AzureCLI@2)
      inputs:
        azureSubscription: my-subscription
        scriptType: bash
        scriptLocation: inlineScript
        inlineScript: |
          az account set --subscription "xxxxxxxxxxx"

          # Verify the context
          az account show --query '{subscription:name,tenant:tenantId}'

          python run.py

{'error': {'code': 'Tenant provided in token does not match resource token', 'message': 'Token tenant xxxxxxxxxxxx does not match resource tenant.'}}

+1 for adding a way to specify the tenant with prompty.