update to Azure.Identity >= 1.15

[cataggar]

What problem would the feature you're requesting solve? Please describe.

I would like to be able to specify the specific credential that Azure Functions Host uses by setting an AZURE_TOKEN_CREDENTIALS environment variable as documented here.

Describe the solution you'd like

Bump from 1.14.2 to 1.15.0 or higher.
https://www.nuget.org/packages/Azure.Identity

[jviau]

I would like to be able to specify the specific credential that Azure Functions Host uses

@cataggar can you clarify which credential you are trying to control here? There is no single credential in the host. Each extension is responsible for creating their own credentials for whatever resources they access. There are really only 2 credentials the host itself controls: accessing application insights and Azure Storage (via AzureWebJobsStorage).

[cataggar]

@jviau, the Azure Storage that the host uses. Is Copilot correct:

---

Based on the code in the Azure/azure-functions-host repository, the process for creating Azure Storage service clients (which would be used for AzureWebJobsStorage) is handled by the StorageClientProvider class, which uses an AzureComponentFactory to create clients.

When a connection string is not specified, it falls back to a default account, and a credential is created via _componentFactory.CreateTokenCredential(connectionSection). In Azure's client libraries, DefaultAzureCredential is the typical default used unless overridden, and the naming strongly suggests this class is responsible for returning a DefaultAzureCredential if no explicit credentials are configured.

However, the precise use of DefaultAzureCredential is not explicitly named in the returned code, but the flow and Azure SDK conventions indicate that AzureWebJobsStorage can use DefaultAzureCredential via this mechanism when a connection string isn’t provided.

Summary:

• If AzureWebJobsStorage is not set (no connection string), StorageClientProvider uses the Azure SDK credential factory.
• That factory will typically use DefaultAzureCredential unless overridden.
• If you set a connection string, it will use the connection string instead.

References:

• StorageClientProvider.cs

In short:
Yes, AzureWebJobsStorage will use DefaultAzureCredential when a connection string is not provided, through the Azure client credential factory logic. If a connection string is set, that will be used instead.