How to fix Error building AzureRM Client: obtain subscription from Azure CLI in Terraform

TerraformINTERMEDIATEMEDIUMUpdated Dec 30, 2025· 116 views

This error occurs when Terraform cannot authenticate to Azure because the AzureRM provider cannot determine which subscription to use. It typically happens when running Terraform in CI/CD pipelines or when the Azure CLI authentication is not properly configured.

Quick fix

Fixes Error building AzureRM Client: obtain subscription from Azure CLI

az version
az account show
  1. Verify Azure CLI is installed and authenticated
  2. Explicitly specify subscription_id in provider block
  3. Use environment variables for subscription configuration
  4. For GitHub Actions: Use OIDC authentication (recommended)
terraform — error
az version
az account show
Error building AzureRM Client: obtain subscription from Azure CLI

What this error means

The AzureRM provider requires a valid Azure subscription ID to initialize. When Terraform runs, it attempts to obtain subscription information from the Azure CLI, but the CLI either isn't authenticated, doesn't have an active subscription set, or the environment variables aren't being passed correctly to the Terraform runtime. This is especially common in GitHub Actions, Azure DevOps, or Terraform Cloud where the execution environment is isolated.

Typical symptoms

  • Error message: "Error building AzureRM Client: obtain subscription from Azure CLI: parsing json result from the Azure CLI"
  • Error: "ERROR: Please run 'az login' to setup account"
  • Terraform plan/apply fails immediately without creating resources
  • Works locally with `az login` but fails in CI/CD pipelines
  • Error occurs even after running `az login` in the pipeline

Common causes

  1. Azure CLI is not authenticated (missing `az login` or token expiration)
  2. Subscription ID is not explicitly specified in the Terraform provider block or via ARM_SUBSCRIPTION_ID environment variable
  3. Azure authentication context is not passed from GitHub Actions to Terraform Cloud (Remote execution mode)
  4. Service Principal authentication is used but not properly configured for non-interactive login
  5. Running on Terraform Cloud which executes remotely and doesn't inherit local environment variables

How to fix "Error building AzureRM Client: obtain subscription from Azure CLI"

1Verify Azure CLI is installed and authenticated

First, ensure the Azure CLI is installed and you're authenticated:

bash
az version
az account show

If you're not logged in, run:

bash
az login

This will open a browser to authenticate. After successful login, verify the correct subscription is set:

bash
az account list
az account set --subscription="<subscription-id>"
2Explicitly specify subscription_id in provider block

Update your Terraform configuration to explicitly include the subscription_id. This is the most reliable fix:

hcl
provider "azurerm" {
  features {}
  subscription_id = "<your-subscription-id>"
}

You can find your subscription ID by running:

bash
az account show --query id -o tsv
3Use environment variables for subscription configuration

Instead of hardcoding, use environment variables which is more secure for CI/CD:

hcl
provider "azurerm" {
  features {}
}

Then set in your shell or CI/CD pipeline:

bash
export ARM_SUBSCRIPTION_ID="<your-subscription-id>"

Or in GitHub Actions:

yaml
env:
  ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
4For GitHub Actions: Use OIDC authentication (recommended)

Modern best practice is to use OpenID Connect (OIDC) instead of storing credentials:

yaml
- name: Azure Login
  uses: azure/login@v1
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
    auth-type: SERVICE_PRINCIPAL

Then in your Terraform provider block:

hcl
provider "azurerm" {
  features {}
  use_oidc = true
}
5For Terraform Cloud: Enable local execution or configure backend

If using Terraform Cloud with remote execution, environment variables won't pass through. Either:

Option A: Change to local execution in your workspace settings.

Option B: Configure the AzureRM backend with explicit credentials:

hcl
terraform {
  backend "azurerm" {
    resource_group_name  = "my-rg"
    storage_account_name = "mystorageacct"
    container_name       = "tfstate"
    key                  = "prod.terraform.tfstate"
  }
}

Then set Azure credentials as Terraform variables in the workspace.

Advanced notes

Why explicit subscription_id matters: Recent versions of the AzureRM provider (v3.41.0+) made subscription_id mandatory for security and clarity. Previously, the provider would implicitly use the currently selected Azure CLI subscription, but this was ambiguous in CI/CD environments.

For Service Principals in CI/CD: Service Principal authentication via Azure CLI is not supported directly. Instead, use environment variables (ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID) or OIDC authentication. OIDC is preferred because it doesn't require storing long-lived credentials.

Rootless/Multi-tenant scenarios: If working with multiple Azure tenants, ensure you're authenticating to the correct tenant before setting the subscription. Use az login --tenant <tenant-id> if needed.

Frequently asked questions

What does "Error building AzureRM Client: obtain subscription from Azure CLI" mean?
The AzureRM provider requires a valid Azure subscription ID to initialize. When Terraform runs, it attempts to obtain subscription information from the Azure CLI, but the CLI either isn't authenticated, doesn't have an active subscription set, or the environment variables aren't being passed correctly to the Terraform runtime. This is especially common in GitHub Actions, Azure DevOps, or Terraform Cloud where the execution environment is isolated.
How do I fix "Error building AzureRM Client: obtain subscription from Azure CLI"?
This error occurs when Terraform cannot authenticate to Azure because the AzureRM provider cannot determine which subscription to use. It typically happens when running Terraform in CI/CD pipelines or when the Azure CLI authentication is not properly configured.
What causes "Error building AzureRM Client: obtain subscription from Azure CLI"?
Azure CLI is not authenticated (missing az login or token expiration) Subscription ID is not explicitly specified in the Terraform provider block or via ARM_SUBSCRIPTION_ID environment variable Azure authentication context is not passed from GitHub Actions to Terraform Cloud (Remote execution mode)
Is the "Error building AzureRM Client: obtain subscription from Azure CLI" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading