Authenticate Java Apps with Azure AD

Reference for authenticating Java applications to Azure services via Microsoft Entra ID (Azure AD) using the azure-identity SDK. Covers eight credential types and when to use each: DefaultAzureCredential (recommended, tries environment variables, Workload Identity, Managed Identity, Azure CLI, Azure PowerShell, and Azure Developer CLI in order), ManagedIdentityCredential (system- or user-assigned, for App Service, Functions, AKS, and VMs), WorkloadIdentityCredential (AKS, reads AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE), EnvironmentCredential (CI/CD via env vars), ClientSecretCredential and ClientCertificateCredential (service principals with a secret or a PEM/PFX certificate, including certificate-chain SNI), AzureCliCredential (local dev via az login), InteractiveBrowserCredential (desktop login flow), and DeviceCodeCredential (headless devices). Also covers ChainedTokenCredential for custom fallback chains, token caching including SharedTokenCacheCredential, sovereign-cloud authority hosts (Azure Government, Azure China), structured error handling for CredentialUnavailableException and ClientAuthenticationException, and AZURE_LOG_LEVEL-based auth logging.

Use when wiring up authentication for a Java app calling any Azure SDK client (Blob Storage, Key Vault, and others) - choosing the right credential type for the deployment target is the core decision this skill answers. Default to DefaultAzureCredential unless there is a specific reason to pin one credential; use ManagedIdentityCredential or WorkloadIdentityCredential in production Azure-hosted environments so no secret has to be managed at all. Don't reach for ClientSecretCredential or hardcoded environment secrets in production when a managed identity is available - the skill's own best practices flag secrets as a last resort, not a default. Not applicable outside Java or outside Azure - this covers only the com.azure:azure-identity library.

Inputs are Azure identifiers - tenant ID, client ID, client secret or certificate path, managed-identity client or resource ID - supplied via builder methods or the documented AZURE_* environment variables. Output is a TokenCredential object (DefaultAzureCredential, ManagedIdentityCredential, and so on) that any Azure SDK client builder accepts via .credential(credential), or directly an AccessToken from credential.getToken(...) for manual token acquisition.

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
    <version>1.15.0</version>
</dependency>

Integrates with any Azure SDK for Java client (Blob Storage, Key Vault, and others shown via BlobServiceClientBuilder and KeyClientBuilder), Azure CLI (az login) for local development, Azure Kubernetes Service workload identity federation, and CI/CD pipelines via environment-variable credentials. Supports Azure Government and Azure China sovereign clouds through AzureAuthorityHosts.

Java developers and platform engineers setting up or troubleshooting Azure authentication across environments - local dev, CI/CD, App Service or Functions, AKS, or desktop and CLI tools - who need the right credential type and its exact builder configuration rather than re-deriving it from Azure docs.