Document AZURE_TOKEN_CREDENTIALS env var in credential chains doc (#46495)

* Document AZURE_TOKEN_CREDENTIALS env var in credential chains doc

* Update mermaid diagram

* Add more clarity

* React to feedback

Author: scottaddie

docs/azure/sdk/authentication/credential-chains.md

@@ -2,7 +2,7 @@
 title: 'Credential chains in the Azure Identity library for .NET'
 description: 'This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity library.'
 ms.topic: conceptual
-ms.date: 02/13/2025
+ms.date: 05/30/2025
 ---
 
 # Credential chains in the Azure Identity library for .NET
@@ -70,7 +70,11 @@ In its simplest form, you can use the parameterless version of `DefaultAzureCred
 
 ### How to customize DefaultAzureCredential
 
-To remove a credential from `DefaultAzureCredential`, use the corresponding `Exclude`-prefixed property in [DefaultAzureCredentialOptions](/dotnet/api/azure.identity.defaultazurecredentialoptions?view=azure-dotnet&preserve-view=true#properties). For example:
+The following sections describe strategies for omitting credentials from the chain.
+
+#### Exclude an individual credential
+
+To exclude an individual credential from `DefaultAzureCredential`, use the corresponding `Exclude`-prefixed property in [DefaultAzureCredentialOptions](/dotnet/api/azure.identity.defaultazurecredentialoptions?view=azure-dotnet&preserve-view=true#properties). For example:
 
 :::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_DacExcludes" highlight="11-13":::
 
@@ -93,6 +97,19 @@ As more `Exclude`-prefixed properties are set to `true` (credential exclusions a
 
 ---
 
+#### Exclude a credential type category
+
+To exclude all `Developer tool` or `Deployed service` credentials, set environment variable `AZURE_TOKEN_CREDENTIALS` to `prod` or `dev`, respectively. When a value of `prod` is used, the underlying credential chain looks as follows:
+
+:::image type="content" source="../media/mermaidjs/DefaultAzureCredentialEnvVarProd.svg" alt-text="DefaultAzureCredential with AZURE_TOKEN_CREDENTIALS set to 'prod'":::
+
+When a value of `dev` is used, the chain looks as follows:
+
+:::image type="content" source="../media/mermaidjs/DefaultAzureCredentialEnvVarDev.svg" alt-text="DefaultAzureCredential with AZURE_TOKEN_CREDENTIALS set to 'dev'":::
+
+> [!IMPORTANT]
+> The `AZURE_TOKEN_CREDENTIALS` environment variable is supported in `Azure.Identity` package versions 1.14.0 and later.
+
 ## ChainedTokenCredential overview
 
 [ChainedTokenCredential](/dotnet/api/azure.identity.chainedtokencredential?view=azure-dotnet&preserve-view=true) is an empty chain to which you add credentials to suit your app's needs. For example:

docs/azure/sdk/media/mermaidjs/DefaultAzureCredentialEnvVarDev.md

@@ -0,0 +1,31 @@
+---
+ms.topic: include
+ms.date: 05/30/2025
+---
+
+```mermaid
+%% STEPS TO GENERATE IMAGE
+%% =======================
+%% 1. Install mermaid CLI v10.9.1 (see https://github.com/mermaid-js/mermaid-cli/blob/master/README.md):
+%%    npm i -g @mermaid-js/[email protected]
+%% 2. Run command: mmdc -i DefaultAzureCredentialEnvVarDev.md -o ../../media/mermaidjs/DefaultAzureCredentialEnvVarDev.svg
+
+%%{
+  init: {
+    'theme': 'base',
+    'themeVariables': {
+      'tertiaryBorderColor': '#fff',
+      'tertiaryColor': '#fff'
+    }
+  }
+}%%
+
+flowchart LR;
+    accTitle: DefaultAzureCredential authentication flow without deployed service credentials;
+    accDescr: Flowchart showing the credential chain implemented by DefaultAzureCredential when AZURE_TOKEN_CREDENTIALS is set to "dev";
+
+    D(Visual Studio):::developer --> E(Azure CLI):::developer --> F(Azure PowerShell):::developer --> G(Azure Developer CLI):::developer;
+
+    %% Define styles for credential type boxes
+    classDef developer fill:#F5AF6F, stroke:#EB7C39, stroke-width:2px;
+```

docs/azure/sdk/media/mermaidjs/DefaultAzureCredentialEnvVarDev.svg

@@ -0,0 +1,31 @@
+---
+ms.topic: include
+ms.date: 05/30/2025
+---
+
+```mermaid
+%% STEPS TO GENERATE IMAGE
+%% =======================
+%% 1. Install mermaid CLI v10.9.1 (see https://github.com/mermaid-js/mermaid-cli/blob/master/README.md):
+%%    npm i -g @mermaid-js/[email protected]
+%% 2. Run command: mmdc -i DefaultAzureCredentialEnvVarProd.md -o ../../media/mermaidjs/DefaultAzureCredentialEnvVarProd.svg
+
+%%{
+  init: {
+    'theme': 'base',
+    'themeVariables': {
+      'tertiaryBorderColor': '#fff',
+      'tertiaryColor': '#fff'
+    }
+  }
+}%%
+
+flowchart LR;
+    accTitle: DefaultAzureCredential authentication flow without developer tool credentials;
+    accDescr: Flowchart showing the credential chain implemented by DefaultAzureCredential when AZURE_TOKEN_CREDENTIALS is set to "prod";
+
+    A(Environment):::deployed --> B(Workload Identity):::deployed --> C(Managed Identity):::deployed;
+
+    %% Define styles for credential type boxes
+    classDef deployed fill:#95C37E, stroke:#71AD4C, stroke-width:2px;
+```