This article looks at how the Azure Identity library supports Microsoft Entra token authentication for applications hosted on Azure. This support is made possible through a set ofTokenCredential implementations, which are discussed in this article.

This article covers the following subjects:

• DefaultAzureCredential
• ManagedIdentityCredential

For troubleshooting authentication issues related to Azure-hosted applications, seeTroubleshoot Azure-hosted application authentication.

DefaultAzureCredential

DefaultAzureCredential combines credentials that are commonly used to authenticate when deployed, with credentials that are used to authenticate in a development environment. For more information, seeDefaultAzureCredential overview.

Configure DefaultAzureCredential

DefaultAzureCredential supports a set of configurations through setters on theDefaultAzureCredentialBuilder or environment variables.

• Setting the environment variablesAZURE_CLIENT_ID,AZURE_CLIENT_SECRET, andAZURE_TENANT_ID as defined inEnvironment variables configuresDefaultAzureCredential to authenticate as the service principal specified by the values.
• Setting.managedIdentityClientId(String) on the builder or the environment variableAZURE_CLIENT_ID configuresDefaultAzureCredential to authenticate as a user-assigned managed identity, while leaving them empty configures it to authenticate as a system-assigned managed identity.
• Setting.tenantId(String) on the builder or the environment variableAZURE_TENANT_ID configuresDefaultAzureCredential to authenticate to a specific tenant for either the shared token cache or IntelliJ IDEA.
• Setting the environment variableAZURE_USERNAME configuresDefaultAzureCredential to pick the corresponding cached token from the shared token cache.

Authenticate with DefaultAzureCredential

The following example demonstrates authenticating theSecretClient from theazure-security-keyvault-secrets client library usingDefaultAzureCredential:

// Azure SDK client builders accept the credential as a parameter.SecretClient client = new SecretClientBuilder()  .vaultUrl("https://<KEY_VAULT_NAME>.vault.azure.net")  .credential(new DefaultAzureCredentialBuilder().build())  .buildClient();

Authenticate a user-assigned managed identity with DefaultAzureCredential

The following example demonstrates authenticating theSecretClient from theazure-security-keyvault-secrets client library usingDefaultAzureCredential deployed to an Azure resource with a user-assigned managed identity configured.

/** * DefaultAzureCredential uses the user-assigned managed identity with the specified client ID. */DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()  .managedIdentityClientId("<CLIENT_ID>")  .build();// Azure SDK client builders accept the credential as a parameter.SecretClient client = new SecretClientBuilder()  .vaultUrl("https://<KEY_VAULT_NAME>.vault.azure.net")  .credential(credential)  .buildClient();

ManagedIdentityCredential

ManagedIdentityCredential authenticates the managed identity (system-assigned or user-assigned) of an Azure resource. So, if the application is running inside an Azure resource that supports managed identity throughIDENTITY/MSI,IMDS endpoints, or both, then this credential gets your application authenticated, and offers a secretless authentication experience.

For more information, seeWhat are managed identities for Azure resources?.

Authenticate in Azure with managed identity

The following example demonstrates authenticating theSecretClient from theazure-security-keyvault-secrets client library using theManagedIdentityCredential in a Virtual Machine, App Service, Functions app, Cloud Shell, Service Fabric, Arc, or AKS environment on Azure, with system-assigned or user-assigned managed identity enabled.

/** * Authenticate with a user-assigned managed identity. */ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()  .clientId("<CLIENT_ID>") // required only for user-assigned  .build();// Azure SDK client builders accept the credential as a parameter.SecretClient client = new SecretClientBuilder()  .vaultUrl("https://<KEY_VAULT_NAME>.vault.azure.net")  .credential(credential)  .buildClient();

Environment variables

You can configureDefaultAzureCredential andEnvironmentCredential with environment variables. Each type of authentication requires values for specific variables:

Service principal with secret

Service principal with certificate

Username and password

Configuration is attempted in this order. For example, if values for a client secret and certificate are both present, the client secret is used.

Next steps

This article covered authentication for applications hosted in Azure. This form of authentication is one of multiple ways you can authenticate in the Azure SDK for Java. The following articles describe other ways:

• Azure authentication in development environments
• Authentication with service principals
• Authentication with user credentials

If you run into issues related to Azure-hosted application authentication, seeTroubleshoot Azure-hosted application authentication.

After you've mastered authentication, seeConfigure logging in the Azure SDK for Java for information on the logging functionality provided by the SDK.