Bug: Azure Government (GovCloud) organizations fail silently; multiple Azure orgs collide on a single shared credential

Describe the bug

The Azure organization integration (used for AKS cluster auto-discovery) does not correctly scope credentials per-organization, and does not support Azure Government / national clouds. This shows up as two related problems:

1. Azure Government (GovCloud) organizations never work. Adding an organization with login endpoint https://login.microsoftonline.us completes sign-in successfully (toast: "Azure organization added successfully" / "Token refreshed successfully"), and a valid MSAL auth record is persisted for the account. But:

   • On first add, the organization entry is not written to the local organizations store at all, so it silently disappears from the UI despite the successful sign-in.
   • After manually restoring the organization entry, it shows up with a lock icon. Clicking it re-triggers sign-in, which succeeds, but subscription/cluster discovery still fails every time, in an infinite reauthentication loop, and no clusters are ever listed.
   • Root cause appears to be that the Azure Resource Manager scope used for all subscription-fetch calls is hardcoded to the commercial cloud (https://management.azure.com/.default) with no equivalent for Azure Government (https://management.usgovcloudapi.net/.default), so a valid GovCloud token can never be obtained for ARM calls even though AAD sign-in itself works fine against login.microsoftonline.us.

2. Configuring more than one Azure organization at the same time breaks discovery for at least one of them, even when both are on the commercial cloud. When two organizations are configured, subscription-fetch calls appear to use a single global "currently active" credential (whichever organization most recently completed sign-in) instead of looking up the correct stored auth record per organization. As a result:

   • With only a GovCloud org configured, failed calls used the auth record belonging to a different, unrelated commercial org while requesting the GovCloud tenant ID.
   • After adding a commercial org back in (making it no longer the most-recently-authenticated org), the mismatch reversed direction: calls for the commercial tenant then used the GovCloud org's auth record instead - breaking cluster discovery for the commercial org too, which had previously worked fine on its own.

To Reproduce

Steps to reproduce (GovCloud org not appearing):

1. Open Lens, go to add a new Azure organization.
2. Choose the "advanced"/manual login option and enter https://login.microsoftonline.us as the login endpoint (Azure US Government).
3. Complete interactive sign-in. Toast confirms "Azure organization added successfully".
4. Look under Kubernetes Clusters -> AKS in the sidebar.
5. See: the organization is not present in the list at all, even though sign-in succeeded.

Steps to reproduce (locked org / infinite reauth loop), after manually adding the missing organization entry back to Lens's local organizations store using the existing auth record:

1. The GovCloud organization now appears under AKS, with a lock icon.
2. Click the lock. Interactive sign-in against login.microsoftonline.us opens and completes ("Auth code was successfully acquired... Token refreshed successfully").
3. The organization still shows nothing underneath, and the lock reappears shortly after.
4. Repeating step 2 loops indefinitely; clusters are never listed.

Steps to reproduce (multi-org credential collision):

1. With only a GovCloud organization configured (as above, showing the lock/reauth-loop symptom), add a second, commercial Azure organization (default login.microsoftonline.com) via the normal "Add Azure organization" flow. Sign-in for the commercial org succeeds.
2. AKS discovery for the commercial organization - which previously worked correctly when configured alone - now also fails.
3. Inspect lens-main.log: subscription-fetch calls for the commercial tenant ID are made using the GovCloud organization's auth record (see Logs section), not the commercial organization's own auth record.

Expected behavior

• Adding an Azure organization with a GovCloud (or other national cloud) login endpoint should either fully work (sign-in, organization persisted, subscriptions/clusters listed using the correct national-cloud ARM endpoint), or fail with a clear, actionable error at add-time if national clouds are not supported - not silently disappear after a "success" toast.
• Each configured Azure organization should use its own stored auth record and the ARM endpoint appropriate to its cloud instance when fetching subscriptions/clusters. Configuring multiple organizations should not cause credential mix-ups or break previously-working organizations.

Screenshots

Environment (please complete the following information):

• Lens Version: 2026.9.20601-latest
• OS: macOS (OSX)
• Installation method: downloaded installer from Lens website

Logs:

[GovCloud org configured alone - auth record from a different, unrelated commercial org used against the GovCloud tenant ID and commercial ARM scope]
error: [AZURE-SSO-MAIN]: Failed to fetch subscriptions for auth record <AUTH-RECORD-A>: Automatic authentication has been disabled. You may call the authentication() method. { scopes: [ 'https://management.azure.com/.default' ], getTokenOptions: { abortSignal: undefined, tracingOptions: { tracingContext: [TracingContextImpl] }, enableCae: true, tenantId: '<GOVCLOUD-TENANT-ID>', disableAutomaticAuthentication: true, browserCustomizationOptions: undefined, loginHint: undefined }, name: 'AuthenticationRequiredError' }

info: [TELEMETRY-MAIN]: azure-reauthentication success
error: [AZURE-SSO-MAIN]: Failed to fetch subscriptions for auth record <AUTH-RECORD-A>: Automatic authentication has been disabled. You may call the authentication() method. { scopes: [ 'https://management.azure.com/.default' ], getTokenOptions: { abortSignal: undefined, tracingOptions: { tracingContext: [TracingContextImpl] }, enableCae: true, tenantId: '<GOVCLOUD-TENANT-ID>', disableAutomaticAuthentication: true, browserCustomizationOptions: undefined, loginHint: undefined }, name: 'AuthenticationRequiredError' }

[... this pattern repeats every time the lock is clicked and reauthentication is completed, indefinitely ...]

[After adding a second, commercial org - the mismatch reverses direction and now affects the commercial org's own subscription-fetch calls]
error: [AZURE-SSO-MAIN]: Failed to fetch subscriptions for auth record <AUTH-RECORD-B-GOVCLOUD>: Automatic authentication has been disabled. You may call the authentication() method. { scopes: [ 'https://management.azure.com/.default' ], getTokenOptions: { abortSignal: undefined, tracingOptions: { tracingContext: [TracingContextImpl] }, enableCae: true, tenantId: '<COMMERCIAL-TENANT-ID>', disableAutomaticAuthentication: true, browserCustomizationOptions: undefined, loginHint: undefined }, name: 'AuthenticationRequiredError' }

info: [TELEMETRY-MAIN]: azure-reauthentication success
error: [AZURE-SSO-MAIN]: Failed to fetch subscriptions for auth record <AUTH-RECORD-B-GOVCLOUD>: Automatic authentication has been disabled. You may call the authentication() method. { scopes: [ 'https://management.azure.com/.default' ], getTokenOptions: { abortSignal: undefined, tracingOptions: { tracingContext: [TracingContextImpl] }, enableCae: true, tenantId: '<GOVCLOUD-TENANT-ID>', disableAutomaticAuthentication: true, browserCustomizationOptions: undefined, loginHint: undefined }, name: 'AuthenticationRequiredError' }
error: [AZURE-SSO-MAIN]: Failed to fetch subscriptions for auth record <AUTH-RECORD-B-GOVCLOUD>: Automatic authentication has been disabled. You may call the authentication() method. { scopes: [ 'https://management.azure.com/.default' ], getTokenOptions: { abortSignal: undefined, tracingOptions: { tracingContext: [TracingContextImpl] }, enableCae: true, tenantId: '<GOVCLOUD-TENANT-ID>', disableAutomaticAuthentication: true, browserCustomizationOptions: undefined, loginHint: undefined }, name: 'AuthenticationRequiredError' }
error: [AZURE-SSO-MAIN]: Failed to fetch subscriptions for auth record <AUTH-RECORD-B-GOVCLOUD>: Automatic authentication has been disabled. You may call the authentication() method. { scopes: [ 'https://management.azure.com/.default' ], getTokenOptions: { abortSignal: undefined, tracingOptions: { tracingContext: [TracingContextImpl] }, enableCae: true, tenantId: '<COMMERCIAL-TENANT-ID>', disableAutomaticAuthentication: true, browserCustomizationOptions: undefined, loginHint: undefined }, name: 'AuthenticationRequiredError' }

[For comparison, a single commercial org configured alone works correctly, e.g.:]
info: [AZURE-AKS-MAIN]: Fetching resource groups for subscription <SUBSCRIPTION-ID>
info: [AZURE-AKS-MAIN]: Found 6 resource groups for subscription <SUBSCRIPTION-ID>
info: [AZURE-AKS-MAIN]: Fetching AKS clusters for resource group <RESOURCE-GROUP>
info: [AZURE-AKS-MAIN]: Successfully fetched AKS clusters for subscription <SUBSCRIPTION-ID>, count 6

Tenant IDs, auth record IDs, subscription IDs, and resource group names above have been replaced with placeholders to remove identifying information; the log structure, error text, and scopes are otherwise unmodified.

Kubeconfig:

Not applicable - the issue occurs before any kubeconfig is generated. The problem is in Azure organization/subscription discovery (Azure SSO + Azure Resource Manager token acquisition), not in loading an existing kubeconfig.

Additional context

• Digging into app.asar, the Azure Resource Manager scope Lens uses for all subscription/cluster discovery calls appears to be a hardcoded constant (AZURE_RM_SCOPE = "https://management.azure.com/.default", AZURE_MANAGEMENT_BASE_URL = "https://management.azure.com"), with no branch for Azure Government or other national clouds. The string management.usgovcloudapi.net does not appear anywhere in the shipped app bundle.
• The underlying MSAL library bundled with the app does have full support for national cloud authorities (AzureUsGovernment: "https://login.microsoftonline.us" etc. are present), so sign-in against GovCloud works - it's specifically the ARM resource/scope selection for subscription and AKS discovery that never varies per organization.
• We also found that Azure credential selection for subscription-fetch calls does not appear to be correctly scoped per-organization at all: with two organizations configured, calls for one organization's tenant ID are made using a different organization's auth record. This happens regardless of which organization is GovCloud vs. commercial, and seems tied to whichever organization most recently completed interactive sign-in becoming a single global "active" credential.
• We are also seeing that when an Azure organization add flow completes successfully (toast shown, auth record created), the organization entry itself is sometimes never persisted to Lens's local state, so it never appears in the UI. This reproduced independently on a fresh install with a single GovCloud organization configured.
• Happy to share more detail/logs if useful - we already have a support case open with this information as well.