Merge pull request #10498 from ryanberg-aquent/CI-8945

AB#8945: [AKS] Create new TSG - Unable to connect with the Fleet Manager

Author: ryanberg-aquent

support/azure/kubernetes-fleet/toc.yml

@@ -1,5 +1,9 @@
+items:
 - name: Welcome
   href: welcome-azure-kubernetes-fleet.yml
+- name: Unable to connect to Azure Fleet Manager
+  href: unable-connect-azure-fleet-manager.md
+- name: Cluster Resource Placement
 
 - name: Resource Placement
   items:

support/azure/kubernetes-fleet/unable-connect-azure-fleet-manager.md

@@ -0,0 +1,50 @@
+---
+title: Can't connect to Azure Fleet Manager
+description: This article provides guidance for actions to take when you can't connect to Azure Fleet Manager.
+ms.date: 01/13/2026
+ms.author: jarrettr
+ms.reviewer: chiragpa, v-ryanberg 
+ms.service: azure-kubernetes-fleet-manager
+ms.custom: sap:Other issue or questions related to Fleet manager
+---
+# Unable to connect to Azure Fleet Manager
+
+This article helps you resolve an issue that prevents you from connecting to Azure Fleet Manager.
+
+## Symptoms
+
+You try to connect to Azure Fleet Manager by retrieving the kubeconfig file for the Fleet Manager hub cluster. You initially run the following command: 
+
+```powershell
+az fleet get-credentials --resource-group \${GROUP} --name
+```
+
+Then, you run the following command:
+
+```powershell
+kubectl get pods
+```
+
+On the Fleet Manager API server, you're prompted to enter a device code in another browser to authenticate your identity.
+
+If your organization enforces Conditional Access policies that block device code flows, you might receive a message that resembles the following message:
+
+> Your sign-in was successful but does not meet the criteria to access this resource. For example, you might be signing in from a browser, app, location, or an authentication flow that is restricted by your admin.
+
+The following screenshot shows an example of this kind of message.
+
+:::image type="content" source="../media/unable-connect-azure-fleet-manager/no-access-message.png" alt-text="Example of Conditional Access blocking device code flow." lightbox="../media/unable-connect-azure-fleet-manager/no-access-message.png":::
+
+## Cause
+
+The kubeconfig file that's generated by the `az fleet get-credentials` command defaults to device code authentication. Conditional Access policies can block this flow and prevent access to the Fleet Manager API server.
+
+## Resolution
+
+To resolve this issue, modify kubeconfig to use Azure CLI authentication instead of device code authentication. To make this change, run the following command:
+
+```powershell
+kubelogin convert-kubeconfig -l azurecli
+```
+
+This command updates the kubeconfig file so that it authenticates by using your existing Azure CLI sign-in session. This action bypasses the device code prompt.