Azure Identity Dotnet

作者 microsoft354361d83247MIT收錄於 2026年10月8日更新於 2026年10月8日

Azure Identity library for .NET. Authentication library for Azure SDK clients using Microsoft Entra ID. Use for DefaultAzureCredential, managed identity, service principals, and developer credentials. Triggers: "Azure Identity", "DefaultAzureCredential", "ManagedIdentityCredential", "ClientSecretCredential", "authentication .NET", "Azure auth", "credential chain".

精選僅含說明Software DevelopmentDevOps & Cloud
AI 產生的概覽

適用於 .NET 應用程式的 Azure 身分驗證參考指南，說明 Azure.Identity 程式庫與其認證類型。

功能
提供 Azure.Identity .NET 程式庫的使用指引，涵蓋安裝、環境變數，以及 DefaultAzureCredential、ManagedIdentityCredential、ClientSecretCredential 與開發人員認證等認證類別。內容包含相依性注入、主權雲端、重試原則、記錄、錯誤處理與執行緒安全的程式碼範例。產出為附有 C# 範例的說明文件，而非可執行的指令碼。
適用情境
適用於撰寫或檢閱透過 Microsoft Entra ID 向 Azure 服務進行身分驗證的 .NET 程式碼。適合處理認證鏈、受控識別、服務主體，或為開發與生產環境選擇認證的問題。
執行需求
需要 .NET SDK 與 Azure.Identity NuGet 套件，可選用 Microsoft.Extensions.Azure 與 Azure.Identity.Broker 套件。實際身分驗證需要 Azure 認證或環境變數。未包含指令碼，僅為說明性內容。

Azure Identity library for .NET

Authentication library for Azure SDK clients using Microsoft Entra ID.

Installation

bash
dotnet add package Azure.Identity
# For ASP.NET Core integrationdotnet add package Microsoft.Extensions.Azure
# For brokered authentication and Visual Studio Code credential supportdotnet add package Azure.Identity.Broker

Environment Variables

Service Principal with Secret

bash
AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_SECRET=<client-secret-value>

Service Principal with Certificate

bash
AZURE_CLIENT_ID=<application-client-id>AZURE_TENANT_ID=<directory-tenant-id>AZURE_CLIENT_CERTIFICATE_PATH=<path-to-pfx-or-pem>AZURE_CLIENT_CERTIFICATE_PASSWORD=<certificate-password>  # Optional

Managed Identity

bash
AZURE_CLIENT_ID=<user-assigned-managed-identity-client-id>  # Only for user-assigned

DefaultAzureCredential

The recommended credential for most scenarios. Tries multiple authentication methods in order. See DefaultAzureCredential overview for the current credential chain order and defaults.

Basic Usage

csharp
using Azure.Identity;using Azure.Storage.Blobs;
var credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(    new Uri("https://myaccount.blob.core.windows.net"),    credential);

ASP.NET Core with Dependency Injection

csharp
using Azure.Identity;using Microsoft.Extensions.Azure;
builder.Services.AddAzureClients(clientBuilder =>{    clientBuilder.AddBlobServiceClient(        new Uri("https://myaccount.blob.core.windows.net"));    clientBuilder.AddSecretClient(        new Uri("https://myvault.vault.azure.net"));        // Uses DefaultAzureCredential by default    clientBuilder.UseCredential(new DefaultAzureCredential());});

Customizing DefaultAzureCredential

csharp
var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        ExcludeEnvironmentCredential = true,        ExcludeManagedIdentityCredential = false,        ExcludeVisualStudioCredential = false,        ExcludeAzureCliCredential = false,        ExcludeInteractiveBrowserCredential = false, // Enable interactive        TenantId = "<tenant-id>",        ManagedIdentityClientId = "<user-assigned-mi-client-id>"    });

Credential Types

ManagedIdentityCredential (Production)

csharp
// System-assigned managed identityvar credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
// User-assigned by client IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));
// User-assigned by resource IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedResourceId("<resource-id>"));
// User-assigned by object IDvar credential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedObjectId("<object-id>"));

ClientSecretCredential

csharp
var credential = new ClientSecretCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    clientSecret: "<client-secret>");
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

ClientCertificateCredential

csharp
var certificate = X509CertificateLoader.LoadCertificateFromFile("MyCertificate.pfx");var credential = new ClientCertificateCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    certificate);

ChainedTokenCredential (Custom Chain)

csharp
var credential = new ChainedTokenCredential(    new ManagedIdentityCredential(),    new AzureCliCredential());
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    credential);

Developer Credentials

csharp
// Azure CLIvar credential = new AzureCliCredential();
// Azure PowerShellvar credential = new AzurePowerShellCredential();
// Azure Developer CLI (azd)var credential = new AzureDeveloperCliCredential();
// Visual Studiovar credential = new VisualStudioCredential();
// Interactive Browservar credential = new InteractiveBrowserCredential();

Environment-Based Configuration

csharp
// Production vs DevelopmentTokenCredential credential = builder.Environment.IsProduction()    ? new ManagedIdentityCredential("<client-id>")    : new DefaultAzureCredential();

Sovereign Clouds

csharp
var credential = new DefaultAzureCredential(    new DefaultAzureCredentialOptions    {        AuthorityHost = AzureAuthorityHosts.AzureGovernment    });
// Available authority hosts:// AzureAuthorityHosts.AzurePublicCloud (default)// AzureAuthorityHosts.AzureGovernment// AzureAuthorityHosts.AzureChina

Credential Types Reference

CategoryCredentialPurpose
ChainsDefaultAzureCredentialPreconfigured chain for dev-to-prod
ChainedTokenCredentialCustom credential chain
Azure-HostedManagedIdentityCredentialAzure managed identity
WorkloadIdentityCredentialKubernetes workload identity
EnvironmentCredentialEnvironment variables
Service PrincipalClientSecretCredentialClient ID + secret
ClientCertificateCredentialClient ID + certificate
ClientAssertionCredentialSigned client assertion
UserInteractiveBrowserCredentialBrowser-based auth
DeviceCodeCredentialDevice code flow
OnBehalfOfCredentialDelegated identity
DeveloperAzureCliCredentialAzure CLI
AzurePowerShellCredentialAzure PowerShell
AzureDeveloperCliCredentialAzure Developer CLI
VisualStudioCredentialVisual Studio

Best Practices

1. Use Deterministic Credentials in Production

csharp
// Developmentvar devCredential = new DefaultAzureCredential();
// Production - use specific credentialvar prodCredential = new ManagedIdentityCredential(    ManagedIdentityId.FromUserAssignedClientId("<client-id>"));

2. Reuse Credential Instances

csharp
// Good: Single credential instance shared across clientsvar credential = new DefaultAzureCredential();var blobClient = new BlobServiceClient(blobUri, credential);var secretClient = new SecretClient(vaultUri, credential);

3. Configure Retry Policies

csharp
var options = new ManagedIdentityCredentialOptions(    ManagedIdentityId.FromUserAssignedClientId(clientId)){    Retry =    {        MaxRetries = 3,        Delay = TimeSpan.FromSeconds(0.5),    }};var credential = new ManagedIdentityCredential(options);

4. Enable Logging for Debugging

csharp
using Azure.Core.Diagnostics;
using AzureEventSourceListener listener = new((args, message) =>{    if (args is { EventSource.Name: "Azure-Identity" })    {        Console.WriteLine(message);    }}, EventLevel.LogAlways);

Error Handling

csharp
using Azure.Identity;using Azure.Security.KeyVault.Secrets;
var client = new SecretClient(    new Uri("https://myvault.vault.azure.net"),    new DefaultAzureCredential());
try{    KeyVaultSecret secret = await client.GetSecretAsync("secret1");}catch (AuthenticationFailedException e){    Console.WriteLine($"Authentication Failed: {e.Message}");}catch (CredentialUnavailableException e){    Console.WriteLine($"Credential Unavailable: {e.Message}");}

Key Exceptions

ExceptionDescription
AuthenticationFailedExceptionBase exception for authentication errors
CredentialUnavailableExceptionCredential cannot authenticate in current environment
AuthenticationRequiredExceptionInteractive authentication is required

Managed Identity Support

Supported Azure services:

  • Azure App Service and Azure Functions
  • Azure Arc
  • Azure Cloud Shell
  • Azure Kubernetes Service (AKS)
  • Azure Service Fabric
  • Azure Virtual Machines
  • Azure Virtual Machine Scale Sets

Thread Safety

All credential implementations are thread-safe. A single credential instance can be safely shared across multiple clients and threads.

Related packages

PackagePurposeInstall
Azure.IdentityAuthentication (this library)dotnet add package Azure.Identity
Microsoft.Extensions.AzureDI integrationdotnet add package Microsoft.Extensions.Azure
Azure.Identity.BrokerBrokered authdotnet add package Azure.Identity.Broker

Reference Links

ResourceURL
NuGet Packagehttps://www.nuget.org/packages/Azure.Identity
API Referencehttps://learn.microsoft.com/dotnet/api/azure.identity
Credential Chainshttps://aka.ms/azsdk/net/identity/credential-chains
Best Practiceshttps://learn.microsoft.com/dotnet/azure/sdk/authentication/best-practices
GitHub Sourcehttps://github.com/Azure/azure-sdk-for-net/tree/main/sdk/identity/Azure.Identity

來源與署名

來源：microsoft/skills位於.github/plugins/azure-sdk-dotnet/skills/azure-identity-dotnet提交354361d

授權條款： MIT

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 microsoft/skills 的技能

Customize

microsoft

精選

以互動式引導流程部署 Azure OpenAI 模型，可自訂版本、SKU、容量與內容篩選。

DevOps & Cloud2026年10月8日

Discover Azure Skills

microsoft

精選

搜尋 GitHub 上的 Azure 技能目錄，並推薦符合 Azure 工作的可安裝代理技能。

AI & Agents2026年10月8日

Azure Resource Visualizer

microsoft

精選

分析 Azure 資源群組，並產出內含詳細 Mermaid 架構圖與資源關係說明的 Markdown 文件。

DevOps & Cloud2026年10月8日

Azure Resource Lookup

microsoft

精選

使用 Azure Resource Graph 查詢與 MCP 工具，跨訂閱列出和尋找 Azure 資源。

DevOps & Cloud2026年10月8日

Azure Messaging

microsoft

精選

疑難排解並解決 Azure 事件中樞與 Service Bus SDK 的連線、驗證和訊息處理問題。

DevOps & Cloud2026年10月8日

Azure Kusto

microsoft

精選

在 Azure Data Explorer（Kusto）中執行 KQL 查詢並探索結構描述，用於日誌、遙測與時間序列分析。

Data & Analytics2026年10月8日

更多Software Development技能

Playground

anthropics

精選

建立自成一體的互動式 HTML 遊樂場，包含控制項、即時預覽與可複製的提示詞輸出。

Software Development37K今天更新

M5 Onboard

anthropics

精選

透過 USB 偵測 M5Stack ESP32 開發板，燒錄 UIFlow 2.0 韌體並安裝 MicroPython 應用程式套件。

Software Development37K今天更新

Cardputer Buddy

anthropics

精選

指導迭代 Cardputer-Adv 的 MicroPython 應用程式套件：新增應用程式、透過 USB 序列埠推送檔案、查看日誌並執行 REPL 指令。

Software Development37K今天更新

Testing Strategy

anthropics

精選

設計測試策略與測試計畫，涵蓋測試類型、覆蓋率目標與範例測試案例。

Software Development27K今天更新

Tech Debt

anthropics

精選

辨識、分類並排序技術債，產出評分後的待辦清單與分階段改善計畫。

Software Development27K今天更新

System Design

anthropics

精選

透過需求、高階設計、深入設計、擴充與取捨分析來指導系統與架構設計。

Software Development27K今天更新