Azure Identity TS

MicrosoftOfficialCreated by Microsoft

Skill
Tool integration
Cloud and DevOps
MIT
No issues found

From the author

Authenticate to Azure services using Azure Identity library for JavaScript (@azure/identity). Use when configuring authentication with DefaultAzureCredential, managed identity, service principals, or interactive browser login.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-identity-ts skill provides a comprehensive guide for implementing authentication in JavaScript and TypeScript applications using the @azure/identity library. It covers various credential types, including DefaultAzureCredential for seamless local-to-production transitions, Managed Identity for Azure-hosted resources, and Service Principal authentication for automated environments. The skill also details browser-based authentication patterns, custom credential chains, and best practices for secure token management.

What it does

Provides implementation patterns for DefaultAzureCredential to simplify multi-environment authentication.
Demonstrates how to configure Managed Identity for secure, secret-free access in Azure environments.
Explains service principal authentication using both client secrets and certificates.
Covers interactive browser-based login flows for web applications.
Shows how to create custom credential chains for specific fallback requirements.
Includes guidance on debugging authentication issues and managing token providers.

When to use it

When you need to authenticate your Node.js or browser-based application to Azure services.
When you want to follow security best practices by avoiding hardcoded credentials.
When deploying applications to Azure resources that support Managed Identity.
When you need to support multiple authentication methods across local development and production environments.

Advantages

Standardized authentication approach across all Azure SDK clients.
Supports a wide range of identity scenarios from local dev to enterprise production.
Reduces secret management overhead by leveraging Managed Identity.
Provides built-in support for token caching and automatic refresh.

Usage examples

“How do I authenticate a BlobServiceClient using DefaultAzureCredential?”: The agent will provide a code snippet showing the import of DefaultAzureCredential and its injection into the BlobServiceClient constructor.
“Show me how to use a user-assigned managed identity in my code.”: The agent will provide the ManagedIdentityCredential configuration using the client ID or resource ID of the user-assigned identity.
“How do I set up interactive login for a web app?”: The agent will explain the use of InteractiveBrowserCredential, including the necessary app registration requirements and configuration options.
“What is the best way to authenticate in a CI/CD pipeline?”: The agent will recommend using ClientSecretCredential or WorkloadIdentityCredential, providing the necessary environment variable setup.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-identity-ts/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-identity-ts.zip -d .agents/skills

Documentation by Microsoft

Azure Identity library for TypeScript

Authentication library for Azure SDK clients using Microsoft Entra ID.

Installation

npm install @azure/identity

# For Visual Studio Code credential support
npm install @azure/identity-vscode

Environment Variables

Service Principal (Secret)

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in production

Service Principal (Certificate)

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>

Workload Identity (Kubernetes)

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/tokens/azure-identity

DefaultAzureCredential (Recommended for Local Development)

import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";

// Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
const credential = new DefaultAzureCredential({requiredEnvVars: ["AZURE_TOKEN_CREDENTIALS"]});
// Or use a specific credential directly in production:
// See https://learn.microsoft.com/javascript/api/overview/azure/identity-readme?view=azure-node-latest#credential-classes
// const credential = new ManagedIdentityCredential();

// Use with any Azure SDK client
import { BlobServiceClient } from "@azure/storage-blob";
const blobClient = new BlobServiceClient(
  "https://<account>.blob.core.windows.net",
  credential
);

See DefaultAzureCredential overview for the current credential chain order and defaults.

Managed Identity

System-Assigned

import { ManagedIdentityCredential } from "@azure/identity";

const credential = new ManagedIdentityCredential();

User-Assigned (by Client ID)

const credential = new ManagedIdentityCredential({
  clientId: "<user-assigned-client-id>"
});

User-Assigned (by Resource ID)

const credential = new ManagedIdentityCredential({
  resourceId: "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>"
});

User-Assigned (by Object ID)

const credential = new ManagedIdentityCredential({
  objectId: "<user-assigned-object-id>"
});

Service Principal

Client Secret

import { ClientSecretCredential } from "@azure/identity";

const credential = new ClientSecretCredential(
  "<tenant-id>",
  "<client-id>",
  "<client-secret>"
);

Client Certificate

import { ClientCertificateCredential } from "@azure/identity";

const credential = new ClientCertificateCredential(
  "<tenant-id>",
  "<client-id>",
  { certificatePath: "/path/to/cert.pem" }
);

// With password
const credentialWithPwd = new ClientCertificateCredential(
  "<tenant-id>",
  "<client-id>",
  { 
    certificatePath: "/path/to/cert.pem",
    certificatePassword: "<password>"
  }
);

Interactive Authentication

import { InteractiveBrowserCredential } from "@azure/identity";

const credential = new InteractiveBrowserCredential({
  clientId: "<client-id>",
  tenantId: "<tenant-id>",
  loginHint: "[email protected]"
});

Device Code Flow

import { DeviceCodeCredential } from "@azure/identity";

const credential = new DeviceCodeCredential({
  clientId: "<client-id>",
  tenantId: "<tenant-id>",
  userPromptCallback: (info) => {
    console.log(info.message);
    // "To sign in, use a web browser to open..."
  }
});

Custom Credential Chain

import { 
  ChainedTokenCredential,
  ManagedIdentityCredential,
  AzureCliCredential
} from "@azure/identity";

// Try managed identity first, fall back to CLI
const credential = new ChainedTokenCredential(
  new ManagedIdentityCredential(),
  new AzureCliCredential()
);

Developer Credentials

Visual Studio Code

import { useIdentityPlugin, VisualStudioCodeCredential } from "@azure/identity";
import { vsCodePlugin } from "@azure/identity-vscode";

useIdentityPlugin(vsCodePlugin);

const credential = new VisualStudioCodeCredential();

Azure CLI

import { AzureCliCredential } from "@azure/identity";

const credential = new AzureCliCredential();
// Uses: az login

Azure Developer CLI

import { AzureDeveloperCliCredential } from "@azure/identity";

const credential = new AzureDeveloperCliCredential();
// Uses: azd auth login

Azure PowerShell

import { AzurePowerShellCredential } from "@azure/identity";

const credential = new AzurePowerShellCredential();
// Uses: Connect-AzAccount

Sovereign Clouds

import { ClientSecretCredential, AzureAuthorityHosts } from "@azure/identity";

// Azure Government
const credential = new ClientSecretCredential(
  "<tenant>", "<client>", "<secret>",
  { authorityHost: AzureAuthorityHosts.AzureGovernment }
);

// Azure China
const credentialChina = new ClientSecretCredential(
  "<tenant>", "<client>", "<secret>",
  { authorityHost: AzureAuthorityHosts.AzureChina }
);

Bearer Token Provider

import { DefaultAzureCredential, getBearerTokenProvider } from "@azure/identity";

const credential = new DefaultAzureCredential({requiredEnvVars: ["AZURE_TOKEN_CREDENTIALS"]});

// Create a function that returns tokens
const getAccessToken = getBearerTokenProvider(
  credential,
  "https://cognitiveservices.azure.com/.default"
);

// Use with APIs that need bearer tokens
const token = await getAccessToken();

Key Types

import type { 
  TokenCredential, 
  AccessToken, 
  GetTokenOptions 
} from "@azure/core-auth";

import {
  DefaultAzureCredential,
  DefaultAzureCredentialOptions,
  ManagedIdentityCredential,
  ClientSecretCredential,
  ClientCertificateCredential,
  InteractiveBrowserCredential,
  ChainedTokenCredential,
  AzureCliCredential,
  AzurePowerShellCredential,
  AzureDeveloperCliCredential,
  DeviceCodeCredential,
  AzureAuthorityHosts
} from "@azure/identity";

Custom Credential Implementation

import type { TokenCredential, AccessToken, GetTokenOptions } from "@azure/core-auth";

class CustomCredential implements TokenCredential {
  async getToken(
    scopes: string | string[],
    options?: GetTokenOptions
  ): Promise<AccessToken | null> {
    // Custom token acquisition logic
    return {
      token: "<access-token>",
      expiresOnTimestamp: Date.now() + 3600000
    };
  }
}

Debugging

import { setLogLevel, AzureLogger } from "@azure/logger";

setLogLevel("verbose");

// Custom log handler
AzureLogger.log = (...args) => {
  console.log("[Azure]", ...args);
};

Best Practices

Use DefaultAzureCredential for local development; use ManagedIdentityCredential or WorkloadIdentityCredential for production
Never hardcode credentials - Use environment variables or managed identity
Prefer managed identity - No secrets to manage in production
Scope credentials appropriately - Use user-assigned identity for multi-tenant scenarios
Handle token refresh - Azure SDK handles this automatically
Use ChainedTokenCredential - For custom fallback scenarios

Files

ATTRIBUTION.mdAdded by AutoGineer970 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md7.8 KiB
references/browser-auth.md10.4 KiB
references/credential-types.md9.9 KiB

references/credential-types.md

Credential Types Reference

Azure Identity credential types for authenticating to Azure services using the @azure/identity TypeScript SDK.

Overview

The Azure Identity library provides various credential classes for different authentication scenarios. Choose the right credential based on your environment and security requirements.

Credential Selection Guide

Scenario	Recommended Credential
Production (any environment)	`DefaultAzureCredential`
Azure VM/App Service	`ManagedIdentityCredential`
Service Principal (secret)	`ClientSecretCredential`
Service Principal (cert)	`ClientCertificateCredential`
Local development	`AzureCliCredential` or `AzureDeveloperCliCredential`
Browser application	`InteractiveBrowserCredential`
CI/CD pipeline	`ClientSecretCredential` or `WorkloadIdentityCredential`
Kubernetes (AKS)	`WorkloadIdentityCredential`

DefaultAzureCredential (Recommended)

The most versatile credential - automatically tries multiple authentication methods.

import { DefaultAzureCredential } from "@azure/identity";

const credential = new DefaultAzureCredential();

// Works in all environments - dev and production
import { BlobServiceClient } from "@azure/storage-blob";
const blobClient = new BlobServiceClient(
  "https://myaccount.blob.core.windows.net",
  credential
);

See DefaultAzureCredential overview for the current credential chain order and defaults.

Customizing DefaultAzureCredential

import { DefaultAzureCredential } from "@azure/identity";

const credential = new DefaultAzureCredential({
  // Exclude specific credentials
  excludeAzureCliCredential: true,
  excludeAzurePowerShellCredential: true,
  
  // For user-assigned managed identity
  managedIdentityClientId: "<client-id>",
  
  // Tenant hint for multi-tenant
  tenantId: "<tenant-id>",
});

ManagedIdentityCredential

For Azure-hosted resources (VMs, App Service, Functions, AKS).

import { ManagedIdentityCredential } from "@azure/identity";

// System-assigned managed identity
const credential = new ManagedIdentityCredential();

// User-assigned managed identity (by client ID)
const credentialByClientId = new ManagedIdentityCredential({
  clientId: "<user-assigned-client-id>"
});

// User-assigned managed identity (by resource ID)
const credentialByResourceId = new ManagedIdentityCredential({
  resourceId: "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>"
});

ClientSecretCredential

For service principal authentication with a client secret.

import { ClientSecretCredential } from "@azure/identity";

const credential = new ClientSecretCredential(
  "<tenant-id>",
  "<client-id>",
  "<client-secret>"
);

// From environment variables
const credentialFromEnv = new ClientSecretCredential(
  process.env.AZURE_TENANT_ID!,
  process.env.AZURE_CLIENT_ID!,
  process.env.AZURE_CLIENT_SECRET!
);

Required Environment Variables:

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

ClientCertificateCredential

For service principal authentication with a certificate (more secure than secret).

import { ClientCertificateCredential } from "@azure/identity";

// Certificate from file path
const credential = new ClientCertificateCredential(
  "<tenant-id>",
  "<client-id>",
  { certificatePath: "/path/to/cert.pem" }
);

// Certificate with password
const credentialWithPassword = new ClientCertificateCredential(
  "<tenant-id>",
  "<client-id>",
  {
    certificatePath: "/path/to/cert.pfx",
    certificatePassword: "<password>"
  }
);

// Certificate from PEM string
const credentialFromString = new ClientCertificateCredential(
  "<tenant-id>",
  "<client-id>",
  { certificate: "-----BEGIN CERTIFICATE-----\n..." }
);

WorkloadIdentityCredential

For Kubernetes workload identity (AKS, Azure Arc).

import { WorkloadIdentityCredential } from "@azure/identity";

// Uses environment variables automatically set by AKS
const credential = new WorkloadIdentityCredential();

// Explicit configuration
const credentialExplicit = new WorkloadIdentityCredential({
  tenantId: "<tenant-id>",
  clientId: "<client-id>",
  tokenFilePath: "/var/run/secrets/azure/tokens/azure-identity-token"
});

Required Environment Variables (set by AKS):

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/tokens/azure-identity

Developer Credentials

AzureCliCredential

import { AzureCliCredential } from "@azure/identity";

// Uses token from: az login
const credential = new AzureCliCredential();

// With tenant hint
const credentialWithTenant = new AzureCliCredential({
  tenantId: "<tenant-id>"
});

AzureDeveloperCliCredential

import { AzureDeveloperCliCredential } from "@azure/identity";

// Uses token from: azd auth login
const credential = new AzureDeveloperCliCredential();

AzurePowerShellCredential

import { AzurePowerShellCredential } from "@azure/identity";

// Uses token from: Connect-AzAccount
const credential = new AzurePowerShellCredential();

VisualStudioCodeCredential

import { useIdentityPlugin, VisualStudioCodeCredential } from "@azure/identity";
import { vsCodePlugin } from "@azure/identity-vscode";

useIdentityPlugin(vsCodePlugin);

// Uses Azure Account extension in VS Code
const credential = new VisualStudioCodeCredential();

ChainedTokenCredential

Create custom credential chains for specific scenarios.

import {
  ChainedTokenCredential,
  ManagedIdentityCredential,
  AzureCliCredential,
  ClientSecretCredential
} from "@azure/identity";

// Try managed identity first, then CLI
const credential = new ChainedTokenCredential(
  new ManagedIdentityCredential(),
  new AzureCliCredential()
);

// Production: managed identity → service principal fallback
const productionCredential = new ChainedTokenCredential(
  new ManagedIdentityCredential(),
  new ClientSecretCredential(
    process.env.AZURE_TENANT_ID!,
    process.env.AZURE_CLIENT_ID!,
    process.env.AZURE_CLIENT_SECRET!
  )
);

EnvironmentCredential

Automatically selects credential based on environment variables.

import { EnvironmentCredential } from "@azure/identity";

// Checks env vars and creates appropriate credential
const credential = new EnvironmentCredential();

Supported Environment Variable Sets:

Service Principal (Secret):

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

Service Principal (Certificate):

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional>

TokenCredential Interface

All credentials implement TokenCredential:

import type { TokenCredential, AccessToken, GetTokenOptions } from "@azure/core-auth";

interface TokenCredential {
  getToken(
    scopes: string | string[],
    options?: GetTokenOptions
  ): Promise<AccessToken | null>;
}

interface AccessToken {
  token: string;
  expiresOnTimestamp: number;
}

Custom Credential Implementation

import type { TokenCredential, AccessToken, GetTokenOptions } from "@azure/core-auth";

class CustomCredential implements TokenCredential {
  async getToken(
    scopes: string | string[],
    options?: GetTokenOptions
  ): Promise<AccessToken | null> {
    // Custom token acquisition logic
    const token = await fetchTokenFromCustomSource(scopes);
    
    return {
      token: token.accessToken,
      expiresOnTimestamp: token.expiresOn.getTime()
    };
  }
}

Sovereign Clouds

import { 
  ClientSecretCredential, 
  AzureAuthorityHosts 
} from "@azure/identity";

// Azure Government
const govCredential = new ClientSecretCredential(
  "<tenant>", "<client>", "<secret>",
  { authorityHost: AzureAuthorityHosts.AzureGovernment }
);

// Azure China (21Vianet)
const chinaCredential = new ClientSecretCredential(
  "<tenant>", "<client>", "<secret>",
  { authorityHost: AzureAuthorityHosts.AzureChina }
);

// Available authority hosts
// AzureAuthorityHosts.AzurePublicCloud (default)
// AzureAuthorityHosts.AzureGovernment
// AzureAuthorityHosts.AzureChina

Bearer Token Provider

For APIs that need raw tokens:

import { DefaultAzureCredential, getBearerTokenProvider } from "@azure/identity";

const credential = new DefaultAzureCredential();

// Create token provider for specific scope
const getAccessToken = getBearerTokenProvider(
  credential,
  "https://cognitiveservices.azure.com/.default"
);

// Get token when needed
const token = await getAccessToken();
console.log(`Bearer ${token}`);

Debugging

import { setLogLevel, AzureLogger } from "@azure/logger";

// Enable verbose logging
setLogLevel("verbose");

// Custom log handler
AzureLogger.log = (...args) => {
  console.log("[Azure Identity]", ...args);
};

Best Practices

Use DefaultAzureCredential — Works across all environments
Never hardcode credentials — Use environment variables or managed identity
Prefer managed identity — No secrets to manage
Use certificates over secrets — More secure, easier to rotate
Scope user-assigned identity — Use for multi-tenant or specific permissions
Enable logging for debugging — Helps diagnose auth issues
Handle token refresh — Azure SDK handles this automatically

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Node.js

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-sdk-typescript/skills/azure-identity-ts · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-identity-ts.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Identity library for TypeScript

Installation

Environment Variables

Service Principal (Secret)

Service Principal (Certificate)

Workload Identity (Kubernetes)

DefaultAzureCredential (Recommended for Local Development)

Managed Identity

System-Assigned

User-Assigned (by Client ID)

User-Assigned (by Resource ID)

User-Assigned (by Object ID)

Service Principal

Client Secret

Client Certificate

Interactive Authentication

Browser-Based Login

Device Code Flow

Custom Credential Chain

Developer Credentials

Visual Studio Code

Azure CLI

Azure Developer CLI

Azure PowerShell

Sovereign Clouds

Bearer Token Provider

Key Types

Custom Credential Implementation

Debugging

Best Practices

Files

references/credential-types.md

Credential Types Reference

Overview

Credential Selection Guide

DefaultAzureCredential (Recommended)

Customizing DefaultAzureCredential

ManagedIdentityCredential

ClientSecretCredential

ClientCertificateCredential

WorkloadIdentityCredential

Developer Credentials

AzureCliCredential

AzureDeveloperCliCredential

AzurePowerShellCredential

VisualStudioCodeCredential

ChainedTokenCredential

EnvironmentCredential

TokenCredential Interface

Custom Credential Implementation

Sovereign Clouds

Bearer Token Provider

Debugging

Best Practices

See Also

Requirements and compatibility

Security

Attribution and licence

Related skills

Modal

Cloud Infrastructure Network Engineer

Deployment Validation Cloud Architect

Airflow Dag Patterns

Cost Optimization

Hybrid Cloud Networking

Download ZIP