or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

advanced.mdasync.mdazure-platform.mdcore-credentials.mddeveloper.mdindex.mdinteractive.mdservice-principal.md
tile.json

tessl/pypi-azure-identity

Microsoft Azure Identity Library providing authentication credentials for Azure SDK clients.

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/azure-identity@1.24.x

To install, run

npx @tessl/cli install tessl/pypi-azure-identity@1.24.0

index.mddocs/

Azure Identity

The Microsoft Azure Identity Library for Python provides credentials to authenticate with Microsoft Entra ID (formerly Azure Active Directory). It serves as the central authentication solution for Azure SDK clients, offering a unified interface for acquiring Azure access tokens across diverse environments including local development, CI/CD pipelines, and Azure-hosted applications.

Package Information

  • Package Name: azure-identity
  • Language: Python
  • Installation: pip install azure-identity
  • Version: 1.24.0

Core Imports

from azure.identity import DefaultAzureCredential

Comprehensive imports for specific credential types:

from azure.identity import (
    DefaultAzureCredential,
    ClientSecretCredential, 
    CertificateCredential,
    ManagedIdentityCredential,
    InteractiveBrowserCredential,
    DeviceCodeCredential,
    AzureCliCredential,
    ChainedTokenCredential
)

For async support:

from azure.identity.aio import DefaultAzureCredential as AsyncDefaultAzureCredential

Basic Usage

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

# Create credential - automatically detects environment and uses appropriate authentication
credential = DefaultAzureCredential()

# Use with any Azure SDK client
blob_client = BlobServiceClient(
    account_url="https://mystorageaccount.blob.core.windows.net",
    credential=credential
)

# The credential automatically handles token acquisition and refresh
blobs = blob_client.list_containers()
for blob in blobs:
    print(blob.name)

# For specific authentication scenarios
from azure.identity import ClientSecretCredential

# Service principal authentication
sp_credential = ClientSecretCredential(
    tenant_id="your-tenant-id",
    client_id="your-client-id", 
    client_secret="your-client-secret"
)

# Interactive authentication for user scenarios  
from azure.identity import InteractiveBrowserCredential

user_credential = InteractiveBrowserCredential()

Architecture

Azure Identity implements the TokenCredential Protocol that all Azure SDK clients accept. This protocol defines two key methods:

  • get_token(*scopes) - Synchronously acquires an access token for the specified scopes
  • get_token_info(*scopes) - Provides token with additional metadata

Credential Chain Pattern

The DefaultAzureCredential implements a credential chain pattern, attempting authentication methods in this order:

  1. Environment variables - Service principal or user authentication via environment variables
  2. Workload Identity - For Azure Kubernetes Service workloads using service account tokens
  3. Managed Identity - For Azure-hosted applications (VMs, App Service, Function Apps, etc.)
  4. Shared Token Cache - Cached tokens from Microsoft developer tools
  5. Visual Studio Code - Azure account from VS Code Azure extension
  6. Azure CLI - Account logged into Azure CLI
  7. Azure PowerShell - Account logged into Azure PowerShell
  8. Azure Developer CLI - Account logged into Azure Developer CLI
  9. Interactive Browser - Opens browser for user authentication (disabled by default)

This design provides zero-configuration authentication that works across local development and production environments without code changes.

Common Authentication Patterns

  • Service Principal: Applications authenticate with client credentials (secret or certificate)
  • User Authentication: Interactive flows for user-facing applications
  • Managed Identity: Azure services authenticate automatically without storing credentials
  • Developer Authentication: Local development using existing Azure CLI/PowerShell sessions

Capabilities

Core Credentials

Essential credential classes providing the foundation of Azure authentication, including the intelligent DefaultAzureCredential and credential chaining capabilities.

class DefaultAzureCredential:
    def __init__(self, **kwargs): ...

class ChainedTokenCredential:
    def __init__(self, *credentials): ...

Core Credentials

Service Principal Credentials

Authenticate applications and services using Azure Active Directory service principals with client secrets, certificates, or custom client assertions.

class ClientSecretCredential:
    def __init__(self, tenant_id: str, client_id: str, client_secret: str, **kwargs): ...

class CertificateCredential:
    def __init__(self, tenant_id: str, client_id: str, certificate_path: Optional[str] = None, **kwargs): ...

class ClientAssertionCredential:
    def __init__(self, tenant_id: str, client_id: str, func: Callable[[], str], **kwargs): ...

Service Principal Credentials

Interactive User Credentials

Enable user authentication through interactive flows including browser-based authentication, device code flow, and username/password authentication.

from azure.identity._constants import DEVELOPER_SIGN_ON_CLIENT_ID

class InteractiveBrowserCredential:
    def __init__(self, *, client_id: str = DEVELOPER_SIGN_ON_CLIENT_ID, **kwargs): ...

class DeviceCodeCredential:
    def __init__(self, client_id: str = DEVELOPER_SIGN_ON_CLIENT_ID, *, timeout: Optional[int] = None, **kwargs): ...

class UsernamePasswordCredential:
    def __init__(self, client_id: str, username: str, password: str, **kwargs): ...

Interactive User Credentials

Azure Platform Credentials

Leverage Azure's native authentication mechanisms including managed identities, workload identities, and Azure service-specific authentication.

class ManagedIdentityCredential:
    def __init__(self, *, client_id: Optional[str] = None, identity_config: Optional[Mapping[str, str]] = None, **kwargs): ...

class WorkloadIdentityCredential:
    def __init__(self, *, tenant_id: Optional[str] = None, client_id: Optional[str] = None, **kwargs): ...

Azure Platform Credentials

Developer Tool Credentials

Authenticate using existing Azure developer tool sessions including Azure CLI, Azure PowerShell, Azure Developer CLI, and Visual Studio Code.

class AzureCliCredential:
    def __init__(self, *, process_timeout: int = 10, **kwargs): ...

class AzureDeveloperCliCredential:
    def __init__(self, *, process_timeout: int = 10, **kwargs): ...

class AzurePowerShellCredential:
    def __init__(self, *, process_timeout: int = 10, **kwargs): ...

Developer Tool Credentials

Advanced Features

Advanced authentication features including token caching, authentication records, exception handling, and utility functions.

class AuthenticationRecord:
    def __init__(self, tenant_id: str, client_id: str, authority: str, home_account_id: str, username: str): ...

class TokenCachePersistenceOptions:
    def __init__(self, *, allow_unencrypted_storage: bool = False, name: str = "msal.cache", **kwargs): ...

Advanced Features

Async Support

Asynchronous versions of all credential classes for use with asyncio-based applications and Azure SDK async clients.

# All credential classes available in azure.identity.aio module
from azure.identity.aio import DefaultAzureCredential, ClientSecretCredential

Async Support

Shared Types

TokenCredential Protocol

from abc import ABC, abstractmethod
from typing import Any, Optional, Union
from azure.core.credentials import AccessToken

class TokenCredential(ABC):
    @abstractmethod
    def get_token(self, *scopes: str, claims: Optional[str] = None, tenant_id: Optional[str] = None, **kwargs: Any) -> AccessToken:
        """
        Request an access token for the specified scopes.
        
        Args:
            *scopes: Desired scopes for the access token
            claims: Additional claims required in the token
            tenant_id: Optional tenant ID override
            **kwargs: Additional keyword arguments
            
        Returns:
            AccessToken: The access token with expiration information
        """

    def get_token_info(self, *scopes: str, options: Optional[dict] = None) -> dict:
        """
        Request an access token for the specified scopes with additional information.
        
        Args:
            *scopes: Desired scopes for the access token  
            options: Additional options for token acquisition
            
        Returns:
            dict: Token information including access token and metadata
        """

AccessToken

from azure.core.credentials import AccessToken

class AccessToken:
    def __init__(self, token: str, expires_on: int):
        """
        Represents an access token with expiration information.
        
        Args:
            token: The access token string
            expires_on: Token expiration time as seconds since epoch
        """
        self.token = token
        self.expires_on = expires_on

Common Parameter Types

from typing import List, Optional, Mapping, Callable, Iterable

# Authority hosts for different Azure clouds
AzureAuthorityHost = str  # login.microsoftonline.com, login.chinacloudapi.cn, etc.

# Tenant identifier
TenantId = str  

# Client application identifier  
ClientId = str

# Cache persistence configuration
CachePersistenceOptions = Optional[object]  # TokenCachePersistenceOptions instance

# Additional tenant allowlist
AdditionallyAllowedTenants = List[str]

# Authentication record for cached authentication
AuthRecord = Optional[object]  # AuthenticationRecord instance