Azure Identity SDK for .NET. Authentication library for Azure SDK clients using Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and developer credentials.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview
name
azure-identity-dotnet
description
Azure Identity SDK for .NET. Authentication library for Azure SDK clients using Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and developer credentials.
AZURE_CLIENT_ID=<user-assigned-managed-identity-client-id> # Only for user-assigned
DefaultAzureCredential
The recommended credential for most scenarios. Tries multiple authentication methods in order:
Order
Credential
Enabled by Default
1
EnvironmentCredential
Yes
2
WorkloadIdentityCredential
Yes
3
ManagedIdentityCredential
Yes
4
VisualStudioCredential
Yes
5
VisualStudioCodeCredential
Yes
6
AzureCliCredential
Yes
7
AzurePowerShellCredential
Yes
8
AzureDeveloperCliCredential
Yes
9
InteractiveBrowserCredential
No
Basic Usage
using Azure.Identity;
using Azure.Storage.Blobs;
var credential = DefaultAzureCredential();
blobClient = BlobServiceClient(
Uri(),
credential);
new
var
new
new
"https://myaccount.blob.core.windows.net"
ASP.NET Core with Dependency Injection
using Azure.Identity;
using Microsoft.Extensions.Azure;
builder.Services.AddAzureClients(clientBuilder =>
{
clientBuilder.AddBlobServiceClient(
new Uri("https://myaccount.blob.core.windows.net"));
clientBuilder.AddSecretClient(
new Uri("https://myvault.vault.azure.net"));
// Uses DefaultAzureCredential by default
clientBuilder.UseCredential(new DefaultAzureCredential());
});
// System-assigned managed identityvar credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
// User-assigned by client IDvar credential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedClientId("<client-id>"));
// User-assigned by resource IDvar credential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedResourceId("<resource-id>"));
ClientSecretCredential
var credential = new ClientSecretCredential(
tenantId: "<tenant-id>",
clientId: "<client-id>",
clientSecret: "<client-secret>");
var client = new SecretClient(
new Uri("https://myvault.vault.azure.net"),
credential);
ClientCertificateCredential
var certificate = X509CertificateLoader.LoadCertificateFromFile("MyCertificate.pfx");
var credential = new ClientCertificateCredential(
tenantId: "<tenant-id>",
clientId: "<client-id>",
certificate);
ChainedTokenCredential (Custom Chain)
var credential = new ChainedTokenCredential(
new ManagedIdentityCredential(),
new AzureCliCredential());
var client = new SecretClient(
new Uri("https://myvault.vault.azure.net"),
credential);
Developer Credentials
// Azure CLIvar credential = new AzureCliCredential();
// Azure PowerShellvar credential = new AzurePowerShellCredential();
// Azure Developer CLI (azd)var credential = new AzureDeveloperCliCredential();
// Visual Studiovar credential = new VisualStudioCredential();
// Interactive Browservar credential = new InteractiveBrowserCredential();
Environment-Based Configuration
// Production vs Development
TokenCredential credential = builder.Environment.IsProduction()
? new ManagedIdentityCredential("<client-id>")
: new DefaultAzureCredential();
Sovereign Clouds
var credential = new DefaultAzureCredential(
new DefaultAzureCredentialOptions
{
AuthorityHost = AzureAuthorityHosts.AzureGovernment
});
// Available authority hosts:// AzureAuthorityHosts.AzurePublicCloud (default)// AzureAuthorityHosts.AzureGovernment// AzureAuthorityHosts.AzureChina// AzureAuthorityHosts.AzureGermany
Credential Types Reference
Category
Credential
Purpose
Chains
DefaultAzureCredential
Preconfigured chain for dev-to-prod
ChainedTokenCredential
Custom credential chain
Azure-Hosted
ManagedIdentityCredential
Azure managed identity
WorkloadIdentityCredential
Kubernetes workload identity
EnvironmentCredential
Environment variables
Service Principal
ClientSecretCredential
Client ID + secret
ClientCertificateCredential
Client ID + certificate
ClientAssertionCredential
Signed client assertion
User
InteractiveBrowserCredential
Browser-based auth
DeviceCodeCredential
Device code flow
OnBehalfOfCredential
Delegated identity
Developer
AzureCliCredential
Azure CLI
AzurePowerShellCredential
Azure PowerShell
AzureDeveloperCliCredential
Azure Developer CLI
VisualStudioCredential
Visual Studio
Best Practices
1. Use Deterministic Credentials in Production
// Developmentvar devCredential = new DefaultAzureCredential();
// Production - use specific credentialvar prodCredential = new ManagedIdentityCredential("<client-id>");
2. Reuse Credential Instances
// Good: Single credential instance shared across clientsvar credential = new DefaultAzureCredential();
var blobClient = new BlobServiceClient(blobUri, credential);
var secretClient = new SecretClient(vaultUri, credential);
3. Configure Retry Policies
var options = new ManagedIdentityCredentialOptions(
ManagedIdentityId.FromUserAssignedClientId(clientId))
{
Retry =
{
MaxRetries = 3,
Delay = TimeSpan.FromSeconds(0.5),
}
};
var credential = new ManagedIdentityCredential(options);
4. Enable Logging for Debugging
using Azure.Core.Diagnostics;
using AzureEventSourceListener listener = new((args, message) =>
{
if (argsis { EventSource.Name: "Azure-Identity" })
{
Console.WriteLine(message);
}
}, EventLevel.LogAlways);
Error Handling
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
var client = new SecretClient(
new Uri("https://myvault.vault.azure.net"),
new DefaultAzureCredential());
try
{
KeyVaultSecret secret = await client.GetSecretAsync("secret1");
}
catch (AuthenticationFailedException e)
{
Console.WriteLine($"Authentication Failed: {e.Message}");
}
catch (CredentialUnavailableException e)
{
Console.WriteLine($"Credential Unavailable: {e.Message}");
}
Key Exceptions
Exception
Description
AuthenticationFailedException
Base exception for authentication errors
CredentialUnavailableException
Credential cannot authenticate in current environment
AuthenticationRequiredException
Interactive authentication is required
Managed Identity Support
Supported Azure services:
Azure App Service and Azure Functions
Azure Arc
Azure Cloud Shell
Azure Kubernetes Service (AKS)
Azure Service Fabric
Azure Virtual Machines
Azure Virtual Machine Scale Sets
Thread Safety
All credential implementations are thread-safe. A single credential instance can be safely shared across multiple clients and threads.
