Azure Appconfiguration Py
MicrosoftOfficialCreated by Microsoft
- Skill
- Tool integration
- Cloud and DevOps
- MIT
- Low risk
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The azure-appconfiguration-py skill provides a guide for using the Azure App Configuration SDK for Python. It covers essential operations for centralized configuration management, including retrieving, setting, and deleting key-value pairs. The skill emphasizes secure authentication practices using DefaultAzureCredential, proper resource lifecycle management through context managers, and advanced features like feature flags, read-only settings, and point-in-time snapshots.
What it does
- Provides methods to get, set, and delete configuration settings.
- Supports filtering settings by key prefixes and labels for environment management.
- Enables implementation of feature flags for application control.
- Includes functionality for creating and listing configuration snapshots.
- Demonstrates secure authentication using Entra ID and DefaultAzureCredential.
- Offers both synchronous and asynchronous client implementations.
When to use it
- When you need to centralize application configuration across multiple environments.
- When implementing feature flags for gradual rollouts or A/B testing.
- When you require point-in-time snapshots of configuration for rollback capabilities.
- When building Python applications that integrate with Azure cloud services.
Advantages
- Promotes secure practices by avoiding connection strings in favor of Entra ID.
- Ensures resource cleanup through mandatory context manager usage.
- Supports environment-specific configurations via labels.
- Provides consistent patterns for both sync and async development.
Usage examples
- “How do I retrieve a specific configuration setting using the Azure App Configuration Python SDK?”
- The agent provides a code snippet using the get_configuration_setting method with the required key parameter.
- “Show me how to set a feature flag in Azure App Configuration.”
- The agent demonstrates creating a ConfigurationSetting object with the appropriate feature flag key format and JSON-encoded value.
- “How can I list all settings that match a specific key prefix?”
- The agent provides an example using the list_configuration_settings method with the key_filter argument.
- “How should I authenticate my Python application to Azure App Configuration?”
- The agent explains the use of DefaultAzureCredential and provides a code example showing how to initialize the client securely.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-appconfiguration-py/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip azure-appconfiguration-py.zip -d .agents/skills
Documentation by Microsoft
Azure App Configuration SDK for Python
Centralized configuration management with feature flags and dynamic settings.
Installation
pip install azure-appconfigurationEnvironment Variables
AZURE_APPCONFIGURATION_ENDPOINT=https://<name>.azconfig.io # Required for Entra ID auth
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in productionAuthentication & Lifecycle
🔑 Two rules apply to every code sample below:
Prefer
DefaultAzureCredential. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation.
Local dev:
DefaultAzureCredentialworks as-is.Production: set
AZURE_TOKEN_CREDENTIALS=prod(orAZURE_TOKEN_CREDENTIALS=<specific_credential>) to constrain the credential chain to production-safe credentials.Wrap every client in a context manager so HTTP transports, sockets, and token caches are released deterministically:
Sync:
with <Client>(...) as client:Async:
async with <Client>(...) as client:andasync with DefaultAzureCredential() as credential:(fromazure.identity.aio)Snippets may abbreviate this setup, but production code should always follow both rules.
import os
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
# Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
credential = DefaultAzureCredential(require_envvar=True)
# Or use a specific credential directly in production:
# See https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
with AzureAppConfigurationClient(
base_url=os.environ["AZURE_APPCONFIGURATION_ENDPOINT"],
credential=credential
) as client:
# Use client here (see following sections for operations)
...Configuration Settings
Get Setting
setting = client.get_configuration_setting(key="app:settings:message")
print(f"{setting.key} = {setting.value}")Get with Label
# Labels allow environment-specific values
setting = client.get_configuration_setting(
key="app:settings:message",
label="production"
)Set Setting
from azure.appconfiguration import ConfigurationSetting
setting = ConfigurationSetting(
key="app:settings:message",
value="Hello, World!",
label="development",
content_type="text/plain",
tags={"environment": "dev"}
)
client.set_configuration_setting(setting)Delete Setting
client.delete_configuration_setting(
key="app:settings:message",
label="development"
)List Settings
All Settings
settings = client.list_configuration_settings()
for setting in settings:
print(f"{setting.key} [{setting.label}] = {setting.value}")Filter by Key Prefix
settings = client.list_configuration_settings(
key_filter="app:settings:*"
)Filter by Label
settings = client.list_configuration_settings(
label_filter="production"
)Feature Flags
Set Feature Flag
from azure.appconfiguration import ConfigurationSetting
import json
feature_flag = ConfigurationSetting(
key=".appconfig.featureflag/beta-feature",
value=json.dumps({
"id": "beta-feature",
"enabled": True,
"conditions": {
"client_filters": []
}
}),
content_type="application/vnd.microsoft.appconfig.ff+json;charset=utf-8"
)
client.set_configuration_setting(feature_flag)Get Feature Flag
setting = client.get_configuration_setting(
key=".appconfig.featureflag/beta-feature"
)
flag_data = json.loads(setting.value)
print(f"Feature enabled: {flag_data['enabled']}")List Feature Flags
flags = client.list_configuration_settings(
key_filter=".appconfig.featureflag/*"
)
for flag in flags:
data = json.loads(flag.value)
print(f"{data['id']}: {'enabled' if data['enabled'] else 'disabled'}")Read-Only Settings
# Make setting read-only
client.set_read_only(
configuration_setting=setting,
read_only=True
)
# Remove read-only
client.set_read_only(
configuration_setting=setting,
read_only=False
)Snapshots
Create Snapshot
from azure.appconfiguration import ConfigurationSnapshot, ConfigurationSettingFilter
snapshot = ConfigurationSnapshot(
name="v1-snapshot",
filters=[
ConfigurationSettingFilter(key="app:*", label="production")
]
)
created = client.begin_create_snapshot(
name="v1-snapshot",
snapshot=snapshot
).result()List Snapshot Settings
settings = client.list_configuration_settings(
snapshot_name="v1-snapshot"
)Async Client
from azure.appconfiguration.aio import AzureAppConfigurationClient
from azure.identity.aio import DefaultAzureCredential
async def main():
async with DefaultAzureCredential() as credential:
async with AzureAppConfigurationClient(
base_url=endpoint,
credential=credential
) as client:
setting = await client.get_configuration_setting(key="app:message")
print(setting.value)Client Operations
| Operation | Description |
|---|---|
get_configuration_setting | Get single setting |
set_configuration_setting | Create or update setting |
delete_configuration_setting | Delete setting |
list_configuration_settings | List with filters |
set_read_only | Lock/unlock setting |
begin_create_snapshot | Create point-in-time snapshot |
list_snapshots | List all snapshots |
Best Practices
Pick sync OR async and stay consistent. Do not mix
azure.xxxsync clients withazure.xxx.aioasync clients in the same call path. Choose one mode per module.Always use context managers for clients and async credentials. Wrap every client in
with Client(...) as client:(sync) orasync with Client(...) as client:(async). For asyncDefaultAzureCredentialfromazure.identity.aio, also useasync with credential:so tokens and transports are cleaned up.Use labels for environment separation (dev, staging, prod)
Use key prefixes for logical grouping (app:database:, app:cache:)
Make production settings read-only to prevent accidental changes
Create snapshots before deployments for rollback capability
Use Entra ID instead of connection strings in production
Refresh settings periodically in long-running applications
Use feature flags for gradual rollouts and A/B testing
Reference Files
| File | Contents |
|---|---|
| references/capabilities.md | Additional non-hero capabilities, operation-group coverage, and production checklists. |
| references/non-hero-scenarios.md | Dedicated non-hero examples for secondary/advanced scenarios. |
Files
- ATTRIBUTION.mdAdded by AutoGineer986 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md7.5 KiB
- references/capabilities.md1.4 KiB
- references/non-hero-scenarios.md1.6 KiB
LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARERequirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an API key, Needs Python
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills · .github/plugins/azure-sdk-python/skills/azure-appconfiguration-py · commit 0696600
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-appconfiguration-py.zip