Azure Identity for Python
A practical skill for securing Python Azure applications with Microsoft Entra ID credentials.
The documentation promotes Entra authentication, managed identity, environment-based secrets, and credential context managers, and warns against hardcoded credentials and unencrypted cache fallback. However, DefaultAzureCredential attempts multiple local credential sources by default, debug logging may expose sensitive authentication diagnostics, and the wildcard tenant example permits any tenant. Least-privilege, confirmation, data-flow, and recovery boundaries are not fully specified, so points are deducted.
The main and reference documents are broadly consistent on sync, async, caching, error handling, and logging, and they distinguish credential-unavailable from authentication-failure errors. However, the Python package version is not pinned, current chain order and parameters depend on external documentation, and no executable tests for this skill's key paths are provided, so the static score is conservative.
Triggers, audience, and common environments are reasonably clear, covering local development, Azure hosting, CI/CD, desktop, and headless use. Non-fit scenarios, permission prerequisites, input/output boundaries, and false-trigger conditions are not explicit; Chinese-language guidance is absent, with mainland-China support limited to sovereign-cloud examples, so points are deducted.
The skill has front matter, MIT licensing, author and version metadata, installation notes, layered reference files, an environment matrix, and external API references. It lacks a skill-specific changelog, dependency-version policy, explicit maintenance/update path, FAQ, and complete limitations disclosure; some reference material is duplicated, so points are deducted.
Coverage includes DefaultAzureCredential, managed identity, service principals, workload identity, token providers, async usage, and error handling, giving directly useful guidance for common authentication tasks. Most examples use placeholders, and there is no demonstrated end-to-end validation, permission setup, or comparison with alternatives. Static review cannot confirm direct execution against the target package version, so the score is capped at the static limit.
The material names traceable primary sources such as Microsoft Learn, PyPI, and the Azure SDK source, while repository context shows generic CI, evaluation workflows, and test infrastructure. However, the supplied files do not demonstrate skill-specific testing or independent reproduction, and the references are not pinned to a precise dependency version, so the score stays at the static ceiling.
- DefaultAzureCredential may unexpectedly use a developer's local sign-in; production deployments should constrain the credential chain explicitly and review its permissions.
- Do not use unencrypted persistent caching or unrestricted debug logging in production; avoid additionally_allowed_tenants=["*"] unless tenant boundaries have been explicitly reviewed.
- The installation command does not pin azure-identity; verify the current API, dependencies, and cloud-environment support before use.
- This is a static documentation review; examples, authentication flows, and skill-specific tests were not executed.
What does this skill do, and when should you use it?
This skill helps Python developers authenticate Azure SDK clients with Microsoft Entra ID. It covers DefaultAzureCredential, managed identities, service principals, workload identity, developer sign-in, direct token acquisition, and bearer-token providers for non-Azure SDK clients. It also documents synchronous and asynchronous lifecycles, credential-chain customization, sovereign clouds, persistent caching, multi-tenant access, logging, and error handling. It fits teams seeking one authentication pattern across local development, Azure hosting, and CI/CD.
Shows how to install azure-identity and configure environment variables for tenants, clients, secrets, certificates, authority hosts, managed identities, and credential selection; generates Python examples for DefaultAzureCredential and specific credential classes; demonstrates get_token(), get_bearer_token_provider(), sync and async clients, custom chains, token caching, logging, and exception handling; maps deployment environments to recommended credentials.
- A Python developer needs Azure SDK clients to authenticate locally through Azure CLI, VS Code, or another developer credential.
- An App Service, Functions, or VM workload needs to access Azure services through managed identity.
- A service needs client-secret, certificate, or workload-federated service-principal authentication.
- An AKS workload needs Microsoft Entra Workload ID token acquisition.
- An application needs a bearer-token provider for Azure OpenAI or another non-Azure SDK client.
What are this skill's strengths and limitations?
- Covers local development, Azure-hosted workloads, CI/CD, desktop applications, and headless tools.
- Includes sync and async APIs, credential-chain configuration, environment variables, error classification, and debug logging.
- Emphasizes DefaultAzureCredential, managed identity, credential reuse, and context-manager lifecycles.
- States the Python version requirement and provides package and API reference links.
- The skill provides guidance and snippets rather than a complete runnable project or deployment automation.
- Examples depend on Azure services, identity configuration, and network access; required permissions and tenant setup remain the user's responsibility.
- The README's test-coverage summary does not explicitly establish independent test scenarios for this skill.
- Persistent token caching, certificate authentication, and multi-tenant access require the adopter to set an appropriate security policy.
How do you install this skill?
Run npx skills add microsoft/skills in the supported skills installation flow and select azure-identity-py in the wizard. The collection installs into the selected Agent directory, such as .github/skills/ for GitHub Copilot. The README does not provide a separate installation command for this plugin path.
How do you use this skill?
Use a trigger prompt such as: Configure authentication for a Python Blob Storage client with azure-identity and DefaultAzureCredential so it works in local development and Azure deployment, including proper credential and client cleanup. You can also name managed identity, service principals, AKS workload identity, token caching, or credential-chain troubleshooting as the target scenario.