AZ CLI does not work with IPV6

[ThomasShih]

Describe the bug

az login --debug hangs on urllib3.connectionpool: Starting new HTTPS connection (1): login.microsoftonline.com:443 when I'm using ipv6.

Related command

az login --debug
az logout --debug
etc

Errors

No error, just silently hangs

Issue script & Debug output

Same as earlier issue #31221 (comment)

Expected behavior

AZ login does not hang

Environment Summary

azure-cli 2.77.0

core 2.77.0
telemetry 1.1.0

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.77.0/libexec/bin/python'
Config directory '/Users/tshih/.azure'
Extensions directory '/Users/tshih/.azure/cliextensions'

Python (Darwin) 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

I had to turn off IPV6 on my access point in order to authenticate. See #31221 (comment)

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az login stuck on connecting to login.microsoftonline.com:443 #28548
• az login hangs there forever on WSL #31221

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Disabling IPv6 has resolved the issue for several users. After disabling IPv6, az login worked again. For example, on macOS, you can use the following commands:

networksetup -listallnetworkservices
sudo networksetup -setv6off Wi-Fi

Reference:

• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login hangs there forever on WSL #31221 (comment)

Solution 2:

Changing the DNS server fixed the issue for some users. Options include using Cloudflare (1.1.1.1) or Google (8.8.8.8). You can test this with the following commands:

nslookup login.microsoftonline.com 1.1.1.1 # Cloudflare
nslookup login.microsoftonline.com 8.8.8.8 # Google

Reference:

• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)
• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)

Solution 3:

If disabling IPv6 entirely is not desirable, you can instruct glibc to prefer IPv4-mapped IPv6 addresses over native IPv6. On Linux, you can modify /etc/gai.conf by uncommenting the following line:

precedence ::ffff:0:0/96  100

Then restart NetworkManager.

Reference:

• az login stuck on connecting to login.microsoftonline.com:443 #28548 (comment)

Powered by issue-sentinel

[jiasli]

Azure CLI and its underlying Python HTTP requests library fully support IPv6.

It is very likely you will hit the same issue when you access login.microsoftonline.com directly:

python -c "import requests; print(requests.get('https://login.microsoftonline.com/').status_code)"
curl -I https://login.microsoftonline.com/

Please check the network connectivity to login.microsoftonline.com.

[ThomasShih]

Azure CLI and its underlying Python HTTP requests library fully support IPv6.

It is very likely you will hit the same issue when you access login.microsoftonline.com directly:

python -c "import requests; print(requests.get('https://login.microsoftonline.com/').status_code)"
curl -I https://login.microsoftonline.com/

Please check the network connectivity to login.microsoftonline.com.

That was one of the first things I tried actually, I didn't run the python bash cmd but here is the curl output:

curl -I https://login.microsoftonline.com/
HTTP/2 200 
cache-control: no-store, no-cache
pragma: no-cache
content-length: 21248
content-type: text/html; charset=utf-8
expires: -1
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
x-dns-prefetch-control: on
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: b9b6479c-f9fc-413e-8a33-c4ea0b0bc900
x-ms-ests-server: 2.1.21771.7 - NCUS ProdSlices
x-ms-srs: 1.P
content-security-policy-report-only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-T5XvfQoBKrEmhexFw8x9Tw' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
x-xss-protection: 0
set-cookie: fpc=AmgrxSynZB1ApBSAJMsWu2Y; expires=Fri, 10-Oct-2025 00:48:21 GMT; path=/; secure; HttpOnly; SameSite=None
set-cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEjVV70SuNPPEBhR0J6ZaAyINhXmKVxXVJB-pC3bpYdSceu6O3dJh1By1G1V4d8DPLMzvdt3J_UrSYryT9XAnBM5qahCXOIFYjzLyzp4IiFMf4jszKSFIVXu1FqwUvxxlraSjIdRfzb7cRywkMII66B4yWls5zWeLAEnZedRQk6_8gAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None
set-cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
set-cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
date: Wed, 10 Sep 2025 00:48:21 GMT

and just to prove az login is still broken:

 az login --debug
cli.knack.cli: Command arguments: ['login', '--debug']
...some stuff
urllib3.connectionpool: Starting new HTTPS connection (1): login.microsoftonline.com:443

PS: I did remember to turn ipv6 back on for this