To explain why to use the --output tsv, assume the example of assigning a role to a web app’s managed identity which fails with an error Cannot find user or service principal in graph database which looks like a permissions problem. The identity exists and the role name is right.
In this tutorial, we will use OpenID Connect (OIDC) to authenticate GitHub Actions to an Azure Storage Account without storing long-lived client secrets. By establishing a federated credential, GitHub dynamically requests short-lived access tokens from Microsoft Entra ID by proving the workflow originates from a trusted repository, branch, or environment.
A few days ago I had to copy blobs from a storage account in one Azure tenant to another storage account in a different tenant. As a pragmatic approach for this task I used azcopy together with a SAS token.
SAS stands for Shared Access Signature, in simple terms, it is a temporary URL with limited permissions, so you can grant access to a storage resource without exposing the full account key. Using SAS can be useful when you just want to move data from one tenant to another without setting up a full identity and RBAC model for the job.