{ "schema": "https://ai-atoms.com/schemas/skill-v1.json", "type": "skill", "id": "skill/azure-identity-ts", "version": "1.0.0", "name": "Azure Identity Ts", "description": "Authenticate to Azure services using Azure Identity SDK for JavaScript (@azure/identity). Use when configuring authentication with DefaultAzureCredential, managed identity, service principals, or i...", "system_prompt_fragment": "# Azure Identity SDK for TypeScript\n\nAuthenticate to Azure services with various credential types.\n\n## Installation\n\n```bash\nnpm install @azure/identity\n```\n\n## Environment Variables\n\n### Service Principal (Secret)\n\n```bash\nAZURE_TENANT_ID=\nAZURE_CLIENT_ID=\nAZURE_CLIENT_SECRET=\n```\n\n### Service Principal (Certificate)\n\n```bash\nAZURE_TENANT_ID=\nAZURE_CLIENT_ID=\nAZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem\nAZURE_CLIENT_CERTIFICATE_PASSWORD=\n```\n\n### Workload Identity (Kubernetes)\n\n```bash\nAZURE_TENANT_ID=\nAZURE_CLIENT_ID=\nAZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/tokens/azure-identity\n```\n\n## DefaultAzureCredential (Recommended)\n\n```typescript\nimport { DefaultAzureCredential } from \"@azure/identity\";\n\nconst credential = new DefaultAzureCredential();\n\n// Use with any Azure SDK client\nimport { BlobServiceClient } from \"@azure/storage-blob\";\nconst blobClient = new BlobServiceClient(\n \"https://.blob.core.windows.net\",\n credential\n);\n```\n\n**Credential Chain Order:**\n1. EnvironmentCredential\n2. WorkloadIdentityCredential\n3. ManagedIdentityCredential\n4. VisualStudioCodeCredential\n5. AzureCliCredential\n6. AzurePowerShellCredential\n7. AzureDeveloperCliCredential\n\n## Managed Identity\n\n### System-Assigned\n\n```typescript\nimport { ManagedIdentityCredential } from \"@azure/identity\";\n\nconst credential = new ManagedIdentityCredential();\n```\n\n### User-Assigned (by Client ID)\n\n```typescript\nconst credential = new ManagedIdentityCredential({\n clientId: \"\"\n});\n```\n\n### User-Assigned (by Resource ID)\n\n```typescript\nconst credential = new ManagedIdentityCredential({\n resourceId: \"/subscriptions//resourceGroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/\"\n});\n```\n\n## Service Principal\n\n### Client Secret\n\n```typescript\nimport { ClientSecretCredential } from \"@azure/identity\";\n\nconst credential = new ClientSecretCredential(\n \"\",\n \"\",\n \"\"\n);\n```\n\n### Client Certificate\n\n```typescript\nimport { ClientCertificateCredential } from \"@azure/identity\";\n\nconst credential = new ClientCertificateCredential(\n \"\",\n \"\",\n { certificatePath: \"/path/to/cert.pem\" }\n);\n\n// With password\nconst credentialWithPwd = new ClientCertificateCredential(\n \"\",\n \"\",\n { \n certificatePath: \"/path/to/cert.pem\",\n certificatePassword: \"\"\n }\n);\n```\n\n## Interactive Authentication\n\n### Browser-Based Login\n\n```typescript\nimport { InteractiveBrowserCredential } from \"@azure/identity\";\n\nconst credential = new InteractiveBrowserCredential({\n clientId: \"\",\n tenantId: \"\",\n loginHint: \"user@example.com\"\n});\n```\n\n### Device Code Flow\n\n```typescript\nimport { DeviceCodeCredential } from \"@azure/identity\";\n\nconst credential = new DeviceCodeCredential({\n clientId: \"\",\n tenantId: \"\",\n userPromptCallback: (info) => {\n console.log(info.message);\n // \"To sign in, use a web browser to open...\"\n }\n});\n```\n\n## Custom Credential Chain\n\n```typescript\nimport { \n ChainedTokenCredential,\n ManagedIdentityCredential,\n AzureCliCredential\n} from \"@azure/identity\";\n\n// Try managed identity first, fall back to CLI\nconst credential = new ChainedTokenCredential(\n new ManagedIdentityCredential(),\n new AzureCliCredential()\n);\n```\n\n## Developer Credentials\n\n### Azure CLI\n\n```typescript\nimport { AzureCliCredential } from \"@azure/identity\";\n\nconst credential = new AzureCliCredential();\n// Uses: az login\n```\n\n### Azure Developer CLI\n\n```typescript\nimport { AzureDeveloperCliCredential } from \"@azure/identity\";\n\nconst credential = new AzureDeveloperCliCredential();\n// Uses: azd auth login\n```\n\n### Azure PowerShell\n\n```typescript\nimport { AzurePowerShellCredential } from \"@azure/identity\";\n\nconst credential = new AzurePowerShellCredential();\n// Uses: Connect-AzAccount\n```\n\n## Sovereign Clouds\n\n```typescript\nimport { ClientSecretCredential, AzureAuthorityHosts } from \"@azure/identity\";\n\n// Azure Government\nconst credential = new ClientSecretCredential(\n \"\", \"\", \"\",\n { authorityHost: AzureAuthorityHosts.AzureGovernment }\n);\n\n// Azure China\nconst credentialChina = new ClientSecretCredential(\n \"\", \"\", \"\",\n { authorityHost: AzureAuthorityHosts.AzureChina }\n);\n```\n\n## Bearer Token Provider\n\n```typescript\nimport { DefaultAzureCredential, getBearerTokenProvider } from \"@azure/identity\";\n\nconst credential = new DefaultAzureCredential();\n\n// Create a function that returns tokens\nconst getAccessToken = getBearerTokenProvider(\n credential,\n \"https://cognitiveservices.azure.com/.default\"\n);\n\n// Use with APIs that need bearer tokens\nconst token = await getAccessToken();\n```\n\n## Key Types\n\n```typescript\nimport type { \n TokenCredential, \n AccessToken, \n GetTokenOptions \n} from \"@azure/core-auth\";\n\nimport {\n DefaultAzureCredential,\n DefaultAzureCredentialOptions,\n ManagedIdentityCredential,\n ClientSecretCredential,\n ClientCertificateCredential,\n InteractiveBrowserCredential,\n ChainedTokenCredential,\n AzureCliCredential,\n AzurePowerShellCredential,\n AzureDeveloperCliCredential,\n DeviceCodeCredential,\n AzureAuthorityHosts\n} from \"@azure/identity\";\n```\n\n## Custom Credential Implementation\n\n```typescript\nimport type { TokenCredential, AccessToken, GetTokenOptions } from \"@azure/core-auth\";\n\nclass CustomCredential implements TokenCredential {\n async getToken(\n scopes: string | string[],\n options?: GetTokenOptions\n ): Promise {\n // Custom token acquisition logic\n return {\n token: \"\",\n expiresOnTimestamp: Date.now() + 3600000\n };\n }\n}\n```\n\n## Debugging\n\n```typescript\nimport { setLogLevel, AzureLogger } from \"@azure/logger\";\n\nsetLogLevel(\"verbose\");\n\n// Custom log handler\nAzureLogger.log = (...args) => {\n console.log(\"[Azure]\", ...args);\n};\n```\n\n## Best Practices\n\n1. **Use DefaultAzureCredential** - Works in development (CLI) and production (managed identity)\n2. **Never hardcode credentials** - Use environment variables or managed identity\n3. **Prefer managed identity** - No secrets to manage in production\n4. **Scope credentials appropriately** - Use user-assigned identity for multi-tenant scenarios\n5. **Handle token refresh** - Azure SDK handles this automatically\n6. **Use ChainedTokenCredential** - For custom fallback scenarios\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.", "applicable_domains": [ "devops" ], "category": "devops", "invocation": [ "/azure-identity-ts" ], "authored_by": "claudeskills.in community", "source_url": "https://claudeskills.in/skill/azure-identity-ts", "provenance": { "source": "claudeskills.in", "source_url": "https://claudeskills.in/skill/azure-identity-ts", "license": "unknown", "imported_at": "2026-09-03", "notes": "Aggregated by claudeskills.in from community GitHub lists." }, "tags": [ "claudeskills", "devops" ], "lifecycle": "draft" }