Cannot access resources in client subscription in certain blades

Question

Cannot access resources in client subscription in certain blades

Justin Tolchin 21

When following the steps on https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate, I get all the way to the end, but when I try to delete the old watcher, I get a popup saying "Interaction Required", sign in again or ignore. I've tried both options and just get in a loop, even after successful authentication and MFA.

I set up the subscription and everything in it. This started happening a couple weeks ago with another resource. Now it is happening here. I can go to all the different blades, but when I start to dig deeper (like with storage) or try to delete as is the case here, I am blocked.

{
  "sessionId": "c987311f7007410688e1f144283e41e0",
  "errors": [
    {
      "errorMessage": "invalid_grant: xxxxxxxx Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access xxxxxxxxxxxxxxxxxxxxxxxx;. Trace ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx Correlation ID: xxxxxxxxxxxxxxxx Timestamp: 2025-04-24 15:49:16Z",
      "clientId": "xxxxxxxxxxxxxxxxxxxxx",
      "scopes": [
        "xxxxxxxxxxxxxxxxxxxxxxxxxx/.default"
      ]
    }
  ]
}

Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-24T17:16:16.9633333+00:00
Hello Justin Tolchin

I understand that you are facing the issue while accessing resources in your Azure subscription, particularly when trying to delete an old network watcher.

Here are a few things you can try to resolve this issue:

Clearing cached cookies might help mitigate authentication loops, as they can sometimes conflict with authentication tokens.

Check if your organization has implemented conditional access policies that require additional authentication steps. Contact your Azure administrator to verify.

Ensure that your account has the necessary permissions to delete the network watcher. Depending on your role, you might need to verify your access level.

Try accessing the Azure portal from a different browser to see if the issue persists.

In the meantime, could you please provide the following information for further troubleshooting:

Are you the owner of the Azure subscription, or do you have limited permissions?

What type of authentication method are you using (e.g., MFA provider)? Ensure that you have completed the multi-factor authentication process successfully.

Have you noticed any patterns or specific actions that trigger the "Interaction Required" message?

Are there any recent changes in your Azure policies or configuration that you are aware of?

Verify that your account has the necessary permissions to delete the old watcher.

If possible, try accessing the resources from a different location or network to see if the issue persists.

Check the reference document for more understanding https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-create?tabs=portal

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Justin Tolchin 21 Reputation points

2025-04-24T20:49:34.22+00:00

Thank you for your reply.

I've tried incognito, clearing the cache, and using a different browser. All have the same result.

MFA has been enabled for us as well as our clients using the Microsoft Authenticator app.

I built the app and all related components, so as far as I know, I am an owner/admin.

I am no longer the owner of the subscription. I transferred it to the client.

This identity challenge comes up when I try to interact with something on the blade like deleting the Network Watcher or looking inside blob storage. I had no issues with storage when working through PowerShell script, nor did I have issues creating the new Network watcher as outlined in the linked article.
Venkat V 1,800 Reputation points Microsoft External Staff

2025-04-25T06:32:47.7166667+00:00
Hi@Justin Tolchin,

Can you please confirm how you're authenticating — either via code or the Azure portal? If you're using code, kindly share the full snippet for further clarification.

The above error usually occurs when you're trying to authenticate without completing the MFA process.

When I tried to authenticate using code without completing MFA, I encountered the same error as you.

If you're using code to authenticate, you'll need to switch to either the interactive flow or device code flow, both of which require the user to log in at least once to complete MFA.

If users need to use multi-factor authentication (MFA) to log in to the application, they will be blocked instead while generating token with username password flow. Below is the sample Python code to use device code flow.

import adal authority_url = "https://login.microsoftonline.com/common" client_id = "appId" auth_context = adal.AuthenticationContext(authority_url) # Initiate device code flow device_code = auth_context.acquire_user_code("https://xxxx.xxxxx.xxx.dynamics.com/", client_id) print(device_code['message']) # Poll for token using device code token_response = auth_context.acquire_token_with_device_code("https://xxxx.xxxxx.xxx.dynamics.com/", device_code, client_id) access_token = token_response["accessToken"] print("Access token acquired successfully:", access_token)

I hope this is helpful! Do not hesitate to let me know if you have any other questions.
Venkat V 1,800 Reputation points Microsoft External Staff

2025-04-28T06:17:21.8233333+00:00

@Justin Tolchin

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Justin Tolchin 21 Reputation points

2025-04-28T16:44:27.43+00:00

Thank you for your comment. This is all through the portal. I authenticate using MFA to get into the portal. Then I can navigate around the subscription. However, once I get to a certain point in some areas, I get this challenge/error.
Justin Tolchin 21 Reputation points

2025-04-29T16:33:09.3433333+00:00

Error details

NetworkWatcher_eastus/PrivateDataSource-Dev-nsg-pds_rg-flowlog: Delete command failed with http error code: undefined

Accepted answer

1 additional answer

Your answer

Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-24T17:16:16.9633333+00:00

Hello Justin Tolchin

I understand that you are facing the issue while accessing resources in your Azure subscription, particularly when trying to delete an old network watcher.

Here are a few things you can try to resolve this issue:

Clearing cached cookies might help mitigate authentication loops, as they can sometimes conflict with authentication tokens.

Check if your organization has implemented conditional access policies that require additional authentication steps. Contact your Azure administrator to verify.

Ensure that your account has the necessary permissions to delete the network watcher. Depending on your role, you might need to verify your access level.

Try accessing the Azure portal from a different browser to see if the issue persists.

In the meantime, could you please provide the following information for further troubleshooting:

Are you the owner of the Azure subscription, or do you have limited permissions?

What type of authentication method are you using (e.g., MFA provider)? Ensure that you have completed the multi-factor authentication process successfully.

Have you noticed any patterns or specific actions that trigger the "Interaction Required" message?

Are there any recent changes in your Azure policies or configuration that you are aware of?

Verify that your account has the necessary permissions to delete the old watcher.

If possible, try accessing the resources from a different location or network to see if the issue persists.

Check the reference document for more understanding https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-create?tabs=portal

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Justin Tolchin 21 Reputation points

2025-04-24T20:49:34.22+00:00

Thank you for your reply.

I've tried incognito, clearing the cache, and using a different browser. All have the same result.

MFA has been enabled for us as well as our clients using the Microsoft Authenticator app.

I built the app and all related components, so as far as I know, I am an owner/admin.

I am no longer the owner of the subscription. I transferred it to the client.

This identity challenge comes up when I try to interact with something on the blade like deleting the Network Watcher or looking inside blob storage. I had no issues with storage when working through PowerShell script, nor did I have issues creating the new Network watcher as outlined in the linked article.
Venkat V 1,800 Reputation points Microsoft External Staff

2025-04-25T06:32:47.7166667+00:00

Hi@Justin Tolchin,

Can you please confirm how you're authenticating — either via code or the Azure portal? If you're using code, kindly share the full snippet for further clarification.

The above error usually occurs when you're trying to authenticate without completing the MFA process.

When I tried to authenticate using code without completing MFA, I encountered the same error as you.

If you're using code to authenticate, you'll need to switch to either the interactive flow or device code flow, both of which require the user to log in at least once to complete MFA.

If users need to use multi-factor authentication (MFA) to log in to the application, they will be blocked instead while generating token with username password flow. Below is the sample Python code to use device code flow.

import adal authority_url = "https://login.microsoftonline.com/common" client_id = "appId" auth_context = adal.AuthenticationContext(authority_url) # Initiate device code flow device_code = auth_context.acquire_user_code("https://xxxx.xxxxx.xxx.dynamics.com/", client_id) print(device_code['message']) # Poll for token using device code token_response = auth_context.acquire_token_with_device_code("https://xxxx.xxxxx.xxx.dynamics.com/", device_code, client_id) access_token = token_response["accessToken"] print("Access token acquired successfully:", access_token)

I hope this is helpful! Do not hesitate to let me know if you have any other questions.
Venkat V 1,800 Reputation points Microsoft External Staff

2025-04-28T06:17:21.8233333+00:00

@Justin Tolchin

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Justin Tolchin 21 Reputation points

2025-04-28T16:44:27.43+00:00

Thank you for your comment. This is all through the portal. I authenticate using MFA to get into the portal. Then I can navigate around the subscription. However, once I get to a certain point in some areas, I get this challenge/error.
Justin Tolchin 21 Reputation points

2025-04-29T16:33:09.3433333+00:00

Error details

NetworkWatcher_eastus/PrivateDataSource-Dev-nsg-pds_rg-flowlog: Delete command failed with http error code: undefined

Answer 1

Hi @Justin Tolchin

If you're facing issues in the portal, you can also try logging in using PowerShell or Azure CLI with the commands below.

Powershell

Connect-AzAccount -TenantId <Tenant ID> -SubscriptionId <> -UseDeviceAuthentication

Azure CLI

az login --tenant <myTenantID> --use-device-code
az account set --subscription "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

After logging in to the correct subscription and tenant, try deleting the Network Watcher flow log using the cmdlet below.

Remove-AzNetworkWatcherFlowLog -Name 'myVNetFlowLog' -Location 'eastus

Reference: Remove-AzNetworkWatcherFlowLog

If the above is unclear and/or you are unsure about something, add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

Justin Tolchin 21

The answer is: the portal is broken.

As of today, I am no longer getting the Interaction Required. I am getting failed to delete due to undefined error.

I was able to delete the flow log via CLI with help from Vallepu using:

Connect-AzAccount -TenantId xxxxxxxxxx -SubscriptionId xxxxxxxxxx -UseDeviceAuthentication

Remove-AzNetworkWatcherFlowLog -Name 'my-flowlog' -Location 'eastus'

Also, the other page, storage, is no longer challenging me either.

Share via

Cannot access resources in client subscription in certain blades

1 additional answer

Your answer