AZURE_STORAGE_SERVICE_ENDPOINT ignored by az storage blob list

[markgsaye]

Describe the bug

az storage blob list does not use the documented AZURE_STORAGE_SERVICE_ENDPOINT environment variable when no --blob-endpoint argument is supplied.

This is particularly problematic when using Azurite, where the storage account does not exist on the public Azure endpoint.

Related command
az storage blob list

Environment:

AZURE_STORAGE_ACCOUNT=devstoreaccount1
AZURE_STORAGE_KEY=<standard Azurite key>
AZURE_STORAGE_SERVICE_ENDPOINT=http://localhost:10000/devstoreaccount1

Command:
az storage blob list --container-name container1 --auth-mode key

Expected:
Request goes to http://localhost:10000/devstoreaccount1/container1

Actual:
Request goes to https://devstoreaccount1.blob.core.windows.net/container1

Workaround:

az storage blob list \
  --container-name container1 \
  --auth-mode key \
  --blob-endpoint "$AZURE_STORAGE_SERVICE_ENDPOINT"

Related command

az storage blob list --container-name container1 --auth-mode key

Errors

Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account.

Issue script & Debug output

> az storage blob list --container-name container1 --output table --debug
cli.knack.cli: Command arguments: ['storage', 'blob', 'list', '--container-name', 'container1', '--output', 'table', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x75e26a812da0>, <function OutputProducer.on_global_arguments at 0x75e26a7380f0>, <function CLIQuery.on_global_arguments at 0x75e26a50e820>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Using packaged command index for profile 'latest'.
cli.azure.cli.core: Modules found from index for 'storage': ['azure.cli.command_modules.storage']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: storage                   0.108        63       281
cli.azure.cli.core: Loaded command modules:
cli.azure.cli.core: Total (1)                 0.108        63       281
cli.azure.cli.core: Loaded 63 groups, 281 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : storage blob list
cli.azure.cli.core: Command table: storage blob list
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x75e26a4d01a0>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/user/.azure/commands/2026-10-01.11-58-54.storage_blob_list.4739.log'.
az_command_data_logger: command args: storage blob list --container-name {} --output {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x75e26a29da60>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x75e26a29db10>, <function register_global_policy_argument.<locals>.add_global_policy_argument at 0x75e26a2b8d50>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x75e26a2b8e00>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x75e26a2b8eb0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x75e26a7381a0>, <function CLIQuery.handle_query_parameter at 0x75e26a50e8d0>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x75e26a2b8ca0>]
cli.azure.cli.command_modules.storage._validators: Try to get storage auth_mode value from environment variables or config file.
cli.azure.cli.command_modules.storage._validators: Try to get storage account value from environment variables or config file.
cli.azure.cli.command_modules.storage._validators: Try to get storage account_url value from environment variables or config file.
cli.azure.cli.command_modules.storage._validators: Try to get storage connection_string value from environment variables or config file.
cli.azure.cli.command_modules.storage._validators: Try to get storage key value from environment variables or config file.
cli.azure.cli.command_modules.storage._validators: Try to get storage sas_token value from environment variables or config file.
urllib3.connectionpool: Starting new HTTPS connection (1): devstoreaccount1.blob.core.windows.net:443
urllib3.connectionpool: https://devstoreaccount1.blob.core.windows.net:443 "GET /container1?restype=container&comp=list&maxresults=5000 HTTP/1.1" 403 761
cli.azure.cli.core.azclierror: Traceback (most recent call last):
  File "/opt/az/lib/python3.14/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/__init__.py", line 677, in execute
    raise ex
  File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/__init__.py", line 820, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/__init__.py", line 812, in _run_job
    return cmd_copy.exception_handler(ex)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/cli/command_modules/storage/__init__.py", line 357, in new_handler
    first(ex)
    ~~~~~^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/cli/command_modules/storage/__init__.py", line 356, in new_handler
    raise ex
  File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/__init__.py", line 789, in _run_job
    result = cmd_copy(params)
  File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/__init__.py", line 335, in __call__
    return self.handler(*args, **kwargs)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
    return op(**command_args)
  File "/opt/az/lib/python3.14/site-packages/azure/cli/command_modules/storage/operations/blob.py", line 202, in list_blobs
    result = list_generator(pages=pages, num_results=num_results)
  File "/opt/az/lib/python3.14/site-packages/azure/cli/command_modules/storage/track2_util.py", line 74, in list_generator
    page = list(next(pages))
                ~~~~^^^^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/core/paging.py", line 82, in __next__
    self._response = self._get_next(self.continuation_token)
                     ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/storage/blob/_list_blobs_helper.py", line 96, in _get_next_cb
    process_storage_error(error)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^
  File "/opt/az/lib/python3.14/site-packages/azure/storage/blob/_shared/response_handlers.py", line 195, in process_storage_error
    exec("raise error from None")  # pylint: disable=exec-used # nosec
    ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<string>", line 1, in <module>
azure.core.exceptions.ClientAuthenticationError:
Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account.

Content: <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:9c27a114-701e-004b-1293-51d112000000
Time:2026-10-01T10:58:55.6240841Z</Message><AuthenticationErrorDetail>The MAC signature found in the HTTP request 'MVoVtjoHXQoDSOFjtht9q1e6UdXymiRJrdunzxRIjMA=' is not the same as any computed signature. Server used following string to sign: 'GET











x-ms-client-request-id:1839d776-bd87-11f1-9176-00155d613413
x-ms-date:Thu, 01 Oct 2026 10:58:54 GMT
x-ms-version:2026-04-06
/devstoreaccount1/container1
comp:list
maxresults:5000
restype:container'.</AuthenticationErrorDetail></Error>

cli.azure.cli.core.azclierror:
Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account.

az_command_data_logger:
Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account.

cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x75e26a4d0460>]
az_command_data_logger: exit code: 1
cli.__main__: Command ran in 1.301 seconds (init: 0.110, invoke: 1.191)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4052 in cache file under /home/user/.azure/telemetry/20261001115855846
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/opt/az/bin/python3 /opt/az/lib/python3.14/site-packages/azure/cli/telemetry/__init__.py /home/user/.azure /home/user/.azure/telemetry/20261001115855846"
telemetry.process: Return from creating process 4758
telemetry.main: Finish creating telemetry upload process.

Expected behavior

Request goes to http://localhost:10000/devstoreaccount1/container1

Environment Summary

azure-cli 2.90.0

core 2.90.0
telemetry 1.1.0

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python location '/opt/az/bin/python3'
Config directory '/home/user/.azure'
Extensions directory '/home/user/.azure/cliextensions'

Python (Linux) 3.14.6 (main, Aug 26 2026, 01:26:36) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[x-engineering-agent]

Bug Analysis

Affected module: storage in Azure/azure-cli, target branch dev.

The report supplies a reproducible command, endpoint configuration, expected request destination, actual public-cloud destination, and an explicit --blob-endpoint workaround. No additional requirements are needed before investigating the fix.

Reported behavior: az storage blob list --container-name container1 --auth-mode key ignores AZURE_STORAGE_SERVICE_ENDPOINT and sends the request to the default public blob endpoint. The required behavior is to use the configured service endpoint, including an emulator's account-name path segment, when no explicit endpoint is supplied. The reproduction was not executed during triage.

Current source evidence (base da4c0548a2725ea3d08b1d94b8e7fa1b0b07256e):

• StorageCommandGroup._register_data_plane_account_arguments registers --blob-endpoint as account_url and explicitly documents AZURE_STORAGE_SERVICE_ENDPOINT.
• validate_client_parameters instead requests the storage.account_url config key. Both endpoint-fallback blocks are nested under a missing account name, so explicit account names can also prevent endpoint lookup. Verify the CLI config mapping while correcting the documented environment-variable path.
• cf_blob_service uses a connection string first; otherwise an absent account_url falls back to the cloud's default blob endpoint. This explains why a missing endpoint reaches the public service. These are handwritten data-plane helpers, not a request to patch generated AAZ output.

Requirements for the fix:

• Honor the documented service-endpoint environment variable through the established configuration mechanism, independently of whether the account name comes from an argument or the environment.
• Preserve explicit endpoint arguments, existing connection-string precedence, legacy account-URL/config behavior, cloud suffixes, credentials and unrelated storage commands. Define and cover precedence when multiple endpoint sources are present; do not silently replace existing supported configuration.
• Keep URL scheme, host, port and path-style account segment intact. Do not append a second account-name segment or send a configured local endpoint request to the public service.
• Add focused cases in src/azure-cli/azure/cli/command_modules/storage/tests/latest/test_storage_validators.py covering environment endpoint resolution, explicit account-name input, explicit endpoint precedence, legacy configuration, and the unset-endpoint fallback.
• Extend src/azure-cli/azure/cli/command_modules/storage/tests/latest/test_storage_blob_scenarios.py or an existing supported request/transport fixture to exercise the complete blob-list path. Assert the actual outgoing endpoint/container path and returned blob-list result, including path-style emulator behavior; a config-mapping-only test is insufficient. Do not introduce a live-test dependency on an emulator that the workflow does not provision. Keep recordings sanitized and tests re-recordable.
• In the isolated implementation job, run the repository's focused existing validation for the changed validator and blob-list tests. Live service validation, if requested later, is owned by the governed Tester workflow; triage does not run it.

Mandatory Codegen execution protocol

Before editing implementation files, determine whether the affected storage command is AAZ-generated. Files under aaz/<profile>/ are generated output and must never be patched directly, including by an AI agent. Check out Azure/aaz beside Azure/azure-rest-api-specs, Azure/aaz-dev-tools, and the downstream repository. API-schema defects start in the specification; command naming, grouping, arguments, API-version selection, help, and examples belong in the durable Azure/aaz command model; non-modelable client behavior belongs in a handwritten subclass or wrapper in custom.py, registered from commands.py. X Engineering Agent creates and promotes the corresponding durable Azure/aaz source pull request before it promotes downstream generated output.

Follow the Azure CLI repository's Codegen workflow and the aaz-dev setup documentation. Set up the checked-out repositories with azdev setup. Use generate only when importing or redesigning command models from Swagger/TypeSpec. For an existing module whose durable Azure/aaz model has been updated, render that model with regenerate:

aaz-dev cli regenerate --name storage --cli-path <azure-cli>

# New/imported command model only:
aaz-dev cli generate --spec <specification-name> --module storage

You MUST actually run the generator; do not merely describe it or imitate its output. If the AAZ/specification checkout, local source change, credentials, or generator is unavailable, stop and report the blocker instead of editing generated files. Inspect _aaz_info provenance and the complete regenerated diff, then run focused azdev style, azdev linter, and azdev test validation. For an extension, also update its version and HISTORY.rst, preserve azext_metadata.json compatibility, and let release automation update src/index.json.

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Use this EXACT PR title (copy verbatim, do not reword):

[Storage] Fix #34155: `az storage blob list`: Honor the configured storage service endpoint

Keep the backticks around the command and the Fix #34155: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Storage] prefix, issue link, and backticked command must stay.

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #34155.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Storage] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

Posted by x-engineering-agent (Fixer)