Description

# Azure Identity client library for Python The Azure Identity library provides [Microsoft Entra ID](https://learn.microsoft.com/entra/fundamentals/whatis) token-based authentication support across the Azure SDK. It provides a set of [`TokenCredential`][token_cred_ref]/[`SupportsTokenInfo`][supports_token_info_ref] implementations, which can be used to construct Azure SDK clients that support Microsoft Entra token authentication. [Source code](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity) | [Package (PyPI)](https://pypi.org/project/azure-identity/) | [Package (Conda)](https://anaconda.org/microsoft/azure-identity/) | [API reference documentation][ref_docs] | [Microsoft Entra ID documentation](https://learn.microsoft.com/entra/identity/) ## Getting started ### Install the package Install Azure Identity with pip: ```sh pip install azure-identity ``` ### Prerequisites - An [Azure subscription](https://azure.microsoft.com/free/python) - Python 3.9 or a recent version of Python 3 (this library doesn't support end-of-life versions) ### Authenticate the client When debugging and executing code locally, it's typical for a developer to use their own account for authenticating calls to Azure services. There are several developer tools that can be used to perform this authentication in your development environment. For more information, see [Authentication during local development](https://learn.microsoft.com/azure/developer/python/sdk/authentication/overview#authentication-during-local-development). ## Key concepts ### Credentials A credential is a class that contains or can obtain the data needed for a service client to authenticate requests. Service clients across the Azure SDK accept a credential instance when they're constructed, and use that credential to authenticate requests. The Azure Identity library focuses on OAuth authentication with Microsoft Entra ID. It offers various credential classes capable of acquiring a Microsoft Entra access token. See the [Credential classes](#credential-classes "Credential classes") section for a list of this library's credential classes. ### DefaultAzureCredential `DefaultAzureCredential` simplifies authentication while developing apps that deploy to Azure by combining credentials used in Azure hosting environments with credentials used in local development. For more information, see [DefaultAzureCredential overview][dac_overview]. #### Continuation policy As of version 1.14.0, `DefaultAzureCredential` attempts to authenticate with all developer credentials until one succeeds, regardless of any errors previous developer credentials experienced. For example, a developer credential may attempt to get a token and fail, so `DefaultAzureCredential` will continue to the next credential in the flow. Deployed service credentials stop the flow with a thrown exception if they're able to attempt token retrieval, but don't receive one. Prior to version 1.14.0, developer credentials would similarly stop the authentication flow if token retrieval failed, but this is no longer the case. This allows for trying all of the developer credentials on your machine while having predictable deployed behavior. ## Examples The following examples are provided: - [Define a custom authentication flow with ChainedTokenCredential](#define-a-custom-authentication-flow-with-chainedtokencredential "Define a custom authentication flow with ChainedTokenCredential") - [Async credentials](#async-credentials "Async credentials") ### Define a custom authentication flow with `ChainedTokenCredential` While `DefaultAzureCredential` is generally the quickest way to authenticate apps for Azure, you can create a customized chain of credentials to be considered. `ChainedTokenCredential` enables users to combine multiple credential instances to define a customized chain of credentials. For more information, see [ChainedTokenCredential overview][ctc_overview]. ### Async credentials This library includes a set of async APIs. To use the async credentials in [azure.identity.aio][ref_docs_aio], you must first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/). For more information, see [azure-core documentation][azure_core_transport_doc]. Async credentials should be closed when they're no longer needed. Each async credential is an async context manager and defines an async `close` method. For example: ```python from azure.identity.aio import DefaultAzureCredential # call close when the credential is no longer needed credential = DefaultAzureCredential() ... await credential.close() # alternatively, use the credential as an async context manager credential = DefaultAzureCredential() async with credential: ... ``` This example demonstrates authenticating the asynchronous `SecretClient` from [azure-keyvault-secrets][azure_keyvault_secrets] with an asynchronous credential. ```python from azure.identity.aio import DefaultAzureCreden