[DKM] Use ManagedIdentityCredential Instead of DefaultAzureCredential Across Repositories

Priyanka-Microsoft · Priyanka-Microsoft · commit 572df9ed30ae · 2025-07-30T19:51:16.000+05:30
diff --git a/App/backend-api/Microsoft.GS.DPS.Host/AppConfiguration/AppConfiguration.cs b/App/backend-api/Microsoft.GS.DPS.Host/AppConfiguration/AppConfiguration.cs
@@ -1,6 +1,7 @@
 ﻿using Azure.Identity;
 using Microsoft.Extensions.Azure;
 using Microsoft.GS.DPSHost.AppConfiguration;
+using Microsoft.GS.DPSHost.Helpers;
 
 namespace Microsoft.GS.DPSHost.AppConfiguration
 {
@@ -16,7 +17,7 @@ public static void Config(IHostApplicationBuilder builder)
             //Read AppConfiguration with managed Identity
             builder.Configuration.AddAzureAppConfiguration(options =>
             {
-                options.Connect(new Uri(builder.Configuration["ConnectionStrings:AppConfig"]), new DefaultAzureCredential());
+                options.Connect(new Uri(builder.Configuration["ConnectionStrings:AppConfig"]), AzureCredentialHelper.GetAzureCredential());
             });
 
             //Read ServiceConfiguration
diff --git a/App/backend-api/Microsoft.GS.DPS.Host/Helpers/azure_credential_utils.cs b/App/backend-api/Microsoft.GS.DPS.Host/Helpers/azure_credential_utils.cs
@@ -0,0 +1,31 @@
+using System;
+using System.Threading.Tasks;
+using Azure.Core;
+using Azure.Identity;
+
+namespace Microsoft.GS.DPSHost.Helpers
+{
+    public static class AzureCredentialHelper
+    {
+        public static TokenCredential GetAzureCredential(string clientId = null)
+        {
+            var env = Environment.GetEnvironmentVariable("APP_ENV") ?? "prod";
+
+            if (string.Equals(env, "dev", StringComparison.OrdinalIgnoreCase))
+            {
+                return new DefaultAzureCredential(); // For local development
+            }
+            else
+            {
+                return clientId != null
+                    ? new ManagedIdentityCredential(clientId)
+                    : new ManagedIdentityCredential();
+            }
+        }
+
+        public static Task<TokenCredential> GetAzureCredentialAsync(string clientId = null)
+        {
+            return Task.FromResult(GetAzureCredential(clientId));
+        }
+    }
+}
diff --git a/App/kernel-memory/Directory.Packages.props b/App/kernel-memory/Directory.Packages.props
@@ -7,7 +7,7 @@
     <PackageVersion Include="AWSSDK.S3" Version="3.7.310.4" />
     <PackageVersion Include="Azure.AI.DocumentIntelligence" Version="1.0.0" />
     <PackageVersion Include="Azure.AI.FormRecognizer" Version="4.1.0" />
-    <PackageVersion Include="Azure.Core" Version="1.42.0" />
+    <PackageVersion Include="Azure.Core" Version="1.47.1" />
     <PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.3.1" />
     <PackageVersion Include="Azure.Identity" Version="1.12.0" />
     <PackageVersion Include="Azure.Search.Documents" Version="11.5.1" />
diff --git a/App/kernel-memory/Helpers/Helpers.csproj b/App/kernel-memory/Helpers/Helpers.csproj
@@ -0,0 +1,14 @@
+﻿<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Azure.Core" />
+    <PackageReference Include="Azure.Identity" />
+  </ItemGroup>
+
+</Project>
diff --git a/App/kernel-memory/Helpers/azure_credential_utils.cs b/App/kernel-memory/Helpers/azure_credential_utils.cs
@@ -0,0 +1,29 @@
+﻿using System;
+using System.Threading.Tasks;
+using Azure.Core;
+using Azure.Identity;
+namespace Helpers;
+
+public static class azure_credential_utils
+{
+    public static TokenCredential GetAzureCredential(string clientId = null)
+    {
+        var env = Environment.GetEnvironmentVariable("APP_ENV") ?? "prod";
+
+        if (string.Equals(env, "dev", StringComparison.OrdinalIgnoreCase))
+        {
+            return new DefaultAzureCredential(); // For local development
+        }
+        else
+        {
+            return clientId != null
+                ? new ManagedIdentityCredential(clientId)
+                : new ManagedIdentityCredential();
+        }
+    }
+
+    public static Task<TokenCredential> GetAzureCredentialAsync(string clientId = null)
+    {
+        return Task.FromResult(GetAzureCredential(clientId));
+    }
+}
diff --git a/App/kernel-memory/extensions/AzureAIDocIntel/AzureAIDocIntel.csproj b/App/kernel-memory/extensions/AzureAIDocIntel/AzureAIDocIntel.csproj
@@ -8,10 +8,6 @@
         <NoWarn>$(NoWarn);KMEXP02;CA1724;CA1308;</NoWarn>
     </PropertyGroup>
 
-    <ItemGroup>
-        <ProjectReference Include="..\..\service\Abstractions\Abstractions.csproj" />
-    </ItemGroup>
-
     <ItemGroup>
         <PackageReference Include="Azure.Identity" />
         <PackageReference Include="Azure.AI.FormRecognizer" />
@@ -30,4 +26,9 @@
         <None Include="README.md" Link="README.md" Pack="true" PackagePath="." Visible="false" />
     </ItemGroup>
 
+    <ItemGroup>
+      <ProjectReference Include="..\..\Helpers\Helpers.csproj" />
+      <ProjectReference Include="..\..\service\Abstractions\Abstractions.csproj" />
+    </ItemGroup>
+
 </Project>
diff --git a/App/kernel-memory/extensions/AzureAIDocIntel/AzureAIDocIntelEngine.cs b/App/kernel-memory/extensions/AzureAIDocIntel/AzureAIDocIntelEngine.cs
@@ -8,9 +8,11 @@
 using Azure;
 using Azure.AI.FormRecognizer.DocumentAnalysis;
 using Azure.Identity;
+using Helpers;
 using Microsoft.Extensions.Logging;
 using Microsoft.KernelMemory.Diagnostics;
 
+
 namespace Microsoft.KernelMemory.DataFormats.AzureAIDocIntel;
 
 /// <summary>
@@ -36,7 +38,7 @@ public AzureAIDocIntelEngine(
         switch (config.Auth)
         {
             case AzureAIDocIntelConfig.AuthTypes.AzureIdentity:
-                this._recognizerClient = new DocumentAnalysisClient(new Uri(config.Endpoint), new DefaultAzureCredential());
+                this._recognizerClient = new DocumentAnalysisClient(new Uri(config.Endpoint), azure_credential_utils.GetAzureCredential());
                 break;
 
             case AzureAIDocIntelConfig.AuthTypes.APIKey:
diff --git a/App/kernel-memory/extensions/AzureAISearch/AzureAISearch/AzureAISearch.csproj b/App/kernel-memory/extensions/AzureAISearch/AzureAISearch/AzureAISearch.csproj
@@ -9,6 +9,7 @@
     </PropertyGroup>
 
     <ItemGroup>
+        <ProjectReference Include="..\..\..\Helpers\Helpers.csproj" />
         <ProjectReference Include="..\..\..\service\Abstractions\Abstractions.csproj" />
     </ItemGroup>
 
diff --git a/App/kernel-memory/extensions/AzureAISearch/AzureAISearch/AzureAISearchMemory.cs b/App/kernel-memory/extensions/AzureAISearch/AzureAISearch/AzureAISearchMemory.cs
@@ -14,6 +14,7 @@
 using Azure.Search.Documents.Indexes;
 using Azure.Search.Documents.Indexes.Models;
 using Azure.Search.Documents.Models;
+using Helpers;
 using Microsoft.Extensions.Logging;
 using Microsoft.KernelMemory.AI;
 using Microsoft.KernelMemory.Diagnostics;
@@ -66,7 +67,7 @@ public AzureAISearchMemory(
             case AzureAISearchConfig.AuthTypes.AzureIdentity:
                 this._adminClient = new SearchIndexClient(
                     new Uri(config.Endpoint),
-                    new DefaultAzureCredential(),
+                    azure_credential_utils.GetAzureCredential(),
                     GetClientOptions());
                 break;
 
diff --git a/App/kernel-memory/extensions/AzureBlobs/AzureBlobs.csproj b/App/kernel-memory/extensions/AzureBlobs/AzureBlobs.csproj
@@ -9,6 +9,7 @@
     </PropertyGroup>
 
     <ItemGroup>
+        <ProjectReference Include="..\..\Helpers\Helpers.csproj" />
         <ProjectReference Include="..\..\service\Abstractions\Abstractions.csproj" />
     </ItemGroup>
 
diff --git a/App/kernel-memory/extensions/AzureBlobs/AzureBlobsStorage.cs b/App/kernel-memory/extensions/AzureBlobs/AzureBlobsStorage.cs
@@ -11,6 +11,7 @@
 using Azure.Storage.Blobs;
 using Azure.Storage.Blobs.Models;
 using Azure.Storage.Blobs.Specialized;
+using Helpers;
 using Microsoft.Extensions.Logging;
 using Microsoft.KernelMemory.Diagnostics;
 using Microsoft.KernelMemory.Pipeline;
@@ -61,7 +62,7 @@ public AzureBlobsStorage(
             {
                 this.ValidateAccountName(config.Account);
                 var suffix = this.ValidateEndpointSuffix(config.EndpointSuffix);
-                client = new BlobServiceClient(new Uri($"https://{config.Account}.blob.{suffix}"), new DefaultAzureCredential());
+                client = new BlobServiceClient(new Uri($"https://{config.Account}.blob.{suffix}"), azure_credential_utils.GetAzureCredential());
                 break;
             }
 
diff --git a/App/kernel-memory/extensions/AzureOpenAI/AzureOpenAI.csproj b/App/kernel-memory/extensions/AzureOpenAI/AzureOpenAI.csproj
@@ -9,6 +9,7 @@
     </PropertyGroup>
 
     <ItemGroup>
+        <ProjectReference Include="..\..\Helpers\Helpers.csproj" />
         <ProjectReference Include="..\..\service\Abstractions\Abstractions.csproj" />
         <ProjectReference Include="..\OpenAI\OpenAI\OpenAI.csproj" />
     </ItemGroup>
diff --git a/App/kernel-memory/extensions/AzureOpenAI/AzureOpenAITextEmbeddingGenerator.cs b/App/kernel-memory/extensions/AzureOpenAI/AzureOpenAITextEmbeddingGenerator.cs
@@ -8,6 +8,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 using Azure.Identity;
+using Helpers;
 using Microsoft.Extensions.Logging;
 using Microsoft.KernelMemory.AI.OpenAI;
 using Microsoft.KernelMemory.Diagnostics;
@@ -52,7 +53,7 @@ public AzureOpenAITextEmbeddingGenerator(
                 this._client = new AzureOpenAITextEmbeddingGenerationService(
                     deploymentName: config.Deployment,
                     endpoint: config.Endpoint,
-                    credential: new DefaultAzureCredential(),
+                    credential: azure_credential_utils.GetAzureCredential(),
                     modelId: config.Deployment,
                     httpClient: httpClient,
                     dimensions: config.EmbeddingDimensions,
diff --git a/App/kernel-memory/extensions/AzureOpenAI/AzureOpenAITextGenerator.cs b/App/kernel-memory/extensions/AzureOpenAI/AzureOpenAITextGenerator.cs
@@ -11,6 +11,7 @@
 using Azure.AI.OpenAI;
 using Azure.Core.Pipeline;
 using Azure.Identity;
+using Helpers;
 using Microsoft.Extensions.Logging;
 using Microsoft.KernelMemory.AI.AzureOpenAI.Internals;
 using Microsoft.KernelMemory.AI.OpenAI;
@@ -77,7 +78,7 @@ public AzureOpenAITextGenerator(
         switch (config.Auth)
         {
             case AzureOpenAIConfig.AuthTypes.AzureIdentity:
-                this._client = new OpenAIClient(new Uri(config.Endpoint), new DefaultAzureCredential(), options);
+                this._client = new OpenAIClient(new Uri(config.Endpoint), azure_credential_utils.GetAzureCredential(), options);
                 break;
 
             case AzureOpenAIConfig.AuthTypes.ManualTokenCredential:
diff --git a/App/kernel-memory/extensions/AzureQueues/AzureQueues.csproj b/App/kernel-memory/extensions/AzureQueues/AzureQueues.csproj
@@ -9,6 +9,7 @@
     </PropertyGroup>
 
     <ItemGroup>
+        <ProjectReference Include="..\..\Helpers\Helpers.csproj" />
         <ProjectReference Include="..\..\service\Abstractions\Abstractions.csproj" />
     </ItemGroup>
 
diff --git a/App/kernel-memory/extensions/AzureQueues/AzureQueuesPipeline.cs b/App/kernel-memory/extensions/AzureQueues/AzureQueuesPipeline.cs
@@ -11,6 +11,7 @@
 using Azure.Storage;
 using Azure.Storage.Queues;
 using Azure.Storage.Queues.Models;
+using Helpers;
 using Microsoft.Extensions.Logging;
 using Microsoft.KernelMemory.Diagnostics;
 using Microsoft.KernelMemory.DocumentStorage;
@@ -94,7 +95,7 @@ public AzureQueuesPipeline(
             {
                 this.ValidateAccountName(config.Account);
                 var suffix = this.ValidateEndpointSuffix(config.EndpointSuffix);
-                this._clientBuilder = queueName => new QueueClient(new($"https://{config.Account}.queue.{suffix}/{queueName}"), new DefaultAzureCredential());
+                this._clientBuilder = queueName => new QueueClient(new($"https://{config.Account}.queue.{suffix}/{queueName}"), azure_credential_utils.GetAzureCredential());
                 break;
             }
 
diff --git a/App/kernel-memory/service/Service/Program.cs b/App/kernel-memory/service/Service/Program.cs
@@ -4,6 +4,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using Azure.Identity;
+using Helpers;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
@@ -20,6 +21,7 @@
 using Microsoft.KernelMemory.Pipeline;
 using Microsoft.KernelMemory.Service.AspNetCore;
 
+
 // KM Configuration:
 //
 // * Settings are loaded at runtime from multiple sources, merging values.
@@ -85,7 +87,7 @@ public static void Main(string[] args)
         // Add Configuration from App Configuration Service
         appBuilder.Configuration.AddAzureAppConfiguration(options =>
         {
-            options.Connect(new Uri(appBuilder.Configuration["ConnectionStrings:AppConfig"]), new DefaultAzureCredential());
+            options.Connect(new Uri(appBuilder.Configuration["ConnectionStrings:AppConfig"]), azure_credential_utils.GetAzureCredential());
         });
 
 

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`using Azure.Identity;`
`2`	`2`	`using Microsoft.Extensions.Azure;`
`3`	`3`	`using Microsoft.GS.DPSHost.AppConfiguration;`
	`4`	`+using Microsoft.GS.DPSHost.Helpers;`
`4`	`5`
`5`	`6`	`namespace Microsoft.GS.DPSHost.AppConfiguration`
`6`	`7`	`{`
`@@ -16,7 +17,7 @@ public static void Config(IHostApplicationBuilder builder)`
`16`	`17`	`//Read AppConfiguration with managed Identity`
`17`	`18`	`builder.Configuration.AddAzureAppConfiguration(options =>`
`18`	`19`	`{`
`19`		`- options.Connect(new Uri(builder.Configuration["ConnectionStrings:AppConfig"]), new DefaultAzureCredential());`
	`20`	`+ options.Connect(new Uri(builder.Configuration["ConnectionStrings:AppConfig"]), AzureCredentialHelper.GetAzureCredential());`
`20`	`21`	`});`
`21`	`22`
`22`	`23`	`//Read ServiceConfiguration`