Sorry about that, it looks like I pressed enter by mistake. 

Hi Ian. The account has been created by IS via this request: https://portal.admin.canonical.com/C124783/ . I also opened a bug 3 months ago with them regarding this issue : https://portal.admin.canonical.com/C125015/.

Regarding what happens when I try to add the credential, here is more details :

$ az login 
You have logged in. Now let us find all the subscriptions to which you have access...                                                                                                                       
[                                                                                                                                                                                                           
  {                                                
    "cloudName": "AzureCloud",                                                                        
    "homeTenantId": "40a524d9-f848-46d4-a96f-be6df491fe15",                                                                                                                                                 
    "id": "af632a76-a2ab-42c2-801f-cb4a7471c83a",                                                     
    "isDefault": true,                                                                                                                                                                                      
    "managedByTenants": [],                                                                                                                                                                                 
    "name": "Microsoft Azure Enterprise",                                                                                                                                                                   
    "state": "Enabled",                                                                               
    "tenantId": "40a524d9-f848-46d4-a96f-be6df491fe15",                                                                                                                                                     
    "user": {                                                                                                                                                                                               
      "name": "<email address hidden>",                                                                                                                                                            
      "type": "user"                                                                                  
    }                                                                                                 
  }                                                                                                                                                                                                         
] 

$ juju add-credential azure                                                                                                                                                      
This operation can be applied to both a copy on this client and to the one on a controller.                                                                                                                 
No current controller was detected but there are other controllers registered: use -c or --controller to specify a controller if needed.
Do you ONLY want to add a credential to this client? (Y/n): Y                                                                                                                                               
                                                   
Enter credential name: azure                                                                                                                                                                                
                                                   
Regions                                                                                               
  centralus                                                                                                                                                                                                   
  eastus                                                                                                                                                                                                    
  eastus2
  ...
Select region [any region, credential is not region specific]: centralus                                                                                                                                    

Auth Types                                         
  interactive                                      
  service-principal-secret                         

Select auth type [interactive]: interactive                                                           

Enter subscription-id (optional):                                                                     

ERROR finalizing credential: cannot get service principal: creating service principal: graphrbac.ServicePrincipalsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: Authorizat
ion_RequestDenied: When using this permission, the backing application of the service principal being created must in the local tenant



 juju add-credential azure                                                
This operation can be applied to both a copy on this client and to the one on a controller.                                                                                                                 
No current controller was detected but there are other controllers registered: use -c or --controller to specify a controller if needed.
Do you ONLY want to add a credential to this client? (Y/n): Y                                                                                                                                               

Enter credential name: azure                                                                          

Regions                                            
  centralus                                        
  eastus                                           
  eastus2                     
  ...

Select region [any region, credential is not region specific]: centralus                                                                                                                                    

Auth Types                                         
  interactive                                      
  service-principal-secret                         

Select auth type [interactive]:                                                                       

Enter subscription-id (optional): af632a76-a2ab-42c2-801f-cb4a7471c83a                                                                                                                                      

Initiating interactive authentication.                                                                

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code FFHQ8GNHN to authenticate.                                                                              

Authenticated as "Camille Rodriguez".                                                                 
ERROR finalizing credential: creating service principal: graphrbac.ServicePrincipalsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: Authorization_RequestDenied: When using 
this permission, the backing application of the service principal being created must in the local tenant