Microsoft's Azure authentication library for Python. Provides credential classes for authenticating against Azure services. Primary interface is DefaultAzureCredential which chains multiple credential sources. Current version is 1.23.1 (Mar 2026).
pip install azure-identityVerified import paths — ran on the pinned version, not inferred.
Minimal Azure authentication using DefaultAzureCredential 1.23.x.
In production use ManagedIdentityCredential() or ClientSecretCredential(tenant_id, client_id, client_secret) explicitly. Reserve DefaultAzureCredential for local dev only.
credential = DefaultAzureCredential(additionally_allowed_tenants=['*'])
Explicitly exclude if not needed: DefaultAzureCredential(exclude_visual_studio_code_credential=True)
async with DefaultAzureCredential() as credential:
token = await credential.get_token(scope)Never set logging_enable=True in production.
Use Python 3.10+ for new projects.
Install the 'azure-storage-blob' package: pip install azure-storage-blob
Install the required storage package, e.g., 'pip install azure-storage-blob'.
Ensure the `azure-identity` package is installed: `pip install azure-identity`. If using a virtual environment, activate it before installing or running the script.
This is a general error, and the fix depends on the underlying credential that failed. Common resolutions include: * **EnvironmentCredential (when nested):** Ensure environment variables for service principal authentication (`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_SECRET` or `AZURE_CLIENT_CERTIFICATE_PATH`) are correctly set. * **Multi-tenant authentication:** If authenticating to a tenant different from the one logged into via Azure CLI or other tools, add `additionally_allowed_tenants=['*']` (to allow any tenant) or specific tenant IDs when initializing `DefaultAzureCredential`. * **ManagedIdentityCredential (when nested):** Verify that managed identity is enabled and correctly configured on the Azure resource (e.g., VM, App Service, Function App) where the code is running, and that the identity has the necessary Azure RBAC permissions. * **General troubleshooting:** Enable logging for `azure-identity` to get detailed information on which specific credential in the chain is failing and why.
Verify the following: * **Azure RBAC roles:** Ensure the identity (user, service principal, or managed identity) has the appropriate Azure RBAC roles assigned for the specific Azure service and resource it's trying to access. * **Scope/Audience:** Confirm that the `scope` or `resource URI` provided when requesting the token (e.g., `https://storage.azure.com/.default` for Azure Storage) is correct for the target service. * **Token validity:** Ensure the tokens are not expired; Azure SDKs usually handle token refreshing automatically, but persistent issues might point to underlying permission or configuration problems preventing successful refresh.