azure.ai.agents - Post-deploy RBAC hook fails with `AzureDeveloperCLICredential: please run "azd auth login"`, No Pre-Flight Auth Check

[therealjohn]

Steps to reproduce:

Run azd deploy
Exact output:
(✓) Done: Deploying service echo-agent-responses-streaming

• Agent endpoint: https://...

ERROR: failed invoking event handlers for 'postdeploy'
agent identity RBAC setup failed: failed to discover agent identity:
AzureDeveloperCLICredential: please run "azd auth login"

Impact: Deploy reports (✓) Done before the hook runs. Agent is silently broken. Expected: Pre-flight auth check before deploy, and mark RBAC hook failure as a blocking error:
RBAC setup failed. Run: azd auth login && azd deploy

[therealjohn]

There is an existing pre-flight check. It produces a warning like:

You also can't run azd commands like deploy, up, provision, without it prompting you that you need to login first.

I suspect this user hit an issue related to the root cause in #7541, which is a content access policy preventing a token with the graph scope.

[JeffreyCA]

I have some ideas for a more holistic fix, but requires several changes including:

• Extension errors with suggestions in custom service targets not propagating through #7706
• Minor update to azidentity in https://github.com/Azure/azure-sdk-for-go
• and the extension

A short term fix would be to update in azure.ai.agents the azidentity package to v1.14.0-beta.3 so that the full error from azd auth token can be parsed for AADSTS530084, and return a clearer error message and suggestion to the user, during predeploy.