Authentication & Credentials — The Foundry SDK
[ ABORT TO HUD ]
SEQ. 1
SEQ. 2
SEQ. 3
SEQ. 4
Authentication & Credentials
Securing SDK Access
The SDK uses DefaultAzureCredential from the Azure Identity library, which automatically tries multiple authentication methods:
Authentication Chain
- Environment variables (AZURE_CLIENT_ID, etc.) - for CI/CD
- Managed Identity - for Azure-hosted apps (VMs, App Service)
- Azure CLI (
az login) - for local development - VS Code / Azure PowerShell - additional dev options
Best Practices
| Environment | Use | Why |
|---|---|---|
| Local Dev | Azure CLI (az login) | Simple, no secrets to manage |
| Production | Managed Identity | No credentials in code, auto-rotated |
| CI/CD | Service Principal + Environment vars | Automated, scoped permissions |
Entra ID Token Scopes & Keyless RBAC
When authenticating with DefaultAzureCredential, AIProjectClient automatically requests tokens for https://ai.azure.com/.default (governed by the Foundry User / Azure AI User role on the project), while direct Azure OpenAI / Foundry Tools calls use https://cognitiveservices.azure.com/.default (governed by Cognitive Services OpenAI User).
🚧 Important: Never hardcode API keys in your application code. Always use
DefaultAzureCredential or Managed Identity. API keys should only be used for quick prototyping and testing.⌨ HANDS-ON LABAuthenticate Foundry Client via Azure CLI Token
⭐ +150 XPAcquire an Entra ID token using az account get-access-token for AI services API authorization.
1Acquire an OAuth bearer token for the Cognitive Services resource scope.
OBJECTIVE 1 / 1 — type "hint" if stuck
FOUNDRY VERIFICATION
QUERY 1 // 1
What authentication method should you use for production Azure AI Foundry applications?
Hardcoded API keys
Managed Identity
Username and password
Anonymous access