Azure Identity Dotnet

by microsoft354361d83247MITListed Oct 8, 2026Updated Oct 8, 2026

Azure Identity library for .NET. Authentication library for Azure SDK clients using Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and developer credentials. Triggers: "Azure Identity", "DefaultAzureCredential", "ManagedIdentityCredential", "ClientSecretCredential", "authentication .NET", "Azure auth", "credential chain".

FeaturedInstructions onlySoftware Development DevOps & Cloud

AI-generated overview

Reference guide for authenticating .NET apps to Azure SDK clients with the Azure.Identity library and its credential types.

What it does: Provides usage guidance for the Azure.Identity .NET library, covering installation, environment variables, and credential classes such as DefaultAzureCredential, ManagedIdentityCredential, ClientSecretCredential, and developer credentials. It shows code patterns for dependency injection, sovereign clouds, retry policies, logging, error handling, and thread safety. The deliverable is instructional documentation with C# examples rather than executable scripts.
When to use it: Use when writing or reviewing .NET code that authenticates to Azure services through Microsoft Entra ID. It fits questions about credential chains, managed identity, service principals, or choosing a credential for development versus production.
Requirements: Requires the .NET SDK and the Azure.Identity NuGet package, with optional Microsoft.Extensions.Azure and Azure.Identity.Broker packages. Azure credentials or environment variables are needed for actual authentication. No scripts are included; the skill is instructions only.

Azure Identity library for .NET

Authentication library for Azure SDK clients using Microsoft Entra ID.

Installation

bash

dotnet add package Azure.Identity
# For ASP.NET Core integrationdotnet add package Microsoft.Extensions.Azure
# For brokered authentication and Visual Studio Code credential supportdotnet add package Azure.Identity.Broker

dotnet add package Azure.Identity
# For ASP.NET Core integrationdotnet add package Microsoft.Extensions.Azure
# For brokered authentication and Visual Studio Code credential supportdotnet add package Azure.Identity.Broker

Environment Variables

Service Principal with Secret

bash

AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_SECRET=<client-secret-value>

AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_SECRET=<client-secret-value>

Service Principal with Certificate

bash

AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_CERTIFICATE_PATH=<path-to-pfx-or-pem>AZURE_CLIENT_CERTIFICATE_PASSWORD=<certificate-password>  # Optional

AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_CERTIFICATE_PATH=<path-to-pfx-or-pem>AZURE_CLIENT_CERTIFICATE_PASSWORD=<certificate-password>  # Optional

Managed Identity

DefaultAzureCredential

The recommended credential for most scenarios. Tries multiple authentication methods in order. See DefaultAzureCredential overview for the current credential chain order and defaults.

Basic Usage

csharp

using Azure.Identity;using Azure.Storage.Blobs;
var credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(    new Uri("https://myaccount.blob.core.windows.net"),    credential);

using Azure.Identity;using Azure.Storage.Blobs;
var credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(    new Uri("https://myaccount.blob.core.windows.net"),    credential);

ASP.NET Core with Dependency Injection

csharp

using Azure.Identity;using Microsoft.Extensions.Azure;
builder.Services.AddAzureClients(clientBuilder =>{    clientBuilder.AddBlobServiceClient(        new Uri("https://myaccount.blob.core.windows.net"));    clientBuilder.AddSecretClient(        new Uri("https://myvault.vault.azure.net"));        // Uses DefaultAzureCredential by default    clientBuilder.UseCredential(new DefaultAzureCredential());});

using Azure.Identity;using Microsoft.Extensions.Azure;
builder.Services.AddAzureClients(clientBuilder =>{    clientBuilder.AddBlobServiceClient(        new Uri("https://myaccount.blob.core.windows.net"));    clientBuilder.AddSecretClient(        new Uri("https://myvault.vault.azure.net"));        // Uses DefaultAzureCredential by default    clientBuilder.UseCredential(new DefaultAzureCredential());});

Customizing DefaultAzureCredential

csharp

var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        ExcludeEnvironmentCredential = true,        ExcludeManagedIdentityCredential = false,        ExcludeVisualStudioCredential = false,        ExcludeAzureCliCredential = false,        ExcludeInteractiveBrowserCredential = false, // Enable interactive        TenantId = "<tenant-id>",        ManagedIdentityClientId = "<user-assigned-mi-client-id>"    });

var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        ExcludeEnvironmentCredential = true,        ExcludeManagedIdentityCredential = false,        ExcludeVisualStudioCredential = false,        ExcludeAzureCliCredential = false,        ExcludeInteractiveBrowserCredential = false, // Enable interactive        TenantId = "<tenant-id>",        ManagedIdentityClientId = "<user-assigned-mi-client-id>"    });

Credential Types

ManagedIdentityCredential (Production)

csharp

// System-assigned managed identityvar credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
// User-assigned by client IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));
// User-assigned by resource IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedResourceId("<resource-id>"));
// User-assigned by object IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedObjectId("<object-id>"));

// System-assigned managed identityvar credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
// User-assigned by client IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));
// User-assigned by resource IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedResourceId("<resource-id>"));
// User-assigned by object IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedObjectId("<object-id>"));

ClientSecretCredential

csharp

var credential = new ClientSecretCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    clientSecret: "<client-secret>");
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

var credential = new ClientSecretCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    clientSecret: "<client-secret>");
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

ClientCertificateCredential

csharp

var certificate = X509CertificateLoader.LoadCertificateFromFile("MyCertificate.pfx");var credential = new ClientCertificateCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    certificate);

var certificate = X509CertificateLoader.LoadCertificateFromFile("MyCertificate.pfx");var credential = new ClientCertificateCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    certificate);

ChainedTokenCredential (Custom Chain)

csharp

var credential = new ChainedTokenCredential(    new ManagedIdentityCredential(),    new AzureCliCredential());
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

var credential = new ChainedTokenCredential(    new ManagedIdentityCredential(),    new AzureCliCredential());
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

Developer Credentials

csharp

// Azure CLIvar credential = new AzureCliCredential();
// Azure PowerShellvar credential = new AzurePowerShellCredential();
// Azure Developer CLI (azd)var credential = new AzureDeveloperCliCredential();
// Visual Studiovar credential = new VisualStudioCredential();
// Interactive Browservar credential = new InteractiveBrowserCredential();

// Azure CLIvar credential = new AzureCliCredential();
// Azure PowerShellvar credential = new AzurePowerShellCredential();
// Azure Developer CLI (azd)var credential = new AzureDeveloperCliCredential();
// Visual Studiovar credential = new VisualStudioCredential();
// Interactive Browservar credential = new InteractiveBrowserCredential();

Environment-Based Configuration

csharp

// Production vs DevelopmentTokenCredential credential = builder.Environment.IsProduction()    ? new ManagedIdentityCredential("<client-id>")    : new DefaultAzureCredential();

// Production vs DevelopmentTokenCredential credential = builder.Environment.IsProduction()    ? new ManagedIdentityCredential("<client-id>")    : new DefaultAzureCredential();

Sovereign Clouds

csharp

var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        AuthorityHost = AzureAuthorityHosts.AzureGovernment    });
// Available authority hosts:// AzureAuthorityHosts.AzurePublicCloud (default)// AzureAuthorityHosts.AzureGovernment// AzureAuthorityHosts.AzureChina

var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        AuthorityHost = AzureAuthorityHosts.AzureGovernment    });
// Available authority hosts:// AzureAuthorityHosts.AzurePublicCloud (default)// AzureAuthorityHosts.AzureGovernment// AzureAuthorityHosts.AzureChina

Credential Types Reference

Category	Credential	Purpose
Chains	`DefaultAzureCredential`	Preconfigured chain for dev-to-prod
	`ChainedTokenCredential`	Custom credential chain
Azure-Hosted	`ManagedIdentityCredential`	Azure managed identity
	`WorkloadIdentityCredential`	Kubernetes workload identity
	`EnvironmentCredential`	Environment variables
Service Principal	`ClientSecretCredential`	Client ID + secret
	`ClientCertificateCredential`	Client ID + certificate
	`ClientAssertionCredential`	Signed client assertion
User	`InteractiveBrowserCredential`	Browser-based auth
	`DeviceCodeCredential`	Device code flow
	`OnBehalfOfCredential`	Delegated identity
Developer	`AzureCliCredential`	Azure CLI
	`AzurePowerShellCredential`	Azure PowerShell
	`AzureDeveloperCliCredential`	Azure Developer CLI
	`VisualStudioCredential`	Visual Studio

Best Practices

1. Use Deterministic Credentials in Production

csharp

// Developmentvar devCredential = new DefaultAzureCredential();
// Production - use specific credentialvar prodCredential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));

// Developmentvar devCredential = new DefaultAzureCredential();
// Production - use specific credentialvar prodCredential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));

2. Reuse Credential Instances

csharp

// Good: Single credential instance shared across clientsvar credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(blobUri, credential);var secretClient = new SecretClient(vaultUri, credential);

// Good: Single credential instance shared across clientsvar credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(blobUri, credential);var secretClient = new SecretClient(vaultUri, credential);

3. Configure Retry Policies

csharp

var options = new ManagedIdentityCredentialOptions(    ManagedIdentityId.FromUserAssignedClientId(clientId)){    Retry =    {        MaxRetries = 3,        Delay = TimeSpan.FromSeconds(0.5),    }};var credential = new ManagedIdentityCredential(options);

var options = new ManagedIdentityCredentialOptions(    ManagedIdentityId.FromUserAssignedClientId(clientId)){    Retry =    {        MaxRetries = 3,        Delay = TimeSpan.FromSeconds(0.5),    }};var credential = new ManagedIdentityCredential(options);

4. Enable Logging for Debugging

csharp

using Azure.Core.Diagnostics;
using AzureEventSourceListener listener = new((args, message) =>{    if (args is { EventSource.Name: "Azure-Identity" })    {        Console.WriteLine(message);    }}, EventLevel.LogAlways);

using Azure.Core.Diagnostics;
using AzureEventSourceListener listener = new((args, message) =>{    if (args is { EventSource.Name: "Azure-Identity" })    {        Console.WriteLine(message);    }}, EventLevel.LogAlways);

Error Handling

csharp

using Azure.Identity;using Azure.Security.KeyVault.Secrets;
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    new DefaultAzureCredential());
try{    KeyVaultSecret secret = await client.GetSecretAsync("secret1");}catch (AuthenticationFailedException e){    Console.WriteLine($"Authentication Failed: {e.Message}");}catch (CredentialUnavailableException e){    Console.WriteLine($"Credential Unavailable: {e.Message}");}

using Azure.Identity;using Azure.Security.KeyVault.Secrets;
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    new DefaultAzureCredential());
try{    KeyVaultSecret secret = await client.GetSecretAsync("secret1");}catch (AuthenticationFailedException e){    Console.WriteLine($"Authentication Failed: {e.Message}");}catch (CredentialUnavailableException e){    Console.WriteLine($"Credential Unavailable: {e.Message}");}

Key Exceptions

Exception	Description
`AuthenticationFailedException`	Base exception for authentication errors
`CredentialUnavailableException`	Credential cannot authenticate in current environment
`AuthenticationRequiredException`	Interactive authentication is required

Managed Identity Support

Supported Azure services:

Azure App Service and Azure Functions
Azure Arc
Azure Cloud Shell
Azure Kubernetes Service (AKS)
Azure Service Fabric
Azure Virtual Machines
Azure Virtual Machine Scale Sets

Thread Safety

All credential implementations are thread-safe. A single credential instance can be safely shared across multiple clients and threads.

Related packages

Package	Purpose	Install
`Azure.Identity`	Authentication (this library)	`dotnet add package Azure.Identity`
`Microsoft.Extensions.Azure`	DI integration	`dotnet add package Microsoft.Extensions.Azure`
`Azure.Identity.Broker`	Brokered auth	`dotnet add package Azure.Identity.Broker`

Reference Links

Resource	URL
NuGet Package	https://www.nuget.org/packages/Azure.Identity
API Reference	https://learn.microsoft.com/dotnet/api/azure.identity
Credential Chains	https://aka.ms/azsdk/net/identity/credential-chains
Best Practices	https://learn.microsoft.com/dotnet/azure/sdk/authentication/best-practices
GitHub Source	https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/identity/Azure.Identity

Source and attribution

Source:microsoft/skillsin.github/plugins/azure-sdk-dotnet/skills/azure-identity-dotnetat commit354361d

License: MIT

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Azure Identity Dotnet

Azure Identity library for .NET

Installation

Environment Variables

Service Principal with Secret

Service Principal with Certificate

Managed Identity

DefaultAzureCredential

Basic Usage

ASP.NET Core with Dependency Injection

Customizing DefaultAzureCredential

Credential Types

ManagedIdentityCredential (Production)

ClientSecretCredential

ClientCertificateCredential

ChainedTokenCredential (Custom Chain)

Developer Credentials

Environment-Based Configuration

Sovereign Clouds

Credential Types Reference

Best Practices

1. Use Deterministic Credentials in Production

2. Reuse Credential Instances

3. Configure Retry Policies

4. Enable Logging for Debugging

Error Handling

Key Exceptions

Managed Identity Support

Thread Safety

Related packages

Reference Links

Source and attribution

More from microsoft/skills

Customize

Discover Azure Skills

Azure Resource Visualizer

Azure Resource Lookup

Azure Messaging

Azure Kusto

More in Software Development

Playground

M5 Onboard

Cardputer Buddy

Web Design Guidelines

Gemini Live Api

Gemini Api