Azure Identity Rust

1---
2name: azure-identity-rust
3description: |
4  Azure Identity SDK for Rust authentication. Use for DeveloperToolsCredential, ManagedIdentityCredential, ClientSecretCredential, and token-based authentication.
5  Triggers: "azure-identity", "DeveloperToolsCredential", "authentication rust", "managed identity rust", "credential rust".
6package: azure_identity
7---
8 
9# Azure Identity SDK for Rust
10 
11Authentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD).
12 
13## Installation
14 
15```sh
16cargo add azure_identity
17```
18 
19## Environment Variables
20 
21```bash
22# Service Principal (for production/CI)
23AZURE_TENANT_ID=<your-tenant-id>
24AZURE_CLIENT_ID=<your-client-id>
25AZURE_CLIENT_SECRET=<your-client-secret>
26 
27# User-assigned Managed Identity (optional)
28AZURE_CLIENT_ID=<managed-identity-client-id>
29```
30 
31## DeveloperToolsCredential
32 
33The recommended credential for local development. Tries developer tools in order (Azure CLI, Azure Developer CLI):
34 
35```rust
36use azure_identity::DeveloperToolsCredential;
37use azure_security_keyvault_secrets::SecretClient;
38 
39let credential = DeveloperToolsCredential::new(None)?;
40let client = SecretClient::new(
41    "https://my-vault.vault.azure.net/",
42    credential.clone(),
43    None,
44)?;
45```
46 
47### Credential Chain Order
48 
49| Order | Credential | Environment |
50|-------|-----------|-------------|
51| 1 | AzureCliCredential | `az login` |
52| 2 | AzureDeveloperCliCredential | `azd auth login` |
53 
54## Credential Types
55 
56| Credential | Usage |
57|------------|-------|
58| `DeveloperToolsCredential` | Local development - tries CLI tools |
59| `ManagedIdentityCredential` | Azure VMs, App Service, Functions, AKS |
60| `WorkloadIdentityCredential` | Kubernetes workload identity |
61| `ClientSecretCredential` | Service principal with secret |
62| `ClientCertificateCredential` | Service principal with certificate |
63| `AzureCliCredential` | Direct Azure CLI auth |
64| `AzureDeveloperCliCredential` | Direct azd CLI auth |
65| `AzurePipelinesCredential` | Azure Pipelines service connection |
66| `ClientAssertionCredential` | Custom assertions (federated identity) |
67 
68## ManagedIdentityCredential
69 
70For Azure-hosted resources:
71 
72```rust
73use azure_identity::ManagedIdentityCredential;
74 
75// System-assigned managed identity
76let credential = ManagedIdentityCredential::new(None)?;
77 
78// User-assigned managed identity
79let options = ManagedIdentityCredentialOptions {
80    client_id: Some("<user-assigned-mi-client-id>".into()),
81    ..Default::default()
82};
83let credential = ManagedIdentityCredential::new(Some(options))?;
84```
85 
86## ClientSecretCredential
87 
88For service principal with secret:
89 
90```rust
91use azure_identity::ClientSecretCredential;
92 
93let credential = ClientSecretCredential::new(
94    "<tenant-id>".into(),
95    "<client-id>".into(),
96    "<client-secret>".into(),
97    None,
98)?;
99```
100 
101## Best Practices
102 
1031. **Use `DeveloperToolsCredential` for local dev** — automatically picks up Azure CLI
1042. **Use `ManagedIdentityCredential` in production** — no secrets to manage
1053. **Clone credentials** — credentials are `Arc`-wrapped and cheap to clone
1064. **Reuse credential instances** — same credential can be used with multiple clients
1075. **Use `tokio` feature** — `cargo add azure_identity --features tokio`
108 
109## Reference Links
110 
111| Resource | Link |
112|----------|------|
113| API Reference | https://docs.rs/azure_identity |
114| Source Code | https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/identity/azure_identity |
115| crates.io | https://crates.io/crates/azure_identity |
116