Azure Identity Dotnet

作者 microsoft354361d83247MIT收录于 2026年10月8日更新于 2026年10月8日

Azure Identity library for .NET. Authentication library for Azure SDK clients using Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and developer credentials. Triggers: "Azure Identity", "DefaultAzureCredential", "ManagedIdentityCredential", "ClientSecretCredential", "authentication .NET", "Azure auth", "credential chain".

精选仅含说明Software DevelopmentDevOps & Cloud
AI 生成的概览

面向 .NET 应用的 Azure 身份验证参考指南，介绍 Azure.Identity 库及其凭据类型。

功能
提供 Azure.Identity .NET 库的使用指导，涵盖安装、环境变量以及 DefaultAzureCredential、ManagedIdentityCredential、ClientSecretCredential 和开发人员凭据等凭据类。内容包含依赖注入、主权云、重试策略、日志记录、错误处理和线程安全的代码示例。交付物是带 C# 示例的说明文档，而非可执行脚本。
适用场景
适用于编写或审查通过 Microsoft Entra ID 向 Azure 服务进行身份验证的 .NET 代码。适合处理凭据链、托管标识、服务主体，或为开发与生产环境选择凭据的问题。
运行要求
需要 .NET SDK 和 Azure.Identity NuGet 包，可选 Microsoft.Extensions.Azure 与 Azure.Identity.Broker 包。实际身份验证需要 Azure 凭据或环境变量。不包含脚本，仅为说明性内容。

Azure Identity library for .NET

Authentication library for Azure SDK clients using Microsoft Entra ID.

Installation

bash
dotnet add package Azure.Identity
# For ASP.NET Core integrationdotnet add package Microsoft.Extensions.Azure
# For brokered authentication and Visual Studio Code credential supportdotnet add package Azure.Identity.Broker

Environment Variables

Service Principal with Secret

bash
AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_SECRET=<client-secret-value>

Service Principal with Certificate

bash
AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_CERTIFICATE_PATH=<path-to-pfx-or-pem>AZURE_CLIENT_CERTIFICATE_PASSWORD=<certificate-password>  # Optional

Managed Identity

bash
AZURE_CLIENT_ID=<user-assigned-managed-identity-client-id>  # Only for user-assigned

DefaultAzureCredential

The recommended credential for most scenarios. Tries multiple authentication methods in order. See DefaultAzureCredential overview for the current credential chain order and defaults.

Basic Usage

csharp
using Azure.Identity;using Azure.Storage.Blobs;
var credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(    new Uri("https://myaccount.blob.core.windows.net"),    credential);

ASP.NET Core with Dependency Injection

csharp
using Azure.Identity;using Microsoft.Extensions.Azure;
builder.Services.AddAzureClients(clientBuilder =>{    clientBuilder.AddBlobServiceClient(        new Uri("https://myaccount.blob.core.windows.net"));    clientBuilder.AddSecretClient(        new Uri("https://myvault.vault.azure.net"));        // Uses DefaultAzureCredential by default    clientBuilder.UseCredential(new DefaultAzureCredential());});

Customizing DefaultAzureCredential

csharp
var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        ExcludeEnvironmentCredential = true,        ExcludeManagedIdentityCredential = false,        ExcludeVisualStudioCredential = false,        ExcludeAzureCliCredential = false,        ExcludeInteractiveBrowserCredential = false, // Enable interactive        TenantId = "<tenant-id>",        ManagedIdentityClientId = "<user-assigned-mi-client-id>"    });

Credential Types

ManagedIdentityCredential (Production)

csharp
// System-assigned managed identityvar credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
// User-assigned by client IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));
// User-assigned by resource IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedResourceId("<resource-id>"));
// User-assigned by object IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedObjectId("<object-id>"));

ClientSecretCredential

csharp
var credential = new ClientSecretCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    clientSecret: "<client-secret>");
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

ClientCertificateCredential

csharp
var certificate = X509CertificateLoader.LoadCertificateFromFile("MyCertificate.pfx");var credential = new ClientCertificateCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    certificate);

ChainedTokenCredential (Custom Chain)

csharp
var credential = new ChainedTokenCredential(    new ManagedIdentityCredential(),    new AzureCliCredential());
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

Developer Credentials

csharp
// Azure CLIvar credential = new AzureCliCredential();
// Azure PowerShellvar credential = new AzurePowerShellCredential();
// Azure Developer CLI (azd)var credential = new AzureDeveloperCliCredential();
// Visual Studiovar credential = new VisualStudioCredential();
// Interactive Browservar credential = new InteractiveBrowserCredential();

Environment-Based Configuration

csharp
// Production vs DevelopmentTokenCredential credential = builder.Environment.IsProduction()    ? new ManagedIdentityCredential("<client-id>")    : new DefaultAzureCredential();

Sovereign Clouds

csharp
var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        AuthorityHost = AzureAuthorityHosts.AzureGovernment    });
// Available authority hosts:// AzureAuthorityHosts.AzurePublicCloud (default)// AzureAuthorityHosts.AzureGovernment// AzureAuthorityHosts.AzureChina

Credential Types Reference

CategoryCredentialPurpose
ChainsDefaultAzureCredentialPreconfigured chain for dev-to-prod
ChainedTokenCredentialCustom credential chain
Azure-HostedManagedIdentityCredentialAzure managed identity
WorkloadIdentityCredentialKubernetes workload identity
EnvironmentCredentialEnvironment variables
Service PrincipalClientSecretCredentialClient ID + secret
ClientCertificateCredentialClient ID + certificate
ClientAssertionCredentialSigned client assertion
UserInteractiveBrowserCredentialBrowser-based auth
DeviceCodeCredentialDevice code flow
OnBehalfOfCredentialDelegated identity
DeveloperAzureCliCredentialAzure CLI
AzurePowerShellCredentialAzure PowerShell
AzureDeveloperCliCredentialAzure Developer CLI
VisualStudioCredentialVisual Studio

Best Practices

1. Use Deterministic Credentials in Production

csharp
// Developmentvar devCredential = new DefaultAzureCredential();
// Production - use specific credentialvar prodCredential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));

2. Reuse Credential Instances

csharp
// Good: Single credential instance shared across clientsvar credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(blobUri, credential);var secretClient = new SecretClient(vaultUri, credential);

3. Configure Retry Policies

csharp
var options = new ManagedIdentityCredentialOptions(    ManagedIdentityId.FromUserAssignedClientId(clientId)){    Retry =    {        MaxRetries = 3,        Delay = TimeSpan.FromSeconds(0.5),    }};var credential = new ManagedIdentityCredential(options);

4. Enable Logging for Debugging

csharp
using Azure.Core.Diagnostics;
using AzureEventSourceListener listener = new((args, message) =>{    if (args is { EventSource.Name: "Azure-Identity" })    {        Console.WriteLine(message);    }}, EventLevel.LogAlways);

Error Handling

csharp
using Azure.Identity;using Azure.Security.KeyVault.Secrets;
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    new DefaultAzureCredential());
try{    KeyVaultSecret secret = await client.GetSecretAsync("secret1");}catch (AuthenticationFailedException e){    Console.WriteLine($"Authentication Failed: {e.Message}");}catch (CredentialUnavailableException e){    Console.WriteLine($"Credential Unavailable: {e.Message}");}

Key Exceptions

ExceptionDescription
AuthenticationFailedExceptionBase exception for authentication errors
CredentialUnavailableExceptionCredential cannot authenticate in current environment
AuthenticationRequiredExceptionInteractive authentication is required

Managed Identity Support

Supported Azure services:

  • Azure App Service and Azure Functions
  • Azure Arc
  • Azure Cloud Shell
  • Azure Kubernetes Service (AKS)
  • Azure Service Fabric
  • Azure Virtual Machines
  • Azure Virtual Machine Scale Sets

Thread Safety

All credential implementations are thread-safe. A single credential instance can be safely shared across multiple clients and threads.

Related packages

PackagePurposeInstall
Azure.IdentityAuthentication (this library)dotnet add package Azure.Identity
Microsoft.Extensions.AzureDI integrationdotnet add package Microsoft.Extensions.Azure
Azure.Identity.BrokerBrokered authdotnet add package Azure.Identity.Broker

Reference Links

ResourceURL
NuGet Packagehttps://www.nuget.org/packages/Azure.Identity
API Referencehttps://learn.microsoft.com/dotnet/api/azure.identity
Credential Chainshttps://aka.ms/azsdk/net/identity/credential-chains
Best Practiceshttps://learn.microsoft.com/dotnet/azure/sdk/authentication/best-practices
GitHub Sourcehttps://github.com/Azure/azure-sdk-for-net/tree/main/sdk/identity/Azure.Identity

来源与署名

来源：microsoft/skills位于.github/plugins/azure-sdk-dotnet/skills/azure-identity-dotnet提交354361d

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 microsoft/skills 的技能

Customize

microsoft

精选

以交互式引导流程部署 Azure OpenAI 模型，可自定义版本、SKU、容量和内容筛选。

DevOps & Cloud2026年10月8日

Discover Azure Skills

microsoft

精选

搜索 GitHub 上的 Azure 技能目录，并推荐与 Azure 任务匹配的可安装智能体技能。

AI & Agents2026年10月8日

Azure Resource Visualizer

microsoft

精选

分析 Azure 资源组，并生成包含详细 Mermaid 架构图及资源关系说明的 Markdown 文档。

DevOps & Cloud2026年10月8日

Azure Resource Lookup

microsoft

精选

使用 Azure Resource Graph 查询和 MCP 工具，跨订阅列出和查找 Azure 资源。

DevOps & Cloud2026年10月8日

Azure Messaging

microsoft

精选

排查并解决 Azure 事件中心和 Service Bus SDK 的连接、身份验证和消息处理问题。

DevOps & Cloud2026年10月8日

Azure Kusto

microsoft

精选

在 Azure Data Explorer（Kusto）中执行 KQL 查询并浏览架构，用于日志、遥测和时间序列分析。

Data & Analytics2026年10月8日

更多Software Development技能

Playground

anthropics

精选

构建自包含的交互式 HTML 演练场，包含控件、实时预览和可复制的提示词输出。

Software Development37K今天更新

M5 Onboard

anthropics

精选

通过 USB 检测 M5Stack ESP32 开发板，刷写 UIFlow 2.0 固件并安装 MicroPython 应用包。

Software Development37K今天更新

Cardputer Buddy

anthropics

精选

指导迭代 Cardputer-Adv 的 MicroPython 应用包：添加应用、通过 USB 串口推送文件、查看日志并运行 REPL 命令。

Software Development37K今天更新

Testing Strategy

anthropics

精选

设计测试策略与测试计划，涵盖测试类型、覆盖率目标与示例测试用例。

Software Development27K今天更新

Tech Debt

anthropics

精选

识别、分类并排序技术债务，产出评分后的待办清单与分阶段整改计划。

Software Development27K今天更新

System Design

anthropics

精选

通过需求、高层设计、深入设计、扩展与权衡分析来指导系统与架构设计。

Software Development27K今天更新