{ "schema": "https://ai-atoms.com/schemas/skill-v1.json", "type": "skill", "id": "skill/azure-identity-py", "version": "1.0.1", "name": "Azure Identity Py", "description": "Azure Identity SDK for Python authentication. Use for DefaultAzureCredential, managed identity, service principals, and token caching.\nTriggers: \"azure-identity\", \"DefaultAzureCredential\", \"authentication\", \"managed identity\", \"service principal\", \"credential\".", "system_prompt_fragment": "# Azure Identity SDK for Python\n\nAuthentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD).\n\n## Installation\n\n```bash\npip install azure-identity\n```\n\n## Environment Variables\n\n```bash\n# Service Principal (for production/CI)\nAZURE_TENANT_ID=\nAZURE_CLIENT_ID=\nAZURE_CLIENT_SECRET=\n\n# User-assigned Managed Identity (optional)\nAZURE_CLIENT_ID=\n```\n\n## DefaultAzureCredential\n\nThe recommended credential for most scenarios. Tries multiple authentication methods in order:\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.storage.blob import BlobServiceClient\n\n# Works in local dev AND production without code changes\ncredential = DefaultAzureCredential()\n\nclient = BlobServiceClient(\n account_url=\"https://.blob.core.windows.net\",\n credential=credential\n)\n```\n\n### Credential Chain Order\n\n| Order | Credential | Environment |\n|-------|-----------|-------------|\n| 1 | EnvironmentCredential | CI/CD, containers |\n| 2 | WorkloadIdentityCredential | Kubernetes |\n| 3 | ManagedIdentityCredential | Azure VMs, App Service, Functions |\n| 4 | SharedTokenCacheCredential | Windows only |\n| 5 | VisualStudioCodeCredential | VS Code with Azure extension |\n| 6 | AzureCliCredential | `az login` |\n| 7 | AzurePowerShellCredential | `Connect-AzAccount` |\n| 8 | AzureDeveloperCliCredential | `azd auth login` |\n\n### Customizing DefaultAzureCredential\n\n```python\n# Exclude credentials you don't need\ncredential = DefaultAzureCredential(\n exclude_environment_credential=True,\n exclude_shared_token_cache_credential=True,\n managed_identity_client_id=\"\" # For user-assigned MI\n)\n\n# Enable interactive browser (disabled by default)\ncredential = DefaultAzureCredential(\n exclude_interactive_browser_credential=False\n)\n```\n\n## Specific Credential Types\n\n### ManagedIdentityCredential\n\nFor Azure-hosted resources (VMs, App Service, Functions, AKS):\n\n```python\nfrom azure.identity import ManagedIdentityCredential\n\n# System-assigned managed identity\ncredential = ManagedIdentityCredential()\n\n# User-assigned managed identity\ncredential = ManagedIdentityCredential(\n client_id=\"\"\n)\n```\n\n### ClientSecretCredential\n\nFor service principal with secret:\n\n```python\nfrom azure.identity import ClientSecretCredential\n\ncredential = ClientSecretCredential(\n tenant_id=os.environ[\"AZURE_TENANT_ID\"],\n client_id=os.environ[\"AZURE_CLIENT_ID\"],\n client_secret=os.environ[\"AZURE_CLIENT_SECRET\"]\n)\n```\n\n### AzureCliCredential\n\nUses the account from `az login`:\n\n```python\nfrom azure.identity import AzureCliCredential\n\ncredential = AzureCliCredential()\n```\n\n### ChainedTokenCredential\n\nCustom credential chain:\n\n```python\nfrom azure.identity import (\n ChainedTokenCredential,\n ManagedIdentityCredential,\n AzureCliCredential\n)\n\n# Try managed identity first, fall back to CLI\ncredential = ChainedTokenCredential(\n ManagedIdentityCredential(client_id=\"\"),\n AzureCliCredential()\n)\n```\n\n## Credential Types Table\n\n| Credential | Use Case | Auth Method |\n|------------|----------|-------------|\n| `DefaultAzureCredential` | Most scenarios | Auto-detect |\n| `ManagedIdentityCredential` | Azure-hosted apps | Managed Identity |\n| `ClientSecretCredential` | Service principal | Client secret |\n| `ClientCertificateCredential` | Service principal | Certificate |\n| `AzureCliCredential` | Local development | Azure CLI |\n| `AzureDeveloperCliCredential` | Local development | Azure Developer CLI |\n| `InteractiveBrowserCredential` | User sign-in | Browser OAuth |\n| `DeviceCodeCredential` | Headless/SSH | Device code flow |\n\n## Getting Tokens Directly\n\n```python\nfrom azure.identity import DefaultAzureCredential\n\ncredential = DefaultAzureCredential()\n\n# Get token for a specific scope\ntoken = credential.get_token(\"https://management.azure.com/.default\")\nprint(f\"Token expires: {token.expires_on}\")\n\n# For Azure Database for PostgreSQL\ntoken = credential.get_token(\"https://ossrdbms-aad.database.windows.net/.default\")\n```\n\n## Async Client\n\n```python\nfrom azure.identity.aio import DefaultAzureCredential\nfrom azure.storage.blob.aio import BlobServiceClient\n\nasync def main():\n credential = DefaultAzureCredential()\n \n async with BlobServiceClient(\n account_url=\"https://.blob.core.windows.net\",\n credential=credential\n ) as client:\n # ... async operations\n pass\n \n await credential.close()\n```\n\n## Best Practices\n\n1. **Use DefaultAzureCredential** for code that runs locally and in Azure\n2. **Never hardcode credentials** — use environment variables or managed identity\n3. **Prefer managed identity** in production Azure deployments\n4. **Use ChainedTokenCredential** when you need a custom credential order\n5. **Close async credentials** explicitly or use context managers\n6. **Set AZURE_CLIENT_ID** for user-assigned managed identities\n7. **Exclude unused credentials** to speed up authentication\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.", "applicable_domains": [ "devops" ], "category": "devops", "invocation": [ "/azure-identity-py" ], "authored_by": "claudeskills.in community", "source_url": "https://claudeskills.in/skill/azure-identity-py", "provenance": { "source": "claudeskills.in", "source_url": "https://claudeskills.in/skill/azure-identity-py", "license": "unknown", "imported_at": "2026-09-03", "notes": "Aggregated by claudeskills.in from community GitHub lists." }, "tags": [ "claudeskills", "devops" ], "lifecycle": "draft" }