[Feature Request] Drop multi-account login

[jiasli]

Context

As henrikm (@henrik-me) pointed out, currently Azure CLI supports login with with multiple user or Service Principal accounts.

The authentication information is bound to the subscription:

> az account show
{
  "environmentName": "AzureCloud",
  "homeTenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
  "id": "0b1f6471-1bf0-4dda-aec3-cb9272f09590",
  "isDefault": true,
  "managedByTenants": [
    {
      "tenantId": "2f4a9838-26b7-47ee-be60-ccc1fdec5953"
    }
  ],
  "name": "AzureSDKTest",
  "state": "Enabled",
  "tenantId": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a",
  "user": {
    "name": "test@azuresdkteam.onmicrosoft.com",  // User information is provided here
    "type": "user"
  }
}

If several user or Service Principal accounts have access to the same subscription, the subscription will be bound to the last account that logged in.

Proposed solution

Drop multi-user login. The old user should be removed if az login is called.

Reason

1. From a security perspective, it should be forbidden to login multiple accounts at the same time.
2. For cross-tenant authentication, all access tokens must belong to the same user or Service Principal, so cross-tenant authentication is not affected:

   All the tokens must be from the same user or application.

3. Because only one account is permitted, az login can log out that account first before a new login, thus resolving Revoked ATs are returned after re-login AzureAD/microsoft-authentication-library-for-python#335 (comment) easily.

[yonzhan]

Drop multi-account login

[markcowl]

Can we clarify the security concern? Is it that users might inadvertently use an unexpected account when managing resources in a subscription, or is it something else?

[cveld]

Please do it the other way around. Improve multi-user features.

1. Have Az cli contexts per shell context. Currently the az context is applicable to all shell contexts which makes it unusable for multi-user scenarios
2. Have Az cli contexts with user/subscription identitifiers. Currently only the subscription is specifying which az context to take. This is too limited. I have multiple accounts for the same subscription
3. If multi-user is really a security concern, you can add a parameter to the cli that block/unblock multiple users.