[Bug] Service Principal Authentication Fails with pac code init - Environment Not Found Error

[megel]

Describe the bug
When using a service principal (Application authentication profile) with the PowerApps CLI, the pac code init command fails with "Environment not found" error, despite successful authentication and the environment being visible in pac auth list. The same environment works correctly with User authentication profiles.

To Reproduce
Steps to reproduce the behavior:

1. Authenticate using a service principal: pac auth create (creates UNIVERSAL Application profile) using --accept-cleartext-caching option
2. Select the service principal profile: pac auth select -n DEV-US
3. Verify authentication: pac auth list (shows the environment correctly)
4. Attempt to initialize code project: pac code init --displayname "My App 3"
5. See error: Error: Environment '[REDACTED-ENV-ID]' not found. Please verify the environment ID and ensure you have access to it.

Expected behavior
The pac code init command should successfully initialize a new code project when using a service principal, just as it does with User authentication profiles. The service principal has access to the environment (as confirmed by successful authentication and environment listing).

Command Output

$ pac auth select -n DEV-US
New default profile:
    * UNIVERSAL DEV-US                         : [REDACTED-SERVICE-PRINCIPAL-ID]     Public https://example.crm.dynamics.com/  

$ pac auth list
Index Active Kind      Name   User                                 Cloud  Type        Environment      Environment Url
[1]   *      UNIVERSAL DEV-US [REDACTED-SERVICE-PRINCIPAL-ID]     Public Application [DEV] US Preview https://example.crm.dynamics.com/
[2]          UNIVERSAL US     [REDACTED-USER-EMAIL]               Public User        [DEV] US Preview https://example.crm.dynamics.com/

$ pac code init --displayname "My App 3"
Connected as [REDACTED-SERVICE-PRINCIPAL-ID]
Error during CLI execution: Error: Environment '[REDACTED-ENV-ID]' not found. Please verify the environment ID and ensure you have access to it.

Screenshots
N/A - Terminal output provided above

Desktop (please complete the following information):

• OS: Linux (Ubuntu 24.04.4 LTS in dev container)
• CLI Tool: PowerApps CLI (pac)
• Version: 2.4.1+g3799f3e (2.5.1 is currently not working)

pac-log-sanitized-service-principal.txt

Additional context

• Authentication Type: Service Principal (Application profile, not User profile)
• Key Observation: The same environment works fine with User authentication ([2] in the list), but fails with Application/Service Principal authentication ([1] in the list)
• Connection Status: CLI successfully connects as the service principal before failing
• Environment Access: The service principal can authenticate and the environment appears in pac auth list, suggesting it has access
• Error Location: The error occurs during the pac code init command execution, after successful connection
• Environment ID: The error message references a specific environment ID that matches the authenticated environment
• Environment: GitHub Codespace

Possible Cause
The pac code init command may not properly support service principal authentication, or there may be additional permissions/configuration required for service principals that isn't documented. The environment lookup mechanism might be using different APIs or scopes for Application vs User authentication types.

Workaround
Use User authentication profile instead of service principal for pac code init operations (switch to profile [2] in the example above).

Impact
This prevents automation and CI/CD scenarios where service principals are preferred over user accounts for non-interactive authentication e.g. with pac code push similar issue.

[eschavez]

Thanks for the clear repro steps and the sanitized log. The behavior you're seeing - pac code init returning "Environment not found" with a service principal profile despite successful authentication and the environment appearing in pac auth list - is something we're investigating.

The pac code init command uses a different API path for environment resolution than pac auth list, and it looks like that path may not handle Application/service principal auth types correctly in all cases.

We also noticed you reported a related issue in #305 (pac code push returning 403 with service principal auth). We'll look at both together since they appear to share the same root cause around service principal support for Code Apps CLI commands.

We'll update this issue with findings and any workaround beyond switching to a user auth profile.