Managed Identity Authentication

/**
 * Attempts authentication using a managed identity available at the deployment environment.
 * Works in Azure VMs, App Service instances, Azure Functions applications,
 * Azure Kubernetes Services, Azure Service Fabric instances and inside Azure Cloud Shell.
 */
class ManagedIdentityCredential implements TokenCredential {
  constructor(clientId: string, options?: TokenCredentialOptions);
  constructor(options?: ManagedIdentityCredentialClientIdOptions);
  constructor(options?: ManagedIdentityCredentialResourceIdOptions);
  constructor(options?: ManagedIdentityCredentialObjectIdOptions);
  getToken(scopes: string | string[], options?: GetTokenOptions): Promise<AccessToken>;
}

interface ManagedIdentityCredentialClientIdOptions extends TokenCredentialOptions {
  /**
   * The client ID of the user-assigned managed identity (or app registration when working with AKS pod-identity)
   */
  clientId: string;
}

interface ManagedIdentityCredentialResourceIdOptions extends TokenCredentialOptions {
  /**
   * The resource ID of the user-assigned managed identity
   */
  resourceId: string;
}

interface ManagedIdentityCredentialObjectIdOptions extends TokenCredentialOptions {
  /**
   * The object ID of the user-assigned managed identity
   */
  objectId: string;
}

import { ManagedIdentityCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

// System-assigned managed identity (no parameters needed)
const systemCredential = new ManagedIdentityCredential();

// User-assigned managed identity with client ID
const userCredential = new ManagedIdentityCredential("12345678-1234-1234-1234-123456789012");

// User-assigned managed identity with options object
const userCredentialWithOptions = new ManagedIdentityCredential({
  clientId: "12345678-1234-1234-1234-123456789012"
});

// User-assigned managed identity with resource ID
const resourceCredential = new ManagedIdentityCredential({
  resourceId: "/subscriptions/sub/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity"
});

// User-assigned managed identity with object ID
const objectCredential = new ManagedIdentityCredential({
  objectId: "12345678-1234-1234-1234-123456789012"
});

// Use with Azure SDK client
const client = new KeyClient("https://vault.vault.azure.net", systemCredential);

// Works automatically on Azure VMs with managed identity enabled
const credential = new ManagedIdentityCredential();

// System-assigned managed identity
const credential = new ManagedIdentityCredential();

// User-assigned managed identity (specify client ID in app settings)
const credential = new ManagedIdentityCredential({
  clientId: process.env.AZURE_CLIENT_ID
});

// Pod Identity with user-assigned managed identity
const credential = new ManagedIdentityCredential({
  clientId: "your-managed-identity-client-id"
});

// Workload Identity (uses token exchange)
const credential = new ManagedIdentityCredential();

const credential = new ManagedIdentityCredential();

// Only system-assigned managed identity is supported
// User-assigned identities are not supported in Service Fabric
const credential = new ManagedIdentityCredential();

// Only system-assigned managed identity is supported
// User-assigned identities will throw an error in Cloud Shell
const credential = new ManagedIdentityCredential();

const credential = new ManagedIdentityCredential();

const credential = new ManagedIdentityCredential({
  clientId: "12345678-1234-1234-1234-123456789012"
});

const credential = new ManagedIdentityCredential({
  resourceId: "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity"
});

const credential = new ManagedIdentityCredential({
  objectId: "12345678-1234-1234-1234-123456789012"
});

import { CredentialUnavailableError, AuthenticationError } from "@azure/identity";

try {
  const credential = new ManagedIdentityCredential();
  const token = await credential.getToken("https://graph.microsoft.com/.default");
} catch (error) {
  if (error instanceof CredentialUnavailableError) {
    // Managed identity is not available in this environment
    console.log("Managed identity not available:", error.message);
  } else if (error instanceof AuthenticationError) {
    // Authentication failed (e.g., insufficient permissions)
    console.log("Authentication failed:", error.message);
  }
}

// This will throw an error
try {
  const credential = new ManagedIdentityCredential({
    clientId: "some-client-id"
  });
} catch (error) {
  // CredentialUnavailableError: Specifying a user-assigned managed identity 
  // is not supported for CloudShell at runtime
}

// This will throw an error
try {
  const credential = new ManagedIdentityCredential({
    clientId: "some-client-id"
  });
} catch (error) {
  // CredentialUnavailableError: Service Fabric MSI does not support 
  // specifying user-assigned managed identity by client ID or resource ID
}

// The credential will quickly determine if managed identity is available
const credential = new ManagedIdentityCredential();

// If IMDS is not reachable, this will fail quickly with CredentialUnavailableError
try {
  const token = await credential.getToken("https://vault.vault.azure.net/.default");
} catch (error) {
  // Handle unavailable managed identity
}

// Automatically uses token exchange in AKS workload identity scenarios
const credential = new ManagedIdentityCredential();

import { DefaultAzureCredential } from "@azure/identity";

// This will try ManagedIdentityCredential along with other credential types
const credential = new DefaultAzureCredential();

// Specify managed identity client ID for DefaultAzureCredential
const credential = new DefaultAzureCredential({
  managedIdentityClientId: "12345678-1234-1234-1234-123456789012"
});

// Specify managed identity resource ID for DefaultAzureCredential  
const credential = new DefaultAzureCredential({
  managedIdentityResourceId: "/subscriptions/sub/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity"
});