azure-tenant-isolation

Multi-Tenant Azure CLI & AZD Isolation

Run multiple az / azd workflows against different Azure tenants and subscriptions at the same time without crossing wires.

This skill ships two files only: this document and a JSON schema example. There are no wrapper scripts, no PowerShell modules, no helper functions. Every Azure operation in this skill is a literal az (or azd) CLI command. The only shell-specific bits are the unavoidable env-var one-liners (export VAR=… on Unix, $env:VAR=… on Windows).

---

Problem

az and azd keep session state (tokens, active subscription, environments) in a single shared directory (~/.azure and ~/.azd by default). When two terminals or scripts target different tenants concurrently they collide:

• az login --tenant X in terminal A overwrites the token used by terminal B.
• az account set -s <sub> mutates global state — every shell sees it.
• azd env select in one shell leaks into another.
• A subprocess that forgets AZURE_CONFIG_DIR silently hits the wrong tenant.

This is the #1 cause of "I deployed to the wrong subscription" incidents.

Concrete failure

Three concurrent shells targeting three different aliases — without isolation, terminal C's az account set silently rewrites the active subscription that terminal A is about to deploy with:

Terminal A (prod)         Terminal B (dev)          Terminal C (partner)
─────────────────         ─────────────────         ───────────────────
az login --tenant <prod>                            
                          az login --tenant <dev>   
                                                    az login --tenant <partner>
                                                    az account set -s partner-shared
az account show                                                               ← shows partner-shared (!!)
azd up                                                                         ← deploys prod env to partner sub