Authenticate Securely to Azure Services

Azure Identity SDK for TypeScript authenticates applications to Azure services using multiple credential types including managed identity, service principals (secret or certificate), interactive browser login, device code flow, and developer CLI credentials. It provides a unified authentication interface that works across development and production environments through the DefaultAzureCredential chain, which automatically tries multiple authentication methods in sequence.

Use this skill when you need to authenticate TypeScript or Node.js applications to Azure services like Blob Storage, Key Vault, or other Azure resources. It is ideal for applications running in Azure (using managed identity), Kubernetes workloads with federated tokens, or local development using Azure CLI. Use DefaultAzureCredential for applications that need to work seamlessly across development and production without code changes.

Do NOT use this skill if you are working with non-Azure cloud providers or if your application requires OAuth flows outside the Azure ecosystem. Avoid hardcoding credentials directly in code; always use environment variables or managed identity instead.

You provide tenant IDs, client IDs, and authentication secrets (client secrets, certificate paths, or federated token files) through environment variables or constructor parameters. For managed identity scenarios, the Azure platform provides credentials automatically. For interactive flows, you provide callback functions to handle user prompts.

You receive TokenCredential objects that can be passed to any Azure SDK client. These credentials automatically handle token acquisition, caching, and refresh. The getBearerTokenProvider function returns access tokens as strings for APIs that require bearer tokens directly.

The SDK integrates with Azure Blob Storage (BlobServiceClient) and all Azure SDK clients that accept TokenCredential. It supports authentication through Azure CLI (az login), Azure Developer CLI (azd auth login), and Azure PowerShell (Connect-AzAccount). The SDK works with sovereign clouds including Azure Government and Azure China through AzureAuthorityHosts configuration. It supports Kubernetes workload identity through federated token files.

This skill serves Node.js and TypeScript developers building applications that consume Azure services. It is essential for DevOps engineers deploying applications to Azure App Service, Azure Functions, or Azure Kubernetes Service where managed identity eliminates secret management. Backend developers building APIs that access Azure resources will use service principal authentication with secrets or certificates. Frontend developers can use InteractiveBrowserCredential for user-delegated access scenarios.

Installation:

npm install @azure/identity

Basic usage with DefaultAzureCredential:

import { DefaultAzureCredential } from "@azure/identity";

const credential = new DefaultAzureCredential();

// Use with any Azure SDK client
import { BlobServiceClient } from "@azure/storage-blob";
const blobClient = new BlobServiceClient(
  "https://<account>.blob.core.windows.net",
  credential
);

Environment variables for service principal (secret):

AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

The DefaultAzureCredential tries credentials in this order: EnvironmentCredential, WorkloadIdentityCredential, ManagedIdentityCredential, VisualStudioCodeCredential, AzureCliCredential, AzurePowerShellCredential, and AzureDeveloperCliCredential. For custom fallback scenarios, use ChainedTokenCredential to define your own credential chain order.