Azure Identity (Python)

Azure Identity is Microsoft’s official Python library for authenticating against Microsoft Entra ID (formerly Azure AD) and acquiring the OAuth tokens every other Azure SDK client needs to call Azure services. It ships a set of TokenCredential implementations covering interactive browser login, managed identity, service principals, environment-variable credentials, and chained fallback strategies like DefaultAzureCredential, so applications can authenticate consistently across local development, CI, and production Azure environments.

What You Get

• DefaultAzureCredential, a chained credential that tries environment, managed identity, and developer-tool credentials in order
• Dedicated credential classes for service principals, certificates, managed identity, and workload identity federation
• Interactive and device-code credential flows for CLI tools and local development
• An async credential API mirroring the sync API for asyncio-based services
• Token caching (persistent and in-memory) to avoid redundant authentication round-trips

Common Use Cases

• Authenticating an Azure SDK client (Blob Storage, Key Vault, Cosmos DB) from a Python application running on Azure
• Using DefaultAzureCredential so the same code authenticates locally via Azure CLI login and in production via managed identity
• Authenticating CI/CD pipelines against Azure resources via service principal or workload identity federation credentials
• Building internal tools that need interactive or device-code login flows against Microsoft Entra ID

Under The Hood

Architecture - The package centers on the TokenCredential/SupportsTokenInfo protocol from azure-core; each credential class in azure/identity/_credentials/ implements that protocol independently, and DefaultAzureCredential composes several of them into a single fallback chain, with a mirrored aio subpackage providing async equivalents of every credential. Tech Stack - Pure Python (3.9+), built on azure-core for the shared pipeline/transport abstractions, msal/msal-extensions for the underlying Microsoft Authentication Library protocol implementation, and cryptography for certificate-based credential flows; packaged as part of the Azure SDK for Python monorepo under sdk/identity/azure-identity. Code Quality - The tests/ directory contains dedicated sync and async test modules per credential type (AAD client, app service, auth code, managed identity, etc.), plus recorded-test-case infrastructure and live integration tests, reflecting Microsoft’s SDK-wide testing conventions across a very large monorepo. API Design - Every credential exposes the same get_token()/get_token_info() surface regardless of the underlying auth mechanism, so credentials are interchangeable wherever an Azure SDK client accepts a TokenCredential, though the sheer number of credential classes (a dozen-plus) means picking the right one for a given environment has a real learning curve, addressed by extensive docs like TROUBLESHOOTING.md and TOKEN_CACHING.md.