From fbc27322efa341db229bee6cdf5b96f2258579bb Mon Sep 17 00:00:00 2001
From: Zhiyi Huang <17182306+calvinhzy@users.noreply.github.com>
Date: Tue, 16 Sep 2025 16:21:40 +0800
Subject: [PATCH 1/2] fix case where user is not logged in but want to use
 azcopy with account-key

---
 .../azure/cli/command_modules/storage/azcopy/util.py          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py b/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py
index 47e765fb502..5fa208e4220 100644
--- a/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py
+++ b/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py
@@ -146,8 +146,8 @@ def login_auth_for_azcopy(cmd):
 
 
 def client_auth_for_azcopy(cmd, client):
-    # prefer oauth mode
-    if client.credential:
+    # prefer oauth mode, if account-key is not provided
+    if client.credential and not hasattr(client.credential, "account_key"):
         raw_token = Profile(cli_ctx=cmd.cli_ctx).get_raw_token(resource=STORAGE_RESOURCE_ENDPOINT)
         token_info = raw_token[0][2]
         try:

From 510db566d380fc0b48e611255ede18f27b875173 Mon Sep 17 00:00:00 2001
From: Zhiyi Huang <17182306+calvinhzy@users.noreply.github.com>
Date: Mon, 22 Sep 2025 14:57:32 +0800
Subject: [PATCH 2/2] check other cases like if sas-token is passed in or
 account-key is passed in as a dict

---
 .../cli/command_modules/storage/azcopy/util.py   | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py b/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py
index 5fa208e4220..6f6a8c24400 100644
--- a/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py
+++ b/src/azure-cli/azure/cli/command_modules/storage/azcopy/util.py
@@ -147,7 +147,21 @@ def login_auth_for_azcopy(cmd):
 
 def client_auth_for_azcopy(cmd, client):
     # prefer oauth mode, if account-key is not provided
-    if client.credential and not hasattr(client.credential, "account_key"):
+    is_oauth = True
+    credential = client.credential
+    if credential:
+        if isinstance(credential, dict) and "account_key" in credential:
+            is_oauth = False
+        elif hasattr(credential, "account_key"):
+            is_oauth = False
+        elif isinstance(credential, str):
+            sas_indicators = ["sig=", "sv=", "sr=", "se=", "sp="]
+            for indicator in sas_indicators:
+                if indicator in credential:
+                    is_oauth = False
+                    break
+
+    if is_oauth:
         raw_token = Profile(cli_ctx=cmd.cli_ctx).get_raw_token(resource=STORAGE_RESOURCE_ENDPOINT)
         token_info = raw_token[0][2]
         try: