Skip to content

Add code snippet to credential chains doc #49637

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
+21 −3
Draft

Add code snippet to credential chains doc #49637

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions docs/azure/sdk/authentication/credential-chains.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: 'Credential chains in the Azure Identity library for .NET'
description: 'This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity library.'
ms.topic: concept-article
ms.date: 08/13/2025
ms.date: 11/05/2025
---

# Credential chains in the Azure Identity library for .NET
Expand Down Expand Up @@ -112,7 +112,9 @@ When a value of `dev` is used, the chain looks as follows:

:::image type="content" source="../media/mermaidjs/default-azure-credential-environment-variable-development.svg" alt-text="DefaultAzureCredential with AZURE_TOKEN_CREDENTIALS set to 'dev'":::

To ensure the environment variable is defined and set to a supported string, use constructor overload <xref:Azure.Identity.DefaultAzureCredential.%23ctor(System.String,Azure.Identity.DefaultAzureCredentialOptions)?displayProperty=name>.
To ensure the environment variable is defined and set to a supported string, use constructor overload <xref:Azure.Identity.DefaultAzureCredential.%23ctor(System.String,Azure.Identity.DefaultAzureCredentialOptions)?displayProperty=name>:

:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_DacEnvVar" highlight="8-9":::

#### Use a specific credential

Expand All @@ -132,7 +134,9 @@ To exclude all credentials except for one, set environment variable `AZURE_TOKEN
> [!IMPORTANT]
> The `AZURE_TOKEN_CREDENTIALS` environment variable supports individual credential names in `Azure.Identity` package versions 1.15.0 and later.

To ensure the environment variable is defined and set to a supported string, use constructor overload <xref:Azure.Identity.DefaultAzureCredential.%23ctor(System.String,Azure.Identity.DefaultAzureCredentialOptions)?displayProperty=name>.
To ensure the environment variable is defined and set to a supported string, use constructor overload <xref:Azure.Identity.DefaultAzureCredential.%23ctor(System.String,Azure.Identity.DefaultAzureCredentialOptions)?displayProperty=name>:
Copy link
Contributor

@christothes christothes Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we validate the environment variable value no matter which approach you take. Should we reword this so that it says something like - "DefaultAzureCredential will validate the value set for the enviornmnent variable and will throw if validation fails."


:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_DacEnvVar" highlight="8-9":::

## ChainedTokenCredential overview

Expand Down
14 changes: 14 additions & 0 deletions docs/azure/sdk/snippets/authentication/credential-chains/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,20 @@
});
#endregion snippet_Dac

#region snippet_DacEnvVar
builder.Services.AddAzureClients(clientBuilder =>
{
clientBuilder.AddSecretClient(
new Uri($"https://{keyVaultName}.vault.azure.net"));
clientBuilder.AddBlobServiceClient(
new Uri($"https://{storageAccountName}.blob.core.windows.net"));

DefaultAzureCredential credential = new(
DefaultAzureCredential.DefaultEnvironmentVariableName);
clientBuilder.UseCredential(credential);
});
#endregion snippet_DacEnvVar

#region snippet_DacExcludes
builder.Services.AddAzureClients(clientBuilder =>
{
Expand Down
Loading