Terraform AzureRM provider "building AzureRM Client" missing ARM_CLIENT_ID in CI

The AzureRM provider failed at initialization while building its client: it could not assemble a complete set of credentials. In CI this is almost always a missing or wrong ARM_CLIENT_ID / ARM_TENANT_ID / ARM_SUBSCRIPTION_ID or auth secret.

What this error means

terraform plan/apply fails immediately with "Error: building AzureRM Client: ..." mentioning a missing client id, tenant id, or that no credentials were found.

Error: building AzureRM Client: please ensure you have configured a method
of authentication, such as a Service Principal with a Client Secret, OIDC, or
Managed Identity. Could not configure AzureCli authentication, and no valid
ARM_CLIENT_ID was found.

Common causes

Auth environment variables are not injected

The job did not set ARM_CLIENT_ID, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID, and a secret/OIDC, so the provider has nothing to authenticate with.

A partial or mismatched credential set

Some variables are present but one (often the client secret or OIDC config) is missing, so the client cannot be built.

How to fix it

Set the full ARM credential set

1. Provide all required ARM_* variables from CI secrets.
2. For OIDC, also enable ARM_USE_OIDC=true and the federated token wiring.
3. Re-run; the client builds once a complete credential is present.

env:
  ARM_CLIENT_ID:       ${{ secrets.ARM_CLIENT_ID }}
  ARM_TENANT_ID:       ${{ secrets.ARM_TENANT_ID }}
  ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
  ARM_USE_OIDC:        'true'

Confirm the secret reached the step

A secret defined at the wrong scope is empty in the step; verify the variables are non-empty before Terraform runs.

How to prevent it

• Inject the complete ARM_* credential set from secrets.
• Enable ARM_USE_OIDC when using federated credentials.
• Check that auth variables are present before the Terraform step.

Related guides