Skip to content

Commit 3df436a

Browse files
Apply suggestions from code review
Co-authored-by: Scott Addie <[email protected]>
1 parent d07ab12 commit 3df436a

File tree

2 files changed

+4
-5
lines changed

2 files changed

+4
-5
lines changed

docs/azure/sdk/includes/default-azure-credential-usage.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,19 @@ In a production environment, the unpredictability of `DefaultAzureCredential` ca
1111
1. For months, a .NET app hosted on an Azure Virtual Machine (VM) successfully uses `DefaultAzureCredential` to authenticate via managed identity.
1212
1. Without telling the support team, a developer installs the Azure CLI on that VM and runs the `az login` command to authenticate to Azure.
1313
1. Due to a separate configuration change in the Azure environment, authentication via the original managed identity unexpectedly begins to fail silently.
14-
1. `DefaultAzureCredential` skips the failed `ManagedIdentityCredential` and searches for the next available credential, which is the Azure CLI credentials.
14+
1. `DefaultAzureCredential` skips the failed `ManagedIdentityCredential` and searches for the next available credential, which is `AzureCliCredential`.
1515
1. The application starts utilizing the Azure CLI credentials rather than the managed identity, which may fail or result in unexpected elevation or reduction of privileges.
1616

1717
To prevent these types of subtle issues or silent failures in production apps, strongly consider moving from `DefaultAzureCredential` to one of the following deterministic solutions:
1818

1919
- A specific `TokenCredential` implementation, such as `ManagedIdentityCredential`. See the [**Derived** list](/dotnet/api/azure.core.tokencredential?view=azure-dotnet&preserve-view=true#definition) for options.
2020
- A pared-down `ChainedTokenCredential` implementation optimized for the Azure environment in which your app runs. `ChainedTokenCredential` essentially creates a specific allow-list of acceptable credential options, such as `ManagedIdentity` for production and `VisualStudioCredential` for development.
2121

22-
For example, consider the following `DefaultAzureCredential` configuration:
22+
For example, consider the following `DefaultAzureCredential` configuration in an ASP.NET Core project:
2323

2424
:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_Dac" highlight="6,7":::
2525

26-
Replace the preceding code with the following `ChainedTokenCredential` implementation to intentionally specify your desired credentials:
26+
Replace the preceding code with a `ChainedTokenCredential` implementation that specifies only the necessary credentials:
2727

2828
:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_Ctc" highlight="6-8":::
2929

docs/azure/sdk/snippets/authentication/best-practices/Program.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@
1212
clientBuilder.AddSecretClient(new Uri("<key-vault-url>"));
1313
clientBuilder.AddBlobServiceClient(new Uri("<blob-storage-uri>"));
1414

15-
DefaultAzureCredential credential = new();
16-
clientBuilder.UseCredential(credential);
15+
clientBuilder.UseCredential(new DefaultAzureCredential());
1716
});
1817
#endregion snippet_credential_reuse_Dac
1918

0 commit comments

Comments
 (0)