Kiota Authentication Azure

microsoft-kiota-authentication-azure is the Python authentication adapter for Kiota, Microsoft’s OpenAPI-driven SDK generator. Kiota-generated Python clients rely on a pluggable AccessTokenProvider interface (defined in microsoft-kiota-abstractions) to attach bearer tokens to outgoing requests; this package supplies the concrete implementation that sources those tokens from the azure-identity library, letting a generated client authenticate against Microsoft Graph or any other Azure AD-protected API using whichever credential type (DefaultAzureCredential, ClientSecretCredential, managed identity, etc.) the host application already uses.

The library transparently supports both synchronous and asynchronous azure-identity credentials behind a single async API, enforces HTTPS-only and allowed-host validation before every token request, and wires in Continuous Access Evaluation (CAE) claims-challenge handling and OpenTelemetry tracing spans out of the box. It ships as one of several sibling packages (abstractions, http, serialization, bundle) that together make up the Kiota Python runtime.

What You Get

• AzureIdentityAuthenticationProvider, a ready-to-use BaseBearerTokenAuthenticationProvider that wraps any azure-identity credential for use with a Kiota request adapter
• AzureIdentityAccessTokenProvider, which transparently handles both sync (TokenCredential) and async (AsyncTokenCredential) azure-identity credentials behind one async get_authorization_token() call
• Built-in allowed-host validation and HTTPS-only enforcement before every outgoing token request, guarding against token leakage to unintended hosts
• Continuous Access Evaluation (CAE) support via claims-challenge decoding, so conditional-access-protected APIs like Microsoft Graph can request step-up authentication mid-session
• OpenTelemetry tracing spans wrapping each token acquisition, exposing scopes, URL validity, and claims usage as span attributes for observability

Common Use Cases

• Authenticating a Kiota-generated Microsoft Graph SDK client using DefaultAzureCredential or a managed identity in an Azure-hosted service
• Wiring a custom Kiota-generated client (from any Azure AD-protected OpenAPI spec) to azure-identity credentials without writing a token provider from scratch
• Restricting which hosts a generated SDK is allowed to send bearer tokens to, via the allowed_hosts constructor argument
• Handling Continuous Access Evaluation challenges transparently when calling conditional-access-protected Azure APIs

Under The Hood

Architecture The package is a thin, single-responsibility adapter living inside the modular kiota-python monorepo (alongside abstractions, http, serialization, and bundle packages). It supplies two classes: AzureIdentityAuthenticationProvider, which subclasses BaseBearerTokenAuthenticationProvider from microsoft-kiota-abstractions, and AzureIdentityAccessTokenProvider, which implements that package’s AccessTokenProvider protocol. The adapter pattern is clean: host/scheme validation and claims decoding happen inline in get_authorization_token(), sync-vs-async credential resolution is handled by inspecting whether credentials.get_token() returns an awaitable, and allowed-host checks are delegated to a shared AllowedHostsValidator from the abstractions package. Because the provider classes directly implement contracts owned by a sibling package, any change to those interfaces requires a coordinated update here.

Tech Stack Python 3.10+, built with the flit_core PEP 517 backend as part of a monorepo orchestrated by a custom PowerShell script and released via Azure Pipelines gated on release-please tags. Runtime dependencies are aiohttp, azure-core (for the TokenCredential/AsyncTokenCredential/AccessToken types), microsoft-kiota-abstractions (the sibling package defining the interfaces implemented here), and opentelemetry-api/sdk for tracing. Code is type-checked with mypy, formatted with yapf on a PEP 8 base, import-sorted with isort, and linted with pylint.

Code Quality Tests live under the package’s own tests/ directory using pytest and pytest-asyncio, with dummy sync and async azure-identity credential doubles standing in for real Azure calls. Coverage includes constructor validation (missing credentials, wrong types for scopes/allowed_hosts), the allowed-hosts validator, and URL scheme/host enforcement (HTTPS-only, localhost exception, invalid scheme, empty URL). Errors are raised through a small typed exception hierarchy rather than swallowed, and function signatures carry explicit type hints throughout. CI runs on GitHub Actions with a dedicated build workflow plus CodeQL scanning.

What Makes It Unique The standout design choice is unifying sync and async azure-identity credentials behind one async-first API by inspecting the awaitable-ness of the token result, so callers never need separate provider classes for the two credential styles. Combined with proactive host allow-listing and out-of-the-box CAE claims-challenge support, it handles several authentication edge cases that hand-rolled token wrappers commonly miss — though architecturally it remains a conventional, well-executed adapter rather than a novel approach.