Authenticate Azure Services with Rust

Azure Identity SDK for Rust is an authentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD), installed via cargo add azure_identity. It exposes nine credential types: DeveloperToolsCredential (local development, tries CLI tools in order), ManagedIdentityCredential (Azure VMs, App Service, Functions, AKS), WorkloadIdentityCredential (Kubernetes workload identity), ClientSecretCredential and ClientCertificateCredential (service principal with a secret or certificate), AzureCliCredential and AzureDeveloperCliCredential (direct CLI auth), AzurePipelinesCredential (Azure Pipelines service connections), and ClientAssertionCredential (custom assertions for federated identity). The recommended local-development credential, DeveloperToolsCredential, tries developer tools in a fixed order: first AzureCliCredential (az login), then AzureDeveloperCliCredential (azd auth login).

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_secrets::SecretClient;

let credential = DeveloperToolsCredential::new(None)?;
let client = SecretClient::new(
    "https://my-vault.vault.azure.net/",
    credential.clone(),
    None,
)?;

ManagedIdentityCredential supports both system-assigned identity (ManagedIdentityCredential::new(None)?) and user-assigned identity via a ManagedIdentityCredentialOptions struct carrying a client_id. ClientSecretCredential authenticates a service principal from a tenant ID, client ID, and client secret. Service-principal configuration reads AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET from the environment; a user-assigned managed identity instead needs only AZURE_CLIENT_ID set to the identity's client ID.

Use it to authenticate any Azure SDK for Rust client against Microsoft Entra ID, whether locally via CLI-based credentials or in production via managed identity that avoids managing secrets entirely.

Credentials are Arc-wrapped and cheap to clone, so the same credential instance can be reused across multiple SDK clients rather than constructed per client. The tokio async runtime feature is enabled via cargo add azure_identity --features tokio.

Used alongside other Azure SDK for Rust client crates - the documented example pairs it with azure_security_keyvault_secrets::SecretClient to authenticate a Key Vault secrets client. Reference documentation is published on docs.rs, source is on GitHub under Azure/azure-sdk-for-rust, and the crate is published on crates.io.

Rust developers authenticating Azure SDK clients who need to pick the right credential type for the environment: CLI-based tools such as AzureCliCredential or AzureDeveloperCliCredential for local development, ManagedIdentityCredential for Azure-hosted production workloads with no secrets to manage, WorkloadIdentityCredential for Kubernetes, AzurePipelinesCredential for CI service connections, or ClientSecretCredential/ClientCertificateCredential for a standalone service principal.