Skip to content

Commit ceb62a4

Browse files
JillGrant615JillGrant615
authored
Merge pull request #7644 from scottaddie/scottaddie/dac-python
Update Python credential chains doc for 1.24.0 release
2 parents 762304a + c283793 commit ceb62a4

12 files changed

+68
-23
lines changed

‎articles/python/sdk/authentication/credential-chains.md

Lines changed: 31 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Credential chains in the Azure Identity library for Python
33
description: This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity client library.
4-
ms.date: 06/02/2025
4+
ms.date: 08/06/2025
55
ms.topic: article
66
ms.custom: devx-track-python
77
---
@@ -44,7 +44,7 @@ There are two disparate philosophies to credential chaining:
4444

4545
[DefaultAzureCredential](/python/api/azure-identity/azure.identity.defaultazurecredential) is an opinionated, preconfigured chain of credentials. It's designed to support many environments, along with the most common authentication flows and developer tools. In graphical form, the underlying chain looks like this:
4646

47-
:::image type="content" source="../media/mermaidjs/default-azure-credential-auth-flow.svg" alt-text="Diagram that shows DefaultAzureCredential authentication flow." lightbox="../media/mermaidjs/default-azure-credential-auth-flow-big.png":::
47+
:::image type="content" source="../media/mermaidjs/default-azure-credential-authentication-flow-inline.svg" alt-text="Diagram that shows DefaultAzureCredential authentication flow." lightbox="../media/mermaidjs/default-azure-credential-authentication-flow-expanded.png":::
4848

4949
The order in which `DefaultAzureCredential` attempts credentials follows.
5050

@@ -54,19 +54,24 @@ The order in which `DefaultAzureCredential` attempts credentials follows.
5454
| 2 | [Workload Identity][wi-cred] | If the app is deployed to an Azure host with Workload Identity enabled, authenticate that account. | Yes |
5555
| 3 | [Managed Identity][mi-cred] | If the app is deployed to an Azure host with Managed Identity enabled, authenticate the app to Azure using that Managed Identity. | Yes |
5656
| 4 | [Shared Token Cache][vs-cred] | On Windows only, if the developer authenticated to Azure by logging into Visual Studio, authenticate the app to Azure using that same account. | Yes |
57-
| 5 | [Azure CLI][az-cred] | If the developer authenticated to Azure using Azure CLI's `az login` command, authenticate the app to Azure using that same account. | Yes |
58-
| 6 | [Azure PowerShell][pwsh-cred] | If the developer authenticated to Azure using Azure PowerShell's `Connect-AzAccount` cmdlet, authenticate the app to Azure using that same account. | Yes |
59-
| 7 | [Azure Developer CLI][azd-cred] | If the developer authenticated to Azure using Azure Developer CLI's `azd auth login` command, authenticate with that account. | Yes |
60-
| 8 | [Interactive browser][int-cred] | If enabled, interactively authenticate the developer via the current system's default browser. | No |
57+
| 5 | [Visual Studio Code][vsc-cred] | If the developer authenticated via Visual Studio Code's [Azure Resources extension][vsc-ext] and the [azure-identity-broker package][broker-pkg] is installed, authenticate that account. | Yes |
58+
| 6 | [Azure CLI][az-cred] | If the developer authenticated to Azure using Azure CLI's `az login` command, authenticate the app to Azure using that same account. | Yes |
59+
| 7 | [Azure PowerShell][pwsh-cred] | If the developer authenticated to Azure using Azure PowerShell's `Connect-AzAccount` cmdlet, authenticate the app to Azure using that same account. | Yes |
60+
| 8 | [Azure Developer CLI][azd-cred] | If the developer authenticated to Azure using Azure Developer CLI's `azd auth login` command, authenticate with that account. | Yes |
61+
| 9 | [Interactive browser][int-cred] | If enabled, interactively authenticate the developer via the current system's default browser. | No |
62+
| 10 | [Broker][int-cred] | Authenticates using the default account logged into the OS via a broker. Requires that the [azure-identity-broker package][broker-pkg] is installed, since an instance of `InteractiveBrowserBrokerCredential` is used. | Yes |
6163

6264
[env-cred]: /python/api/azure-identity/azure.identity.environmentcredential
6365
[wi-cred]: /python/api/azure-identity/azure.identity.workloadidentitycredential
6466
[mi-cred]: /python/api/azure-identity/azure.identity.managedidentitycredential
6567
[vs-cred]: /python/api/azure-identity/azure.identity.sharedtokencachecredential
68+
[vsc-cred]: /python/api/azure-identity/azure.identity.visualstudiocodecredential
6669
[az-cred]: /python/api/azure-identity/azure.identity.azureclicredential
6770
[pwsh-cred]: /python/api/azure-identity/azure.identity.azurepowershellcredential
6871
[azd-cred]: /python/api/azure-identity/azure.identity.azuredeveloperclicredential
6972
[int-cred]: /python/api/azure-identity/azure.identity.interactivebrowsercredential
73+
[vsc-ext]: https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azureresourcegroups
74+
[broker-pkg]: https://pypi.org/project/azure-identity-broker/
7075

7176
In its simplest form, you can use the parameterless version of `DefaultAzureCredential` as follows:
7277

@@ -85,7 +90,7 @@ blob_service_client = BlobServiceClient(
8590

8691
### How to customize DefaultAzureCredential
8792

88-
The following sections describe strategies for omitting credentials from the chain.
93+
The following sections describe strategies for controlling which credentials are included in the chain.
8994

9095
#### Exclude an individual credential
9196

@@ -115,8 +120,10 @@ credential = DefaultAzureCredential(
115120
exclude_environment_credential=True,
116121
exclude_workload_identity_credential=True,
117122
exclude_shared_token_cache_credential=True,
123+
exclude_visual_studio_code_credential=True,
118124
exclude_azure_powershell_credential=True,
119125
exclude_azure_developer_cli_credential=True,
126+
exclude_broker_credential=True,
120127
managed_identity_client_id=user_assigned_client_id
121128
)
122129
```
@@ -145,6 +152,22 @@ When a value of `dev` is used, the chain looks as follows:
145152
> [!IMPORTANT]
146153
> The `AZURE_TOKEN_CREDENTIALS` environment variable is supported in `azure-identity` package versions 1.23.0 and later.
147154

155+
#### Use a specific credential
156+
157+
To exclude all credentials except for one, set environment variable `AZURE_TOKEN_CREDENTIALS` to the credential name. For example, you can reduce the `DefaultAzureCredential` chain to `AzureCliCredential` by setting `AZURE_TOKEN_CREDENTIALS` to `AzureCliCredential`. The string comparison is performed in a case-insensitive manner. Valid string values for the environment variable include:
158+
159+
- `AzureCliCredential`
160+
- `AzureDeveloperCliCredential`
161+
- `AzurePowerShellCredential`
162+
- `EnvironmentCredential`
163+
- `InteractiveBrowserCredential`
164+
- `ManagedIdentityCredential`
165+
- `VisualStudioCodeCredential`
166+
- `WorkloadIdentityCredential`
167+
168+
> [!IMPORTANT]
169+
> The `AZURE_TOKEN_CREDENTIALS` environment variable supports individual credential names in `azure-identity` package versions 1.24.0 and later.
170+
148171
## ChainedTokenCredential overview
149172

150173
[ChainedTokenCredential](/python/api/azure-identity/azure.identity.chainedtokencredential) is an empty chain to which you add credentials to suit your app's needs. For example:
@@ -158,7 +181,7 @@ credential = ChainedTokenCredential(
158181

159182
The preceding code sample creates a tailored credential chain comprised of two development-time credentials. `AzureCliCredential` is attempted first, followed by `AzureDeveloperCliCredential`, if necessary. In graphical form, the chain looks like this:
160183

161-
:::image type="content" source="../media/mermaidjs/chained-token-credential-auth-flow.svg" alt-text="Diagram that shows authentication flow for a ChainedTokenCredential instance that is composed of Azure CLI and Azure Developer CLI credentials.":::
184+
:::image type="content" source="../media/mermaidjs/chained-token-credential-authentication-flow.svg" alt-text="Diagram that shows authentication flow for a ChainedTokenCredential instance that is composed of Azure CLI and Azure Developer CLI credentials.":::
162185

163186
> [!TIP]
164187
> For improved performance, optimize credential ordering in `ChainedTokenCredential` from most to least used credential.

‎articles/python/sdk/media/mermaidjs/chained-token-credential-auth-flow.svg renamed to ‎articles/python/sdk/media/mermaidjs/chained-token-credential-authentication-flow.svg

File renamed without changes.

‎articles/python/sdk/media/mermaidjs/default-azure-credential-auth-flow-big.png

-38.2 KB
Binary file not shown.

‎articles/python/sdk/media/mermaidjs/default-azure-credential-auth-flow.svg

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎articles/python/sdk/media/mermaidjs/default-azure-credential-authentication-flow-expanded.png

16.9 KB
Loading

‎articles/python/sdk/media/mermaidjs/default-azure-credential-authentication-flow-inline.svg

Lines changed: 1 addition & 0 deletions
Loading

0 commit comments

Comments
 (0)