diff --git a/Gopkg.lock b/Gopkg.lock
index 797653a4c341..eb7e6c92a286 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -9,6 +9,18 @@
   revision = "64a2037ec6be8a4b0c1d1f706ed35b428b989239"
   version = "v0.26.0"
 
+[[projects]]
+  digest = "1:d62e9a41f2e45c103f6c15ffabb3466b3548db41b8cc135a4669794033ee761f"
+  name = "github.com/Azure/go-autorest"
+  packages = [
+    "autorest",
+    "autorest/adal",
+    "autorest/azure",
+    "autorest/date",
+  ]
+  pruneopts = ""
+  revision = "1ff28809256a84bb6966640ff3d0371af82ccba4"
+
 [[projects]]
   digest = "1:b9660f5e3522b899d32b1f9bb98056203d6f76f673e1843eaa00869330103ba5"
   name = "github.com/Knetic/govaluate"
@@ -67,6 +79,14 @@
   revision = "346938d642f2ec3594ed81d874461961cd0faa76"
   version = "v1.1.0"
 
+[[projects]]
+  digest = "1:6098222470fe0172157ce9bbef5d2200df4edde17ee649c5d6e48330e4afa4c6"
+  name = "github.com/dgrijalva/jwt-go"
+  packages = ["."]
+  pruneopts = ""
+  revision = "06ea1031745cb8b3dab3f6a236daf2b0aa468b7e"
+  version = "v3.2.0"
+
 [[projects]]
   branch = "master"
   digest = "1:d6c13a378213e3de60445e49084b8a0a9ce582776dfc77927775dbeb3ff72a35"
@@ -946,6 +966,7 @@
     "pkg/apis/clientauthentication/v1alpha1",
     "pkg/apis/clientauthentication/v1beta1",
     "pkg/version",
+    "plugin/pkg/client/auth/azure",
     "plugin/pkg/client/auth/exec",
     "plugin/pkg/client/auth/gcp",
     "plugin/pkg/client/auth/oidc",
@@ -1090,6 +1111,7 @@
     "k8s.io/client-go/informers/internalinterfaces",
     "k8s.io/client-go/kubernetes",
     "k8s.io/client-go/kubernetes/fake",
+    "k8s.io/client-go/plugin/pkg/client/auth/azure",
     "k8s.io/client-go/plugin/pkg/client/auth/gcp",
     "k8s.io/client-go/plugin/pkg/client/auth/oidc",
     "k8s.io/client-go/rest",
diff --git a/Gopkg.toml b/Gopkg.toml
index 25aee72f4b95..facaf7e03133 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -48,3 +48,10 @@ required = [
 [[constraint]]
   name = "github.com/ghodss/yaml"
   branch = "master"
+
+# vendor/k8s.io/client-go/plugin/pkg/client/auth/azure/azure.go:300:25:
+# cannot call non-function spt.Token (type adal.Token)
+[[override]]
+  name = "github.com/Azure/go-autorest"
+  revision = "1ff28809256a84bb6966640ff3d0371af82ccba4"
+
diff --git a/cmd/argo/main.go b/cmd/argo/main.go
index d799b6a42d14..7f45d54b17f8 100644
--- a/cmd/argo/main.go
+++ b/cmd/argo/main.go
@@ -5,6 +5,8 @@ import (
 	"os"
 
 	"github.com/argoproj/argo/cmd/argo/commands"
+	// load the azure plugin (required to authenticate against AKS clusters).
+	_ "k8s.io/client-go/plugin/pkg/client/auth/azure"
 	// load the gcp plugin (required to authenticate against GKE clusters).
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 	// load the oidc plugin (required to authenticate with OpenID Connect).
diff --git a/cmd/argoexec/main.go b/cmd/argoexec/main.go
index dbebde6e829f..629e1b0806fd 100644
--- a/cmd/argoexec/main.go
+++ b/cmd/argoexec/main.go
@@ -5,6 +5,8 @@ import (
 	"os"
 
 	"github.com/argoproj/argo/cmd/argoexec/commands"
+	// load the azure plugin (required to authenticate against AKS clusters).
+	_ "k8s.io/client-go/plugin/pkg/client/auth/azure"
 	// load the gcp plugin (required to authenticate against GKE clusters).
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 	// load the oidc plugin (required to authenticate with OpenID Connect).
diff --git a/cmd/workflow-controller/main.go b/cmd/workflow-controller/main.go
index a43c1cf2866e..f881739dbf23 100644
--- a/cmd/workflow-controller/main.go
+++ b/cmd/workflow-controller/main.go
@@ -12,6 +12,7 @@ import (
 	"github.com/argoproj/pkg/stats"
 	"github.com/spf13/cobra"
 	"k8s.io/client-go/kubernetes"
+	_ "k8s.io/client-go/plugin/pkg/client/auth/azure"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
 	"k8s.io/client-go/tools/clientcmd"