It is only required in that scenario, but the logging helps prevent a very annoying class of errors where the SDK fetches the token for the wrong tenant from the Azure CLI. This can only be prevented if the tenant ID or subscription ID is provided. This is a warning because it is sometimes safe and sometimes not depending on the configuration of your azure CLI, and if you don't specify anything else, we don't know whether the default tenant matches the workspace's tenant.

At the very least, we could also allow users to specify the tenant ID explicitly instead of the resource ID. However, without either, we depend on defaults configured in the Azure CLI, which result in an exceptionally poor UX, so we caution users who use Azure CLI auth without this extra metadata.

Actually, now that I think about it, there might be an unauthenticated endpoint that can tell us the tenant that a workspace belongs to. If we have that, we can look up the tenant that way, and users won't have to specify this field.