diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/azure_cli.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/azure_cli.py
index 0d089e708c74..809299f21b61 100644
--- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/azure_cli.py
+++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/azure_cli.py
@@ -100,12 +100,13 @@ async def _run_command(command: str) -> str:
         proc = await asyncio.create_subprocess_exec(
             *args,
             stdout=asyncio.subprocess.PIPE,
-            stderr=asyncio.subprocess.STDOUT,
+            stderr=asyncio.subprocess.PIPE,
             cwd=working_directory,
             env=dict(os.environ, AZURE_CORE_NO_COLOR="true")
         )
-        stdout, _ = await asyncio.wait_for(proc.communicate(), 10)
+        stdout, stderr = await asyncio.wait_for(proc.communicate(), 10)
         output = stdout.decode()
+        stderr = stderr.decode()
     except OSError as ex:
         # failed to execute 'cmd' or '/bin/sh'; CLI may or may not be installed
         error = CredentialUnavailableError(message="Failed to execute '{}'".format(args[0]))
@@ -117,11 +118,11 @@ async def _run_command(command: str) -> str:
     if proc.returncode == 0:
         return output
 
-    if proc.returncode == 127 or output.startswith("'az' is not recognized"):
+    if proc.returncode == 127 or stderr.startswith("'az' is not recognized"):
         raise CredentialUnavailableError(CLI_NOT_FOUND)
 
-    if "az login" in output or "az account set" in output:
+    if "az login" in stderr or "az account set" in stderr:
         raise CredentialUnavailableError(message=NOT_LOGGED_IN)
 
-    message = sanitize_output(output) if output else "Failed to invoke Azure CLI"
+    message = sanitize_output(stderr) if stderr else "Failed to invoke Azure CLI"
     raise ClientAuthenticationError(message=message)
diff --git a/sdk/identity/azure-identity/tests/test_cli_credential_async.py b/sdk/identity/azure-identity/tests/test_cli_credential_async.py
index 2276a1bff3e5..568f837a41bf 100644
--- a/sdk/identity/azure-identity/tests/test_cli_credential_async.py
+++ b/sdk/identity/azure-identity/tests/test_cli_credential_async.py
@@ -101,8 +101,8 @@ async def test_get_token():
 async def test_cli_not_installed_linux():
     """The credential should raise CredentialUnavailableError when the CLI isn't installed"""
 
-    output = "/bin/sh: 1: az: not found"
-    with mock.patch(SUBPROCESS_EXEC, mock_exec(output, return_code=127)):
+    stderr = "/bin/sh: 1: az: not found"
+    with mock.patch(SUBPROCESS_EXEC, mock_exec(stderr=stderr, return_code=127)):
         with pytest.raises(CredentialUnavailableError, match=CLI_NOT_FOUND):
             credential = AzureCliCredential()
             await credential.get_token("scope")
@@ -111,8 +111,8 @@ async def test_cli_not_installed_linux():
 async def test_cli_not_installed_windows():
     """The credential should raise CredentialUnavailableError when the CLI isn't installed"""
 
-    output = "'az' is not recognized as an internal or external command, operable program or batch file."
-    with mock.patch(SUBPROCESS_EXEC, mock_exec(output, return_code=1)):
+    stderr = "'az' is not recognized as an internal or external command, operable program or batch file."
+    with mock.patch(SUBPROCESS_EXEC, mock_exec(stderr=stderr, return_code=1)):
         with pytest.raises(CredentialUnavailableError, match=CLI_NOT_FOUND):
             credential = AzureCliCredential()
             await credential.get_token("scope")
@@ -130,8 +130,8 @@ async def test_cannot_execute_shell():
 async def test_not_logged_in():
     """When the CLI isn't logged in, the credential should raise CredentialUnavailableError"""
 
-    output = "ERROR: Please run 'az login' to setup account."
-    with mock.patch(SUBPROCESS_EXEC, mock_exec(output, return_code=1)):
+    stderr = "ERROR: Please run 'az login' to setup account."
+    with mock.patch(SUBPROCESS_EXEC, mock_exec(stderr=stderr, return_code=1)):
         with pytest.raises(CredentialUnavailableError, match=NOT_LOGGED_IN):
             credential = AzureCliCredential()
             await credential.get_token("scope")
@@ -140,9 +140,9 @@ async def test_not_logged_in():
 async def test_unexpected_error():
     """When the CLI returns an unexpected error, the credential should raise an error containing the CLI's output"""
 
-    output = "something went wrong"
-    with mock.patch(SUBPROCESS_EXEC, mock_exec(output, return_code=42)):
-        with pytest.raises(ClientAuthenticationError, match=output):
+    stderr = "something went wrong"
+    with mock.patch(SUBPROCESS_EXEC, mock_exec(stderr=stderr, return_code=42)):
+        with pytest.raises(ClientAuthenticationError, match=stderr):
             credential = AzureCliCredential()
             await credential.get_token("scope")