Azure Identity Py

MicrosoftOfficialCreated by Microsoft

Skill
Tool integration
Software development
MIT
Low risk

From the author

Azure Identity SDK for Python authentication with Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and token caching. Triggers: "azure-identity", "DefaultAzureCredential", "authentication", "managed identity", "service principal", "credential".

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-identity-py skill provides a comprehensive guide to using the Azure Identity library for Python. It focuses on secure, modern authentication patterns for Azure SDK clients, emphasizing the use of DefaultAzureCredential to simplify transitions between local development and production environments. The library supports various credential types, including managed identities, service principals, and interactive browser flows, while providing tools for token caching, logging, and error handling.

What it does

Provides DefaultAzureCredential for seamless local and production authentication.
Supports managed identity, service principal, and interactive user authentication flows.
Enables direct token acquisition for non-Azure SDK clients via get_bearer_token_provider.
Offers configuration for sovereign clouds and multi-tenant support.
Includes options for persistent token caching and verbose authentication logging.
Provides structured error handling for credential chain failures.

When to use it

When building Python applications that need to interact with Azure services.
When you want to avoid hardcoding secrets or API keys in your application code.
When you need a unified authentication strategy that works across local dev and cloud environments.
When integrating non-Azure SDK clients (like OpenAI) with Azure identity providers.
When deploying applications to Azure-hosted environments like App Service, Functions, or AKS.

Advantages

Reduces code changes when moving from local development to production.
Improves security by leveraging Entra ID instead of static connection strings.
Supports both synchronous and asynchronous programming patterns.
Highly configurable credential chains to suit specific environment requirements.
Standardized approach across the Azure SDK ecosystem.

Usage examples

“How do I authenticate a BlobServiceClient using DefaultAzureCredential?”: The agent provides a code snippet showing the import of DefaultAzureCredential and its usage as the credential parameter when initializing the BlobServiceClient.
“How can I use Azure Identity with the OpenAI Python SDK?”: The agent demonstrates using get_bearer_token_provider to wrap a DefaultAzureCredential instance, which is then passed to the AzureOpenAI client's azure_ad_token_provider parameter.
“How do I configure a user-assigned managed identity?”: The agent explains how to pass the managed_identity_client_id to the DefaultAzureCredential constructor or use the ManagedIdentityCredential class directly.
“How do I debug authentication failures in my app?”: The agent provides instructions on enabling verbose logging via the logging module or the AZURE_LOG_LEVEL environment variable.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-identity-py/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-identity-py.zip -d .agents/skills

Documentation by Microsoft

Azure Identity library for Python

Authentication library for Azure SDK clients using Microsoft Entra ID.

Use this skill when:

An app needs to authenticate to Azure services from Python
You need DefaultAzureCredential for local dev + Azure deployment
You need ManagedIdentityCredential for Azure-hosted workloads
You need service principal auth with secret or certificate
You need direct token acquisition with get_token()
You need to troubleshoot credential chain failures

Installation

pip install azure-identity

For VS Code or broker-based desktop auth:

pip install azure-identity-broker

Python Version

azure-identity supports Python 3.9+.

Environment Variables

# Service principal with client secret
AZURE_TENANT_ID=<your-tenant-id>
AZURE_CLIENT_ID=<your-client-id>
AZURE_CLIENT_SECRET=<your-client-secret>

# Service principal with certificate
AZURE_TENANT_ID=<your-tenant-id>
AZURE_CLIENT_ID=<your-client-id>
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>

# Authority (sovereign clouds)
AZURE_AUTHORITY_HOST=login.microsoftonline.com  # Default; or login.chinacloudapi.cn, login.microsoftonline.us

# User-assigned managed identity
AZURE_CLIENT_ID=<managed-identity-client-id>

# Credential selection (new)
AZURE_TOKEN_CREDENTIALS=dev|prod|<credential-name>  # Optional, restricts DAC chain

Authentication & Lifecycle

🔑 Two rules apply to every code sample below:
Prefer DefaultAzureCredential. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation.
Local dev: DefaultAzureCredential works as-is.
Production: set AZURE_TOKEN_CREDENTIALS=prod (or AZURE_TOKEN_CREDENTIALS=<specific_credential>) to constrain the credential chain to production-safe credentials.
Wrap credentials and clients in context managers when they own token caches / transports:
Sync: with DefaultAzureCredential() as credential:
Async: async with DefaultAzureCredential() as credential: (from azure.identity.aio)
Snippets may abbreviate this setup, but production code should always follow both rules.

DefaultAzureCredential

The recommended credential for most scenarios. Tries multiple authentication methods in order:

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

# Works in local dev AND production without code changes
credential = DefaultAzureCredential()

with BlobServiceClient(
    account_url="https://<account>.blob.core.windows.net",
    credential=credential
) as client:
    containers = list(client.list_containers())

Credential Chain Order

See DefaultAzureCredential overview for the current credential chain order and defaults.

Customizing DefaultAzureCredential

# Exclude credentials you don't need
credential = DefaultAzureCredential(
    exclude_environment_credential=True,
    exclude_shared_token_cache_credential=True,
    managed_identity_client_id="<user-assigned-mi-client-id>"  # For user-assigned MI (also accepts object ID or resource ID)
)

# Enable interactive browser (disabled by default)
credential = DefaultAzureCredential(
    exclude_interactive_browser_credential=False
)

# Set subprocess timeout for CLI-based credentials (default: 10s)
credential = DefaultAzureCredential(process_timeout=30)

# Require AZURE_TOKEN_CREDENTIALS env var to be set
credential = DefaultAzureCredential(require_envvar=True)

Exclude Parameters

Parameter	Default	Effect
`exclude_environment_credential`	False	Skip env-var-based auth
`exclude_workload_identity_credential`	False	Skip Kubernetes workload identity
`exclude_managed_identity_credential`	False	Skip managed identity
`exclude_shared_token_cache_credential`	False	Skip shared token cache
`exclude_visual_studio_code_credential`	False	Skip VS Code credential
`exclude_cli_credential`	False	Skip Azure CLI
`exclude_powershell_credential`	False	Skip Azure PowerShell
`exclude_developer_cli_credential`	False	Skip Azure Developer CLI
`exclude_interactive_browser_credential`	True	Skip interactive browser
`exclude_broker_credential`	False	Skip WAM broker

get_bearer_token_provider

Helper that wraps a credential into a callable returning a bearer token string. Essential for OpenAI SDK and other non-Azure-SDK clients:

from azure.identity import DefaultAzureCredential, get_bearer_token_provider

credential = DefaultAzureCredential()
token_provider = get_bearer_token_provider(
    credential, "https://cognitiveservices.azure.com/.default"
)

# Use with OpenAI SDK
from openai import AzureOpenAI

with AzureOpenAI(
    azure_endpoint="https://<resource>.openai.azure.com/",
    azure_ad_token_provider=token_provider,
    api_version="2024-10-21",
) as client:
    # response = client.chat.completions.create(...)
    ...

Credential Types

Credential Chains

Credential	Use Case
`DefaultAzureCredential`	Most scenarios — auto-detects environment
`ChainedTokenCredential`	Custom credential chain with explicit ordering

Azure-Hosted Applications

Credential	Use Case
`EnvironmentCredential`	Auth via AZURE_CLIENT_SECRET / AZURE_CLIENT_CERTIFICATE_PATH env vars
`ManagedIdentityCredential`	Azure VMs, App Service, Functions, AKS, Arc, Service Fabric
`WorkloadIdentityCredential`	Kubernetes with Microsoft Entra Workload ID

Service Principals

Credential	Use Case
`ClientSecretCredential`	Service principal with client secret
`CertificateCredential`	Service principal with PEM/PKCS12 certificate
`ClientAssertionCredential`	Service principal with signed JWT assertion
`AzurePipelinesCredential`	Azure Pipelines with workload identity federation
`OnBehalfOfCredential`	Middle-tier on-behalf-of flow (delegated user identity)

User Authentication

Credential	Use Case
`InteractiveBrowserCredential`	Interactive browser OAuth sign-in
`DeviceCodeCredential`	Headless/SSH device code flow
`AuthorizationCodeCredential`	Previously obtained authorization code

Developer Tools

Credential	Use Case
`AzureCliCredential`	`az login`
`AzureDeveloperCliCredential`	`azd auth login`
`AzurePowerShellCredential`	`Connect-AzAccount`
`VisualStudioCodeCredential`	VS Code Azure Resources extension

Specific Credential Examples

ManagedIdentityCredential

For Azure-hosted resources (VMs, App Service, Functions, AKS):

from azure.identity import ManagedIdentityCredential

# System-assigned managed identity
credential = ManagedIdentityCredential()

# User-assigned managed identity (client_id, object_id, or resource_id)
credential = ManagedIdentityCredential(
    client_id="<user-assigned-mi-client-id>"
)
# Also valid:
# credential = ManagedIdentityCredential(object_id="<object-id>")
# credential = ManagedIdentityCredential(resource_id="<resource-id>")

ClientSecretCredential

import os
from azure.identity import ClientSecretCredential

credential = ClientSecretCredential(
    tenant_id=os.environ["AZURE_TENANT_ID"],
    client_id=os.environ["AZURE_CLIENT_ID"],
    client_secret=os.environ["AZURE_CLIENT_SECRET"],
)

CertificateCredential

Note: The class is CertificateCredential, NOT ClientCertificateCredential.

from azure.identity import CertificateCredential

# From file path
credential = CertificateCredential(
    tenant_id="<tenant-id>",
    client_id="<client-id>",
    certificate_path="/path/to/cert.pem",
)

# From bytes with password
credential = CertificateCredential(
    tenant_id="<tenant-id>",
    client_id="<client-id>",
    certificate_data=cert_bytes,
    password="<cert-password>",
    send_certificate_chain=True,  # Required for SNI auth
)

AzureCliCredential

from azure.identity import AzureCliCredential

credential = AzureCliCredential()
# With tenant restriction
credential = AzureCliCredential(tenant_id="<tenant-id>")

ChainedTokenCredential

Custom credential chain:

from azure.identity import (
    ChainedTokenCredential,
    ManagedIdentityCredential,
    AzureCliCredential,
)

# Try managed identity first, fall back to CLI
credential = ChainedTokenCredential(
    ManagedIdentityCredential(client_id="<user-assigned-mi-client-id>"),
    AzureCliCredential(),
)

WorkloadIdentityCredential

For Azure Kubernetes Service with workload identity:

from azure.identity import WorkloadIdentityCredential

# Reads from AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE
credential = WorkloadIdentityCredential()

# Or explicit configuration
credential = WorkloadIdentityCredential(
    tenant_id="<tenant-id>",
    client_id="<client-id>",
    token_file_path="/var/run/secrets/azure/tokens/azure-identity-token",
)

DeviceCodeCredential

For headless devices (IoT, SSH, CLI tools):

from azure.identity import DeviceCodeCredential

credential = DeviceCodeCredential()
# Prints device code prompt to stdout by default

# With custom prompt callback
def prompt_callback(verification_uri, user_code, expires_on):
    print(f"Go to {verification_uri} and enter code {user_code}")

credential = DeviceCodeCredential(
    client_id="<client-id>",
    prompt_callback=prompt_callback,
)

InteractiveBrowserCredential

For interactive OAuth browser sign-in:

from azure.identity import InteractiveBrowserCredential

credential = InteractiveBrowserCredential()

# With specific tenant and client
credential = InteractiveBrowserCredential(
    tenant_id="<tenant-id>",
    client_id="<client-id>",
)

OnBehalfOfCredential

For middle-tier services propagating user identity:

from azure.identity import OnBehalfOfCredential

credential = OnBehalfOfCredential(
    tenant_id="<tenant-id>",
    client_id="<client-id>",
    client_secret="<client-secret>",
    user_assertion="<access-token-from-client>",
)

AzurePipelinesCredential

For Azure DevOps pipelines with workload identity federation:

import os
from azure.identity import AzurePipelinesCredential

credential = AzurePipelinesCredential(
    tenant_id="<tenant-id>",
    client_id="<client-id>",
    service_connection_id="<service-connection-id>",
    system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],
)

Getting Tokens Directly

from azure.identity import DefaultAzureCredential

with DefaultAzureCredential() as credential:
    # Get token for a specific scope
    token = credential.get_token("https://management.azure.com/.default")
    print(f"Token expires: {token.expires_on}")

    # For Azure Database for PostgreSQL
    token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default")

Async Credentials

Async credentials are in azure.identity.aio. Always close them or use async with:

from azure.identity.aio import DefaultAzureCredential
from azure.storage.blob.aio import BlobServiceClient

async def main():
    # Preferred: use async context manager for both credential and client
    async with DefaultAzureCredential() as credential:
        async with BlobServiceClient(
            account_url="https://<account>.blob.core.windows.net",
            credential=credential,
        ) as client:
            # ... async operations
            pass

The async get_bearer_token_provider is at azure.identity.aio.get_bearer_token_provider.

Sovereign Clouds

Use AzureAuthorityHosts or the AZURE_AUTHORITY_HOST env var:

from azure.identity import DefaultAzureCredential, AzureAuthorityHosts

# Azure Government
credential = DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_GOVERNMENT)

# Azure China
credential = DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_CHINA)

Constant	Authority
`AzureAuthorityHosts.AZURE_PUBLIC_CLOUD`	`login.microsoftonline.com` (default)
`AzureAuthorityHosts.AZURE_GOVERNMENT`	`login.microsoftonline.us`
`AzureAuthorityHosts.AZURE_CHINA`	`login.chinacloudapi.cn`

Persistent Token Caching

Opt-in disk-based caching with TokenCachePersistenceOptions:

from azure.identity import DefaultAzureCredential, TokenCachePersistenceOptions

credential = DefaultAzureCredential(
    cache_persistence_options=TokenCachePersistenceOptions()
)

# Allow unencrypted fallback (NOT recommended for production)
credential = DefaultAzureCredential(
    cache_persistence_options=TokenCachePersistenceOptions(allow_unencrypted_storage=True)
)

Storage: Windows (DPAPI), macOS (Keychain), Linux (Keyring).

Multi-Tenant Support

Allow token acquisition for additional tenants beyond the configured one:

from azure.identity import ClientSecretCredential

credential = ClientSecretCredential(
    tenant_id="<home-tenant>",
    client_id="<client-id>",
    client_secret="<secret>",
    additionally_allowed_tenants=["<other-tenant>", "*"],  # "*" allows any tenant
)

Error Handling

from azure.identity import DefaultAzureCredential, CredentialUnavailableError
from azure.core.exceptions import ClientAuthenticationError

with DefaultAzureCredential() as credential:
    try:
        token = credential.get_token("https://management.azure.com/.default")
    except CredentialUnavailableError:
        # No credential in the chain could attempt authentication
        pass
    except ClientAuthenticationError as e:
        # Authentication was attempted but failed
        # e.message contains details from each credential in the chain
        pass

Logging

Enable authentication logging for debugging:

import logging

# Enable verbose Azure Identity logging
logging.basicConfig(level=logging.DEBUG)
logger = logging.getLogger("azure.identity")
logger.setLevel(logging.DEBUG)

# Or via environment variable
AZURE_LOG_LEVEL=debug

Credential Selection Matrix

Environment	Recommended Credential
Local Development	`DefaultAzureCredential` (uses Azure CLI)
Azure App Service	`DefaultAzureCredential` (uses Managed Identity)
Azure Functions	`DefaultAzureCredential` (uses Managed Identity)
Azure Kubernetes Service	`WorkloadIdentityCredential`
Azure VMs	`DefaultAzureCredential` (uses Managed Identity)
CI/CD Pipeline	`EnvironmentCredential` or `AzurePipelinesCredential`
Desktop App	`InteractiveBrowserCredential`
CLI / Headless Tool	`DeviceCodeCredential`
Middle-tier Service	`OnBehalfOfCredential`

Best Practices

Pick sync OR async and stay consistent. Do not mix azure.xxx sync clients with azure.xxx.aio async clients in the same call path. Choose one mode per module.
Use credentials as context managers (with DefaultAzureCredential() as credential:) when they own token caches / HTTP transports you want cleaned up; for async, use async with on credentials from azure.identity.aio.
Use DefaultAzureCredential for code that runs locally. Use a specific token credential for code that runs in Azure.
Never hardcode credentials — use environment variables or managed identity
Prefer managed identity in production Azure deployments
Use get_bearer_token_provider for non-Azure-SDK clients (OpenAI, REST APIs)
Use ChainedTokenCredential when you need a custom credential order
Set AZURE_CLIENT_ID for user-assigned managed identities (object ID and resource ID are also valid identifiers)
Exclude unused credentials to speed up DefaultAzureCredential authentication
Use CertificateCredential (not ClientCertificateCredential — that name doesn't exist)
Enable cache_persistence_options for long-running services to reduce token requests
Reuse credential instances — same credential can be shared across multiple clients

Reference Links

Resource	URL
PyPI Package	https://pypi.org/project/azure-identity/
API Reference	https://learn.microsoft.com/python/api/azure-identity
GitHub Source	https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
Credential Chains	https://aka.ms/azsdk/python/identity/credential-chains

Reference Files

File	Contents
references/capabilities.md	Additional non-hero capabilities, operation-group coverage, and production checklists.
references/non-hero-scenarios.md	Dedicated non-hero examples for secondary/advanced scenarios.

Files

ATTRIBUTION.mdAdded by AutoGineer962 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md17.3 KiB
references/capabilities.md2.2 KiB
references/non-hero-scenarios.md4.3 KiB

SKILL.md