Azure Identity for Rust
Configure Microsoft Entra ID authentication for Azure SDK clients written in Rust.
The document restricts use to official azure_* crates and recommends avoiding hardcoded credentials, using environment variables, and applying RBAC, reducing dependency and privilege risk. However, the example prints secret.value with debug formatting, which may expose sensitive data, and it lacks explicit confirmation, log-redaction, least-privilege detail, and recovery guidance, so points are deducted.
Installation commands, credential categories, and primary code paths are broadly consistent, with Rust error propagation. However, versions are not pinned, no key-path tests or reproducible static evidence are provided, the Key Vault service crate used by the example is absent from the install command, and abnormal-input feedback is mostly generic errors; the score is therefore conservative and capped by static calibration.
Audience, scenarios, trigger phrases, and the local-development/production distinction are reasonably clear, including the explicit statement that Rust lacks DefaultAzureCredential. Non-fit boundaries, input/output contracts, compatibility ranges, Chinese-language support, and mainland-China reachability are not addressed, so points are deducted.
The skill includes metadata, installation, environment variables, authentication examples, a credential table, best practices, reference links, MIT licensing, and Microsoft attribution. It lacks a version policy, changelog, explicit maintenance/update path, FAQ, and troubleshooting guidance; dependency instructions are also incomplete, so points are deducted.
It can directly guide common Rust Azure authentication choices and basic implementation, offering useful value over manual lookup. However, example completeness is limited, dependencies are not fully listed, and API/version correctness is not supported by in-file test evidence, so substantial human review remains necessary and the static cap applies.
The skill supplies auditable crates.io, docs.rs, and Azure SDK source references and states an official-crate constraint. No execution was performed, and the selected skill has no committed dedicated tests, CI coverage, or pinned versions in the supplied evidence; corroboration is therefore limited and points are deducted.
- Do not print secret.value in production code or logs; apply redaction and least-privilege RBAC.
- The Key Vault service crate used in the example is absent from the installation command, and azure_identity/API versions are not pinned; verify the matching version documentation and add all required dependencies before implementation.
- The document does not address reachability of Azure CLI, azd, or Azure services from mainland-China networks or provide alternatives.
What it does & when to use it
This skill helps Rust developers authenticate Azure SDK clients with the official Azure Rust crates. It covers local development, Azure-hosted workloads, service principals, workload identity, and direct Azure CLI credentials. It explicitly notes that the Rust SDK does not provide DefaultAzureCredential: use DeveloperToolsCredential locally and ManagedIdentityCredential in production. The guide also covers installation, environment variables, credential selection, client reuse, and RBAC considerations.
Shows how to install azure_identity, azure_core, and tokio with cargo add; configure AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET; create DeveloperToolsCredential, ManagedIdentityCredential, and ClientSecretCredential; authenticate locally with az login or azd auth login; clone and reuse credentials across Azure clients; and assign appropriate RBAC roles for target services.
- A Rust developer needs local access to Azure services through Azure CLI or Azure Developer CLI and uses DeveloperToolsCredential.
- A Rust application runs on a VM, App Service, Functions, or AKS and needs Azure-hosted identity through ManagedIdentityCredential.
- A CI/CD pipeline or service account needs service-principal authentication with a client secret through ClientSecretCredential.
- A Kubernetes workload needs federated workload identity and should use WorkloadIdentityCredential.
- An application creates multiple Azure SDK clients and needs to share one credential across them.
Pros & cons
- Covers local development, managed identity, and service-principal authentication scenarios for Rust Azure SDK clients.
- Clearly distinguishes DeveloperToolsCredential from ManagedIdentityCredential and warns that the Rust SDK has no DefaultAzureCredential.
- Includes guidance on official crate selection, environment variables, credential reuse, and RBAC.
- Provides a concrete Key Vault SecretClient example and copyable Cargo commands.
- Its scope is Azure authentication; it does not provide complete usage guidance for individual Azure service clients.
- The supplied material does not show skill-specific test scenarios or test results.
- DeveloperToolsCredential requires an authenticated Azure CLI or Azure Developer CLI session for local use; production deployments still require correctly configured identity and permissions.
- The service-principal example uses a client secret; certificate authentication is listed but not demonstrated.
How to install
Install the collection into the agent environment with npx skills add microsoft/skills, then select azure-identity-rust in the installation wizard. The skill is located at .github/plugins/azure-sdk-rust/skills/azure-identity-rust/SKILL.md. In a Rust project, run: cargo add azure_identity azure_core tokio. A direct azure_core dependency is optional when the code does not import azure_core types directly.
How to use
Use triggers such as “azure identity rust,” “DeveloperToolsCredential,” “authentication rust,” “managed identity rust,” “credential rust,” or “Entra ID rust.” For local development, run az login or azd auth login and use DeveloperToolsCredential::new(None)?; for production, use ManagedIdentityCredential::new(None)?; for service-principal authentication, use ClientSecretCredential::new(<tenant-id>, <client-id>, <client-secret>, None)?. Use only official azure_* crates published by the azure-sdk crates.io user; do not use deprecated azure_sdk_* crates or community crates.
Compared to similar skills
Compared with the deprecated azure_sdk_* crates and community crates, this skill requires the official azure_* crates published by the azure-sdk crates.io user. Compared with DefaultAzureCredential in other Azure SDK languages, the Rust SDK has no single credential of that name; use DeveloperToolsCredential for local development and ManagedIdentityCredential for production.