Unable to connect Foundry from VS Code

[nvdpathward]

Does this occur consistently?
Repro steps:

Action: o.listHostedAgentsDetailed
Error type: Error
Error Message: Failed to list hosted agents for project proj-sysadmin-ai-agent: You are not signed in to an Azure account. Please sign in.

Version: 1.6.2
OS: win32
OS Arch: x64
OS Release: 10.0.20348
Product: Visual Studio Code
Product Version: 1.127.0
Language: en
UTC time: Mon, 06 Jul 2026 04:48:32 GMT

Call Stack

M.listHostedAgents extension.js:8:228301
extension.js:8:1444931extension.js:8:1444931
async t.callWithTelemetryAndErrorHandling extension.js:2:3034547
extension.js:8:1444732extension.js:8:1444732

[microsoft-github-policy-service]

Thank you for contacting us! Any issue or feedback from you is quite important to us. We will do our best to fully respond to your issue as soon as possible. Sometimes additional investigations may be needed, we will usually get back to you within 2 days by adding comments to this issue. Please stay tuned.

[Tajjun]

Same problem

[nvdpathward]

this issue permeant i am unable to connect it

We are experiencing a consistent issue with the Foundry Toolkit for VS Code (version 1.6.2) on a specific workstation running Windows Server 2022 (10.0.20348). The Azure AI Foundry project proj-sysadmin-ai-agent is successfully discovered and displayed within the Foundry Toolkit, confirming that the extension can connect to Azure and retrieve project information. However, when the extension attempts to load Hosted Agents or Prompt Agents, it fails with the error: "Failed to list hosted agents for project proj-sysadmin-ai-agent: You are not signed in to an Azure account. Please sign in."
We have verified that Azure authentication is functioning correctly. The user can successfully sign in to Azure Portal, Azure AI Foundry Portal (https://ai.azure.com), and Azure CLI (az login). The correct tenant and subscription (Application Operations) are selected, and the project is fully accessible through the Azure AI Foundry web portal. In addition, the Foundry Toolkit is able to discover and display the project under My Resources, which indicates that basic Azure connectivity and resource discovery are working.
As part of troubleshooting, we tested the exact same Azure account, tenant, subscription, and AI Foundry project on a different workstation. On the second machine, Foundry Toolkit connects successfully and loads agents without any issues. This suggests the problem is isolated to the affected workstation or its local VS Code/Foundry Toolkit authentication state rather than an Azure configuration, permission, subscription, or project issue.
The Foundry Toolkit logs consistently show the following sequence: the extension successfully begins the operation "Listing hosted agents for project: proj-sysadmin-ai-agent", but immediately fails with "You are not signed in to an Azure account. Please sign in." The issue occurs every time Hosted Agents or Prompt Agents are accessed. Since project discovery succeeds while agent enumeration fails, it appears that the extension may be encountering a problem obtaining or using an Azure authentication token specifically for the Hosted Agent APIs. We would appreciate assistance in determining whether this is related to Foundry Toolkit authentication, VS Code authentication providers, Windows Account Manager (WAM), Azure Account extension integration, token cache corruption, or another known issue affecting agent-related API calls.

[hund030]

Hi @nvdpathward , @Tajjun , this issue is usually caused by VS Code authentication providers. Could you please share the logs in Microsoft Authentication channel in VS Code when the error occurs?

[nvdpathward]

The latest Microsoft Authentication logs continue to show authentication failures before the request reaches Foundry Toolkit. Token acquisition for https://ai.azure.com/.default returns 0 session(s) and fails with AADSTS70043, indicating that the refresh token has expired due to Conditional Access sign-in frequency policies. The affected machine is a Windows Server 2022 Terminal Server accessed through RDP and is not Entra joined (AzureAdJoined:NO, AzureAdPrt:NO, WamDefaultSet:NO). The same user account successfully authenticates and accesses the same Foundry project from a different workstation. This suggests the issue is related to token acquisition through the VS Code Microsoft Authentication Provider/WAM on the terminal server rather than Azure AI Foundry permissions or project configuration. Does Foundry Toolkit currently support authentication through Azure CLI credentials when WAM/PRT is unavailable on Windows Server Terminal Servers, or is WAM-based authentication required? az login -> Works Portal -> Works Foundry -> Fails Below is the log 2026-07-07 23:45:49.684 [info] [getSessions] [VSCODE_TENANT:38821221-2b65-4519-9c7c-8f220162ab8e https://management.azure.com/.default] returned 0 session(s) 2026-07-07 23:45:54.411 [info] [getSessions] [VSCODE_TENANT:38821221-2b65-4519-9c7c-8f220162ab8e https://ai.azure.com/.default] starting 2026-07-07 23:45:54.420 [warning] [Wed, 08 Jul 2026 04:45:54 GMT] : [] : @***@***.*** : Warning - [MSAL:0001] WARNING TryEnqueueMsaDeviceCredentialAcquisitionAndContinue:1092 MsaDeviceOperationProvider is not available. Not attempting to register the device. 2026-07-07 23:45:54.425 [warning] [Wed, 08 Jul 2026 04:45:54 GMT] : [] : @***@***.*** : Warning - [MSAL:0002] WARNING DiscardAccessAndIdTokensIfUnusable:855 No access token found in the cache 2026-07-07 23:45:54.431 [warning] [Wed, 08 Jul 2026 04:45:54 GMT] : [] : @***@***.*** : Warning - [MSAL:0002] WARNING GetPlatformPropertiesFromStorage:2082 No account found in cache. 2026-07-07 23:45:54.463 [error] [Wed, 08 Jul 2026 04:45:54 GMT] : [] : @***@***.*** : Error - [MSAL:0002] ERROR ErrorInternalImpl:134 Created an error: 7rhai, StatusInternal::InteractionRequired, InternalEvent::None, Error Code 3399614467, Context 'SubError: token_expired V2Error: invalid_grant AADSTS70043: The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on 2026-06-26T13:11:41.7352552Z and the maximum allowed lifetime for this request is 259200. Trace ID: 8034eb91-f437-48d2-90aa-d02aa46f8b00 Correlation ID: c42935c8-a940-4d1b-8d0f-b70d49e71869 Timestamp: 2026-07-08 04:45:40Z' 2026-07-07 23:45:54.464 [info] [getAllSessionsForPca] [VSCODE_TENANT:38821221-2b65-4519-9c7c-8f220162ab8e https://ai.azure.com/.default] ***@***.*** failed to acquire token silently, skipping account {"errorCode":"interaction_required","errorMessage":"InteractionRequired: SubError: token_expired V2Error: invalid_grant AADSTS70043: The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on 2026-06-26T13:11:41.7352552Z and the maximum allowed lifetime for this request is 259200. Trace ID: 8034eb91-f437-48d2-90aa-d02aa46f8b00 Correlation ID: c42935c8-a940-4d1b-8d0f-b70d49e71869 Timestamp: 2026-07-08 04:45:40Z (Error Code: 3399614467, Tag: 7rhai)","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"","claims":"","platformBrokerError":{"errorCode":"InteractionRequired","errorMessage":"SubError: token_expired V2Error: invalid_grant AADSTS70043: The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on 2026-06-26T13:11:41.7352552Z and the maximum allowed lifetime for this request is 259200. Trace ID: 8034eb91-f437-48d2-90aa-d02aa46f8b00 Correlation ID: c42935c8-a940-4d1b-8d0f-b70d49e71869 Timestamp: 2026-07-08 04:45:40Z (Error Code: 3399614467, Tag: 7rhai)","subError":"","name":"PlatformBrokerError","statusCode":3399614467,"tag":"7rhai"}} 2026-07-07 23:45:54.464 [info] [getSessions] [VSCODE_TENANT:38821221-2b65-4519-9c7c-8f220162ab8e https://ai.azure.com/.default] returned 0 session(s) Regards, Nataraj V D Systems Administrator

…

________________________________ From: Zhijie Huang ***@***.***> Sent: Wednesday, July 8, 2026 8:58 AM To: microsoft/foundry-toolkit ***@***.***> Cc: Nataraj VD ***@***.***>; Mention ***@***.***> Subject: Re: [microsoft/foundry-toolkit] Unable to connect Foundry from VS Code (Issue #513) You don't often get email from ***@***.*** Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. [https://avatars.githubusercontent.com/u/26134943?s=20&v=4]hund030 left a comment (microsoft/foundry-toolkit#513)<#513 (comment)> Hi @nvdpathward<https://github.com/nvdpathward> , @Tajjun<https://github.com/Tajjun> , this issue is usually caused by VS Code authentication providers. Could you please share the logs in Microsoft Authentication channel in VS Code when the error occurs? image.png (view on web)<https://github.com/user-attachments/assets/1308041a-c326-483a-8f57-33c0790520c0> — Reply to this email directly, view it on GitHub<#513?email_source=notifications&email_token=CFUOUX7657G4L3QQ6ZJPD2D5DW5VZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOJRGEYTANZRGEY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4911107111>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/CFUOUX32RSQJOXZ22TSBLPD5DW5VZAVCNFSNUABFKJSXA33TNF2G64TZHM3TEOJTGAZDKOBYHNEXG43VMU5TIOBRGYZDANBTGEYKC5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/CFUOUX6KQVV6FPLPHFRTWW35DW5VZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOJRGEYTANZRGEY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android<https://github.com/notifications/mobile/android/CFUOUXZK64FNLJSJTJTXTV35DW5VZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOJRGEYTANZRGEY2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[Tajjun]

@hund030

I've refreshed my token, signed in:

failed to acquire token silently, skipping account {"errorCode":"interaction_required","errorMessage":"InteractionRequired: SubError: basic_action V2Error: invalid_grant AADSTS50078: Presented multi-factor authentication has expired due to policies configured by your administrator, you must refresh your multi-factor authentication to access 'xxx'. Trace ID: xxx Correlation ID:xxx Timestamp: 2026-07-08 13:11:28Z (Error Code: 3399614476, Tag: 7q6cn)","subError":"","name":"InteractionRequiredAuthError","timestamp":"","traceId":"","correlationId":"","claims":"","platformBrokerError":{"errorCode":"InteractionRequired","errorMessage":"SubError: basic_action V2Error: invalid_grant AADSTS50078: Presented multi-factor authentication has expired due to policies configured by your administrator, you must refresh your multi-factor authentication to access 'xxx'. Trace ID: xxx Correlation ID: xxx Timestamp: 2026-07-08 13:11:28Z (Error Code: 3399614476, Tag: 7q6cn)","subError":"","name":"PlatformBrokerError","statusCode":3399614476,"tag":"7q6cn"}}
2026-07-08 15:13:17.103 [info] [getSessions] [VSCODE_TENANT:xxx https://ai.azure.com/.default] returned 0 session(s)

I can see the foundry resource under the azure resources extension:

[hund030]

Hi @nvdpathward and @Tajjun , thanks for your information. Could you try the following workarounds?

1. sign out
   Accounts icon (bottom-left gear/person) → your Microsoft account → Sign Out.
2. Force the auth flow to use the browser or device-code, not the broker
   In Settings (Ctrl + ,), search and set microsoft-authentication.implementation to msal-no-broker
3. Trigger a fresh interactive sign-in
4. Verify and review the log of "Microsoft Authentication"

Here is more information about this issue

1. Confirms the root cause from AADSTS70043 / AADSTS50078 logs. Both are interaction_required errors — meaning the token can't be refreshed silently; the user must interactively re-authenticate.
2. Why project discovery works but agents/models fail?
   Resource/project discovery goes through the Azure Resources extension (ARM), which already had/handled its own token. While agent enumeration requests a different resource scope that specifically hit the CA/MFA re-auth wall.
3. Does Foundry Toolkit currently support authentication through Azure CLI credentials?
   No — it does not use Azure CLI credentials.