Azure Identity Java

1---
2name: azure-identity-java
3description: Azure Identity Java SDK for authentication with Azure services. Use when implementing DefaultAzureCredential, managed identity, service principal, or any Azure authentication pattern in Java applications.
4package: com.azure:azure-identity
5---
6 
7# Azure Identity (Java)
8 
9Authenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).
10 
11## Installation
12 
13```xml
14<dependency>
15    <groupId>com.azure</groupId>
16    <artifactId>azure-identity</artifactId>
17    <version>1.15.0</version>
18</dependency>
19```
20 
21## Key Concepts
22 
23| Credential | Use Case |
24|------------|----------|
25| `DefaultAzureCredential` | **Recommended** - Works in dev and production |
26| `ManagedIdentityCredential` | Azure-hosted apps (App Service, Functions, VMs) |
27| `EnvironmentCredential` | CI/CD pipelines with env vars |
28| `ClientSecretCredential` | Service principals with secret |
29| `ClientCertificateCredential` | Service principals with certificate |
30| `AzureCliCredential` | Local dev using `az login` |
31| `InteractiveBrowserCredential` | Interactive login flow |
32| `DeviceCodeCredential` | Headless device authentication |
33 
34## DefaultAzureCredential (Recommended)
35 
36The `DefaultAzureCredential` tries multiple authentication methods in order:
37 
381. Environment variables
392. Workload Identity
403. Managed Identity
414. Azure CLI
425. Azure PowerShell
436. Azure Developer CLI
44 
45```java
46import com.azure.identity.DefaultAzureCredential;
47import com.azure.identity.DefaultAzureCredentialBuilder;
48 
49// Simple usage
50DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();
51 
52// Use with any Azure client
53BlobServiceClient blobClient = new BlobServiceClientBuilder()
54    .endpoint("https://<storage-account>.blob.core.windows.net")
55    .credential(credential)
56    .buildClient();
57 
58KeyClient keyClient = new KeyClientBuilder()
59    .vaultUrl("https://<vault-name>.vault.azure.net")
60    .credential(credential)
61    .buildClient();
62```
63 
64### Configure DefaultAzureCredential
65 
66```java
67DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
68    .managedIdentityClientId("<user-assigned-identity-client-id>")  // For user-assigned MI
69    .tenantId("<tenant-id>")                                        // Limit to specific tenant
70    .excludeEnvironmentCredential()                                 // Skip env vars
71    .excludeAzureCliCredential()                                    // Skip Azure CLI
72    .build();
73```
74 
75## Managed Identity
76 
77For Azure-hosted applications (App Service, Functions, AKS, VMs).
78 
79```java
80import com.azure.identity.ManagedIdentityCredential;
81import com.azure.identity.ManagedIdentityCredentialBuilder;
82 
83// System-assigned managed identity
84ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
85    .build();
86 
87// User-assigned managed identity (by client ID)
88ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
89    .clientId("<user-assigned-client-id>")
90    .build();
91 
92// User-assigned managed identity (by resource ID)
93ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
94    .resourceId("/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>")
95    .build();
96```
97 
98## Service Principal with Secret
99 
100```java
101import com.azure.identity.ClientSecretCredential;
102import com.azure.identity.ClientSecretCredentialBuilder;
103 
104ClientSecretCredential credential = new ClientSecretCredentialBuilder()
105    .tenantId("<tenant-id>")
106    .clientId("<client-id>")
107    .clientSecret("<client-secret>")
108    .build();
109```
110 
111## Service Principal with Certificate
112 
113```java
114import com.azure.identity.ClientCertificateCredential;
115import com.azure.identity.ClientCertificateCredentialBuilder;
116 
117// From PEM file
118ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
119    .tenantId("<tenant-id>")
120    .clientId("<client-id>")
121    .pemCertificate("<path-to-cert.pem>")
122    .build();
123 
124// From PFX file with password
125ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
126    .tenantId("<tenant-id>")
127    .clientId("<client-id>")
128    .pfxCertificate("<path-to-cert.pfx>", "<pfx-password>")
129    .build();
130 
131// Send certificate chain for SNI
132ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
133    .tenantId("<tenant-id>")
134    .clientId("<client-id>")
135    .pemCertificate("<path-to-cert.pem>")
136    .sendCertificateChain(true)
137    .build();
138```
139 
140## Environment Credential
141 
142Reads credentials from environment variables.
143 
144```java
145import com.azure.identity.EnvironmentCredential;
146import com.azure.identity.EnvironmentCredentialBuilder;
147 
148EnvironmentCredential credential = new EnvironmentCredentialBuilder().build();
149```
150 
151### Required Environment Variables
152 
153**For service principal with secret:**
154```bash
155AZURE_TENANT_ID=<tenant-id>
156AZURE_CLIENT_ID=<client-id>
157AZURE_CLIENT_SECRET=<client-secret>
158```
159 
160**For service principal with certificate:**
161```bash
162AZURE_TENANT_ID=<tenant-id>
163AZURE_CLIENT_ID=<client-id>
164AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
165AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>
166```
167 
168**For username/password:**
169```bash
170AZURE_TENANT_ID=<tenant-id>
171AZURE_CLIENT_ID=<client-id>
172AZURE_USERNAME=<username>
173AZURE_PASSWORD=<password>
174```
175 
176## Azure CLI Credential
177 
178For local development using `az login`.
179 
180```java
181import com.azure.identity.AzureCliCredential;
182import com.azure.identity.AzureCliCredentialBuilder;
183 
184AzureCliCredential credential = new AzureCliCredentialBuilder()
185    .tenantId("<tenant-id>")  // Optional: specific tenant
186    .build();
187```
188 
189## Interactive Browser
190 
191For desktop applications requiring user login.
192 
193```java
194import com.azure.identity.InteractiveBrowserCredential;
195import com.azure.identity.InteractiveBrowserCredentialBuilder;
196 
197InteractiveBrowserCredential credential = new InteractiveBrowserCredentialBuilder()
198    .clientId("<client-id>")
199    .redirectUrl("http://localhost:8080")  // Must match app registration
200    .build();
201```
202 
203## Device Code
204 
205For headless devices (IoT, CLI tools).
206 
207```java
208import com.azure.identity.DeviceCodeCredential;
209import com.azure.identity.DeviceCodeCredentialBuilder;
210 
211DeviceCodeCredential credential = new DeviceCodeCredentialBuilder()
212    .clientId("<client-id>")
213    .challengeConsumer(challenge -> {
214        // Display to user
215        System.out.println(challenge.getMessage());
216    })
217    .build();
218```
219 
220## Chained Credential
221 
222Create custom authentication chains.
223 
224```java
225import com.azure.identity.ChainedTokenCredential;
226import com.azure.identity.ChainedTokenCredentialBuilder;
227 
228ChainedTokenCredential credential = new ChainedTokenCredentialBuilder()
229    .addFirst(new ManagedIdentityCredentialBuilder().build())
230    .addLast(new AzureCliCredentialBuilder().build())
231    .build();
232```
233 
234## Workload Identity (AKS)
235 
236For Azure Kubernetes Service with workload identity.
237 
238```java
239import com.azure.identity.WorkloadIdentityCredential;
240import com.azure.identity.WorkloadIdentityCredentialBuilder;
241 
242// Reads from AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE
243WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder().build();
244 
245// Or explicit configuration
246WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()
247    .tenantId("<tenant-id>")
248    .clientId("<client-id>")
249    .tokenFilePath("/var/run/secrets/azure/tokens/azure-identity-token")
250    .build();
251```
252 
253## Token Caching
254 
255Enable persistent token caching for better performance.
256 
257```java
258// Enable token caching (in-memory by default)
259DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
260    .enableAccountIdentifierLogging()
261    .build();
262 
263// With shared token cache (for multi-credential scenarios)
264SharedTokenCacheCredential credential = new SharedTokenCacheCredentialBuilder()
265    .clientId("<client-id>")
266    .build();
267```
268 
269## Sovereign Clouds
270 
271```java
272import com.azure.identity.AzureAuthorityHosts;
273 
274// Azure Government
275DefaultAzureCredential govCredential = new DefaultAzureCredentialBuilder()
276    .authorityHost(AzureAuthorityHosts.AZURE_GOVERNMENT)
277    .build();
278 
279// Azure China
280DefaultAzureCredential chinaCredential = new DefaultAzureCredentialBuilder()
281    .authorityHost(AzureAuthorityHosts.AZURE_CHINA)
282    .build();
283```
284 
285## Error Handling
286 
287```java
288import com.azure.identity.CredentialUnavailableException;
289import com.azure.core.exception.ClientAuthenticationException;
290 
291try {
292    DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();
293    AccessToken token = credential.getToken(new TokenRequestContext()
294        .addScopes("https://management.azure.com/.default"));
295} catch (CredentialUnavailableException e) {
296    // No credential could authenticate
297    System.out.println("Authentication failed: " + e.getMessage());
298} catch (ClientAuthenticationException e) {
299    // Authentication error (wrong credentials, expired, etc.)
300    System.out.println("Auth error: " + e.getMessage());
301}
302```
303 
304## Logging
305 
306Enable authentication logging for debugging.
307 
308```java
309// Via environment variable
310// AZURE_LOG_LEVEL=verbose
311 
312// Or programmatically
313DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
314    .enableAccountIdentifierLogging()  // Log account info
315    .build();
316```
317 
318## Environment Variables
319 
320```bash
321# DefaultAzureCredential configuration
322AZURE_TENANT_ID=<tenant-id>
323AZURE_CLIENT_ID=<client-id>
324AZURE_CLIENT_SECRET=<client-secret>
325 
326# Managed Identity
327AZURE_CLIENT_ID=<user-assigned-mi-client-id>
328 
329# Workload Identity (AKS)
330AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token
331 
332# Logging
333AZURE_LOG_LEVEL=verbose
334 
335# Authority host
336AZURE_AUTHORITY_HOST=https://login.microsoftonline.com/
337```
338 
339## Best Practices
340 
3411. **Use DefaultAzureCredential** - Works seamlessly from dev to production
3422. **Managed Identity in Production** - No secrets to manage, automatic rotation
3433. **Azure CLI for Local Dev** - Run `az login` before running your app
3444. **Least Privilege** - Grant only required permissions to service principals
3455. **Token Caching** - Enabled by default, reduces auth round-trips
3466. **Environment Variables** - Use for CI/CD, not hardcoded secrets
347 
348## Credential Selection Matrix
349 
350| Environment | Recommended Credential |
351|-------------|----------------------|
352| Local Development | `DefaultAzureCredential` (uses Azure CLI) |
353| Azure App Service | `DefaultAzureCredential` (uses Managed Identity) |
354| Azure Functions | `DefaultAzureCredential` (uses Managed Identity) |
355| Azure Kubernetes Service | `WorkloadIdentityCredential` |
356| Azure VMs | `DefaultAzureCredential` (uses Managed Identity) |
357| CI/CD Pipeline | `EnvironmentCredential` |
358| Desktop App | `InteractiveBrowserCredential` |
359| CLI Tool | `DeviceCodeCredential` |
360 
361## Trigger Phrases
362 
363- "Azure authentication Java", "DefaultAzureCredential Java"
364- "managed identity Java", "service principal Java"
365- "Azure login Java", "Azure credentials Java"
366- "AZURE_CLIENT_ID", "AZURE_TENANT_ID"
367