As described in https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/authenticate-multi-tenant
This is needed e.g. when VM tries to reference image or other resource in subscription of another tenant.
With the help of com.microsoft.azure.credentials.AzureTokenCredentials and a bit of fiddling I was able to manually add the filter, but it would be nice to have the support natively in the ADK.