Azure Identity for .NET
Guides .NET applications in authenticating Azure SDK clients with Microsoft Entra ID.
The document covers managed identity, service principals, certificates, and developer credentials, and uses placeholders; however, it does not explain least privilege, user confirmation, credential data flows, secret-at-rest handling, or log redaction. It shows client secrets and certificate passwords without external-effect or rollback guidance, so points are deducted.
Installation, credential-chain examples, exception types, and retry configuration are reasonably consistent; however, there are no skill-specific tests, dependency versions, environment prerequisites, or reproducible diagnostic procedures. API and SDK-version compatibility cannot be confirmed statically, limiting the score.
Triggers, the .NET/Azure Identity audience, and major development, production, managed-identity, and sovereign-cloud scenarios are clear; non-fit boundaries, input/output expectations, permission prerequisites, Chinese-language support, and network reachability are not stated, so points are deducted.
The document is well organized and includes installation, environment variables, examples, exceptions, related packages, MIT licensing, author, and a version field; it lacks a changelog, explicit maintenance owner and update path, dependency versions, and fuller limitation notes, so points are deducted.
The examples provide a directly useful starting point for Azure .NET authentication and cover common credential types and dependency injection; there is no skill-specific execution evidence, complete end-to-end workflow, permission setup guidance, or comparison with alternatives. The static-review cap therefore applies.
Microsoft/Azure SDK, NuGet, API, and best-practice links provide some primary-source traceability; however, the skill has no committed dedicated tests or execution results, and repository-level CI/test material does not establish coverage of this path's key examples, so evidence remains limited.
- Do not use DefaultAzureCredential in production without reviewing its chain, tenant, and permission scope.
- Never commit AZURE_CLIENT_SECRET, certificate passwords, or authentication logs to a repository or shared log sink.
- Pin and verify Azure.Identity and related package versions before relying on the examples with the target .NET runtime.
- The document does not state mainland-China network, enterprise-proxy, or sovereign-cloud prerequisites; validate these separately before deployment.
What does this skill do, and when should you use it?
This Agent Skill focuses on the Azure.Identity authentication library for .NET. It helps coding agents install the relevant packages and configure DefaultAzureCredential, managed identities, service principals, and developer credentials. The guidance also covers environment variables, ASP.NET Core dependency injection, sovereign clouds, custom credential chains, retries, diagnostics, and exception handling. It fits teams building .NET applications that access Azure SDK clients through Microsoft Entra ID.
Provides installation commands for Azure.Identity, Microsoft.Extensions.Azure, and Azure.Identity.Broker; shows environment-variable configuration for secret-based and certificate-based service principals and managed identities; supplies C# examples for DefaultAzureCredential, ManagedIdentityCredential, ClientSecretCredential, ClientCertificateCredential, ChainedTokenCredential, and developer credentials; demonstrates ASP.NET Core dependency injection, sovereign-cloud authority hosts, retry configuration, Azure Identity logging, exception handling, and credential reuse; catalogs credential types, related packages, reference links, and Azure services supporting managed identity.
- A .NET developer integrating Blob Storage or Key Vault needs a standard DefaultAzureCredential setup.
- A team deploying to App Service, Functions, AKS, or virtual machines needs system-assigned or user-assigned managed identity authentication.
- A local developer needs to switch among Azure CLI, Azure PowerShell, Azure Developer CLI, Visual Studio, and browser credentials.
- An ASP.NET Core team needs to register Azure clients and credentials through Microsoft.Extensions.Azure.
- A developer targeting Azure Government or Azure China needs to configure the appropriate authority host.
What are this skill's strengths and limitations?
- Covers common Microsoft Entra ID credentials from local development through Azure-hosted workloads.
- Includes copyable C# and shell examples for common Azure SDK client integrations.
- Addresses production credential selection, credential reuse, retries, diagnostics, and exception handling.
- Includes ASP.NET Core dependency injection and sovereign-cloud configuration guidance.
- The skill provides guidance and examples, not executable scripts or a test suite.
- The current DefaultAzureCredential chain order is delegated to external official documentation rather than fully reproduced here.
- Examples use placeholders; Entra ID application registration, role assignment, and permission setup are outside the documented scope.
- The source does not specify a .NET SDK version or a verified platform matrix.
How do you install this skill?
Run npx skills add microsoft/skills in an Agent Skills-compatible client and select the needed skill in the wizard. This skill is located at .github/plugins/azure-sdk-dotnet/skills/azure-identity-dotnet/SKILL.md. The repository does not document a dedicated single-skill installation command. For the .NET packages described by the skill, run dotnet add package Azure.Identity; optionally add Microsoft.Extensions.Azure for ASP.NET Core integration or Azure.Identity.Broker for brokered authentication and Visual Studio Code credential support.
How do you use this skill?
Ask a coding agent for a request containing terms such as “Azure Identity,” DefaultAzureCredential, ManagedIdentityCredential, ClientSecretCredential, “.NET authentication,” or “credential chain.” Example: Configure credentials for my .NET BlobServiceClient for local development and Azure App Service. The agent should produce package commands, C# credential configuration, environment variables, error handling, and production-oriented guidance.
How does this skill compare with similar options?
The skill presents DefaultAzureCredential as the recommended choice for most scenarios, while recommending a deterministic credential such as ManagedIdentityCredential for production. ChainedTokenCredential is presented for custom authentication chains.