Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Use az login --use-device-code when a Linux server has no browser. Open https://aka.ms/devicelogin on an approved browser, enter the code printed by Azure CLI, and complete MFA or Conditional Access there. For browser-based tasks, launch Chrome through Playwright CLI; headless mode changes how Chrome displays pages, not which Entra policies apply. Use a persistent profile only when your organization allows credential-bearing browser state on that host. Production jobs should use a service principal, managed identity, or another supported workload identity instead of a human sign-in.
Choose the authentication path first
The right method depends on five facts: whether the machine has a graphical browser, whether a person must complete MFA, whether the Linux device is managed and broker-enabled, whether browser state must survive restarts, and whether the job is interactive or unattended.
| Situation | Recommended path | Why |
|---|---|---|
| Terminal-only server, a person can approve sign-in | az login --use-device-code |
Works without opening a browser on the server; the user completes sign-in elsewhere. |
| Managed Linux desktop with Microsoft Identity Broker | Normal az login with brokered SSO, when your tenant and distribution support it |
The broker can provide Linux SSO and keeps refresh-token protection in the user’s keyring. |
| Repeatable browser interaction that needs cookies | Playwright CLI with a dedicated persistent profile | Cookies and storage can survive calls, but the profile is a secret-bearing artifact. |
| Unattended production automation | Service principal, managed identity, or another workload identity | Microsoft recommends workload identities instead of user credentials for production jobs. |
Azure CLI 2.61.0 and later use browser-based sign-in by default on Linux and macOS. Microsoft’s September 2025 MFA requirement applies to Entra user identities used by Azure CLI and other command-line tools; service principals and managed identities are not affected by that user-MFA requirement.
Install and verify Azure CLI on Linux
- Install Azure CLI by following Microsoft’s package instructions for your Linux distribution. Use the vendor package rather than copying an existing user’s token directory.
- Check the installed version and that the executable is on your path:
az version - If the version is older than 2.61.0, upgrade before diagnosing browser-login behavior. Older releases can have different defaults.
Keep the first login interactive. It establishes the account and tenant context that later commands will use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
Log in from a terminal-only host with device code
- Start the flow on the Linux host:
az login --use-device-code - Azure CLI prints a short code and a verification address. On an approved computer or phone, open https://aka.ms/devicelogin.
- Enter the code exactly as displayed, select the requested account or tenant, and complete MFA, federation, and Conditional Access prompts in that browser.
- Return to the terminal. A successful login returns account and subscription information. Confirm the active context:
az account show - If you can access more than one subscription, list them and select the one required by the job:
az account list az account set --subscription "SUBSCRIPTION_NAME_OR_ID" az account show
Device code is a user-driven flow, not a way to bypass policy. A tenant can require MFA, a compliant device, a particular network, or another Conditional Access control. The browser used to redeem the code must satisfy those controls.
What headless Chrome changes—and what it does not
Headless Chrome runs without drawing a visible window. It does not disable Entra checks. MFA, Conditional Access, device-compliance requirements, broker requirements, and identity-provider federation still apply. Microsoft does not guarantee that every tenant policy will permit a headless Chrome session, so validate the exact tenant and account combination.
For browser automation, Playwright CLI runs headless by default. Select Chrome explicitly:
playwright-cli open --browser=chrome https://your-app.exampleUse --headed while diagnosing a first-run sign-in or a redirect that is difficult to observe:
playwright-cli open --headed --browser=chrome https://your-app.exampleOnce the flow is understood, remove --headed for repeatable terminal execution. A headless run still needs an identity that can satisfy the site’s Entra policy; it cannot manufacture an MFA approval or a compliant-device signal.
Preserve browser state only with explicit controls
Playwright keeps its browser profile in memory by default. Cookies and storage state survive between calls in the same session, then disappear when the browser closes. If a workflow genuinely needs state across launches, use a persistent session:
playwright-cli open --persistent --browser=chrome https://your-app.exampleUse a dedicated profile for the automation, restrict its filesystem permissions to the service account, and ensure the account’s keyring is available if the organization requires it. Treat the profile like a password because it may contain Entra cookies, refresh-related state, and application data. Do not copy token databases or cookies between machines, and do not check a profile into source control.
Run an initial setup in headed mode only on an approved workstation or controlled host. After sign-in, close the browser cleanly and test a new headless launch with the same permitted profile. A profile can expire or be invalidated by sign-in-frequency controls, password changes, account risk, or Conditional Access changes; it is not a permanent login.
Linux Identity Broker and PRT considerations
Microsoft Single Sign-on (SSO) for Linux is powered by the Microsoft Identity Broker. Microsoft states that Linux supports both unregistered PRTs for Microsoft Edge and registered PRTs when the broker is present. On Linux, the broker returns an access token to the calling application and stores refresh tokens locally; those refresh tokens are encrypted with a key held in the UNIX user’s sign-in keyring.
This matters mainly on a supported, managed Linux desktop. A minimal server normally has no broker, desktop sign-in session, or usable keyring, so device code is the practical interactive fallback. A Primary Refresh Token (PRT) is valid for 90 days and is continuously renewed while the user actively uses the device; tenant session-frequency controls can still force reauthentication sooner. A PRT is not a reason to move a desktop token store onto a server.
When to replace user sign-in with workload identity
Do not build a production scheduler around a person’s device-code session or a copied Chrome profile. Use a service principal, managed identity, or another supported workload identity when the process must run without a person present, restart after a reboot, or operate under a least-privilege policy. Grant only the resource permissions the job needs, rotate secrets or certificates under your organization’s process, and keep the identity separate from administrator accounts.
User sign-in remains appropriate for an operator running an occasional command, investigating a deployment, or approving a one-time interactive task. The distinction is operational: someone is available to complete MFA and respond when policy changes.
Recommended Free Tools
Or skip the browser setup
If your goal is to capture a page for documentation or a visual check rather than to automate an Entra sign-in, ScreenshotNeo provides a single screenshot request. It is useful after you have an authorized, publicly reachable page; it is not a replacement for Entra authentication or MFA.
The API removes cookie/consent banners, newsletter popups, and chat widgets before capture. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and the response identifies the page verdict and billing result in headers. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. The Free plan includes 1,000 screenshots per month without a card; paid plans start at $5 for 3,000 screenshots.
See the ScreenshotNeo documentation for request options and authentication. Example cURL request (replace the target URL with a page you are allowed to capture):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Create a free ScreenshotNeo account to get 1,000 screenshots a month with no card.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
Troubleshoot common failures
Azure CLI tries to open a browser that is not present
Cause: browser login is the default on current Linux and macOS releases. Fix: rerun az login --use-device-code and redeem the code on an approved browser.
The device-code page rejects the code
Cause: the code expired, was mistyped, or was redeemed by a different account than intended. Fix: start a fresh command, copy the new code carefully, and complete the flow before it expires. If federation or Conditional Access fails, ask the tenant administrator which browser, network, and device state are permitted.
Login succeeds but commands target the wrong subscription
Cause: the account has multiple subscriptions or the CLI retained an earlier context. Fix: run az account list, then az account set --subscription "SUBSCRIPTION_NAME_OR_ID" and verify with az account show.
Headless Chrome reaches sign-in and then stops
Cause: headless mode cannot complete a required human challenge, the tenant requires a compliant device, or a redirect depends on a broker or desktop session. Fix: repeat once with --headed to observe the exact step; do not attempt to automate around MFA. Use device code for an operator-driven flow, a supported brokered desktop where available, or a workload identity for unattended work.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesA persistent Playwright session is logged out
Cause: cookies expired, session-frequency policy required reauthentication, the profile was moved, or the keyring was unavailable. Fix: reauthenticate through the approved interactive process on that same controlled host, verify profile permissions and keyring access, and never restore cookies copied from another machine.
Best Value
The broker works on a desktop but not on the server
Cause: the server lacks the supported Linux desktop components, broker registration, or a user sign-in keyring. Fix: treat the server as a terminal-only host and use device code for interactive administration or a workload identity for automation.
Operational checklist
- Verify Azure CLI version and active tenant/subscription with
az versionandaz account show. - Use device code on terminal-only machines; complete MFA in an approved browser.
- Use headed Chrome only for diagnosis or controlled first-run setup; return to headless mode for routine browser tasks.
- Keep persistent profiles dedicated, permission-restricted, and on the same approved host; never copy their cookies or token stores.
- Record which Conditional Access and device-compliance assumptions the workflow requires.
- Move scheduled or unattended jobs to service principals, managed identities, or another supported workload identity.
FAQ
Can a headless session satisfy every Entra Conditional Access policy?
No universal guarantee exists. The result depends on tenant policy, device compliance, broker availability, and federation. Validate the policy with your administrator rather than assuming that Chrome’s headless flag changes eligibility.
What happens to a Linux broker refresh token?
The broker stores it locally and encrypts it with a key in the UNIX user’s sign-in keyring. A minimal server without that supported desktop environment should not be expected to provide brokered SSO.
Free tools Windows power users keep installed
One-click scans. No signup required.
Is a Playwright persistent profile suitable as a shared team credential?
No. It is a credential-bearing artifact tied to its host and policy context. Keep ownership with one controlled service account, protect the filesystem, and use a workload identity when the process is unattended.
Frequently Asked Questions
Can a headless session satisfy every Entra Conditional Access policy?
No. Eligibility depends on tenant policy, device compliance, broker availability, and federation; the headless flag does not bypass those controls.
What happens to a Linux broker refresh token?
The broker stores it locally and encrypts it with a key in the UNIX user’s sign-in keyring.
Is a Playwright persistent profile suitable as a shared team credential?
No. Protect it as a secret on one controlled host, or use a workload identity for unattended processing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
