Azure Identity Ts

1---
2name: azure-identity-ts
3description: Authenticate to Azure services using Azure Identity SDK for JavaScript (@azure/identity). Use when configuring authentication with DefaultAzureCredential, managed identity, service principals, or interactive browser login.
4package: "@azure/identity"
5---
6 
7# Azure Identity SDK for TypeScript
8 
9Authenticate to Azure services with various credential types.
10 
11## Installation
12 
13```bash
14npm install @azure/identity
15```
16 
17## Environment Variables
18 
19### Service Principal (Secret)
20 
21```bash
22AZURE_TENANT_ID=<tenant-id>
23AZURE_CLIENT_ID=<client-id>
24AZURE_CLIENT_SECRET=<client-secret>
25```
26 
27### Service Principal (Certificate)
28 
29```bash
30AZURE_TENANT_ID=<tenant-id>
31AZURE_CLIENT_ID=<client-id>
32AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
33AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>
34```
35 
36### Workload Identity (Kubernetes)
37 
38```bash
39AZURE_TENANT_ID=<tenant-id>
40AZURE_CLIENT_ID=<client-id>
41AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/tokens/azure-identity
42```
43 
44## DefaultAzureCredential (Recommended)
45 
46```typescript
47import { DefaultAzureCredential } from "@azure/identity";
48 
49const credential = new DefaultAzureCredential();
50 
51// Use with any Azure SDK client
52import { BlobServiceClient } from "@azure/storage-blob";
53const blobClient = new BlobServiceClient(
54  "https://<account>.blob.core.windows.net",
55  credential
56);
57```
58 
59**Credential Chain Order:**
601. EnvironmentCredential
612. WorkloadIdentityCredential
623. ManagedIdentityCredential
634. VisualStudioCodeCredential
645. AzureCliCredential
656. AzurePowerShellCredential
667. AzureDeveloperCliCredential
67 
68## Managed Identity
69 
70### System-Assigned
71 
72```typescript
73import { ManagedIdentityCredential } from "@azure/identity";
74 
75const credential = new ManagedIdentityCredential();
76```
77 
78### User-Assigned (by Client ID)
79 
80```typescript
81const credential = new ManagedIdentityCredential({
82  clientId: "<user-assigned-client-id>"
83});
84```
85 
86### User-Assigned (by Resource ID)
87 
88```typescript
89const credential = new ManagedIdentityCredential({
90  resourceId: "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>"
91});
92```
93 
94## Service Principal
95 
96### Client Secret
97 
98```typescript
99import { ClientSecretCredential } from "@azure/identity";
100 
101const credential = new ClientSecretCredential(
102  "<tenant-id>",
103  "<client-id>",
104  "<client-secret>"
105);
106```
107 
108### Client Certificate
109 
110```typescript
111import { ClientCertificateCredential } from "@azure/identity";
112 
113const credential = new ClientCertificateCredential(
114  "<tenant-id>",
115  "<client-id>",
116  { certificatePath: "/path/to/cert.pem" }
117);
118 
119// With password
120const credentialWithPwd = new ClientCertificateCredential(
121  "<tenant-id>",
122  "<client-id>",
123  { 
124    certificatePath: "/path/to/cert.pem",
125    certificatePassword: "<password>"
126  }
127);
128```
129 
130## Interactive Authentication
131 
132### Browser-Based Login
133 
134```typescript
135import { InteractiveBrowserCredential } from "@azure/identity";
136 
137const credential = new InteractiveBrowserCredential({
138  clientId: "<client-id>",
139  tenantId: "<tenant-id>",
140  loginHint: "user@example.com"
141});
142```
143 
144### Device Code Flow
145 
146```typescript
147import { DeviceCodeCredential } from "@azure/identity";
148 
149const credential = new DeviceCodeCredential({
150  clientId: "<client-id>",
151  tenantId: "<tenant-id>",
152  userPromptCallback: (info) => {
153    console.log(info.message);
154    // "To sign in, use a web browser to open..."
155  }
156});
157```
158 
159## Custom Credential Chain
160 
161```typescript
162import { 
163  ChainedTokenCredential,
164  ManagedIdentityCredential,
165  AzureCliCredential
166} from "@azure/identity";
167 
168// Try managed identity first, fall back to CLI
169const credential = new ChainedTokenCredential(
170  new ManagedIdentityCredential(),
171  new AzureCliCredential()
172);
173```
174 
175## Developer Credentials
176 
177### Azure CLI
178 
179```typescript
180import { AzureCliCredential } from "@azure/identity";
181 
182const credential = new AzureCliCredential();
183// Uses: az login
184```
185 
186### Azure Developer CLI
187 
188```typescript
189import { AzureDeveloperCliCredential } from "@azure/identity";
190 
191const credential = new AzureDeveloperCliCredential();
192// Uses: azd auth login
193```
194 
195### Azure PowerShell
196 
197```typescript
198import { AzurePowerShellCredential } from "@azure/identity";
199 
200const credential = new AzurePowerShellCredential();
201// Uses: Connect-AzAccount
202```
203 
204## Sovereign Clouds
205 
206```typescript
207import { ClientSecretCredential, AzureAuthorityHosts } from "@azure/identity";
208 
209// Azure Government
210const credential = new ClientSecretCredential(
211  "<tenant>", "<client>", "<secret>",
212  { authorityHost: AzureAuthorityHosts.AzureGovernment }
213);
214 
215// Azure China
216const credentialChina = new ClientSecretCredential(
217  "<tenant>", "<client>", "<secret>",
218  { authorityHost: AzureAuthorityHosts.AzureChina }
219);
220```
221 
222## Bearer Token Provider
223 
224```typescript
225import { DefaultAzureCredential, getBearerTokenProvider } from "@azure/identity";
226 
227const credential = new DefaultAzureCredential();
228 
229// Create a function that returns tokens
230const getAccessToken = getBearerTokenProvider(
231  credential,
232  "https://cognitiveservices.azure.com/.default"
233);
234 
235// Use with APIs that need bearer tokens
236const token = await getAccessToken();
237```
238 
239## Key Types
240 
241```typescript
242import type { 
243  TokenCredential, 
244  AccessToken, 
245  GetTokenOptions 
246} from "@azure/core-auth";
247 
248import {
249  DefaultAzureCredential,
250  DefaultAzureCredentialOptions,
251  ManagedIdentityCredential,
252  ClientSecretCredential,
253  ClientCertificateCredential,
254  InteractiveBrowserCredential,
255  ChainedTokenCredential,
256  AzureCliCredential,
257  AzurePowerShellCredential,
258  AzureDeveloperCliCredential,
259  DeviceCodeCredential,
260  AzureAuthorityHosts
261} from "@azure/identity";
262```
263 
264## Custom Credential Implementation
265 
266```typescript
267import type { TokenCredential, AccessToken, GetTokenOptions } from "@azure/core-auth";
268 
269class CustomCredential implements TokenCredential {
270  async getToken(
271    scopes: string | string[],
272    options?: GetTokenOptions
273  ): Promise<AccessToken | null> {
274    // Custom token acquisition logic
275    return {
276      token: "<access-token>",
277      expiresOnTimestamp: Date.now() + 3600000
278    };
279  }
280}
281```
282 
283## Debugging
284 
285```typescript
286import { setLogLevel, AzureLogger } from "@azure/logger";
287 
288setLogLevel("verbose");
289 
290// Custom log handler
291AzureLogger.log = (...args) => {
292  console.log("[Azure]", ...args);
293};
294```
295 
296## Best Practices
297 
2981. **Use DefaultAzureCredential** - Works in development (CLI) and production (managed identity)
2992. **Never hardcode credentials** - Use environment variables or managed identity
3003. **Prefer managed identity** - No secrets to manage in production
3014. **Scope credentials appropriately** - Use user-assigned identity for multi-tenant scenarios
3025. **Handle token refresh** - Azure SDK handles this automatically
3036. **Use ChainedTokenCredential** - For custom fallback scenarios
304