Azure Identity Rust

Azure Identity SDK for Rust

Authentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD).

Installation

cargo add azure_identity

Environment Variables

# Service Principal (for production/CI)
AZURE_TENANT_ID=
AZURE_CLIENT_ID=
AZURE_CLIENT_SECRET=

# User-assigned Managed Identity (optional)
AZURE_CLIENT_ID=

DeveloperToolsCredential

The recommended credential for local development. Tries developer tools in order (Azure CLI, Azure Developer CLI):

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_secrets::SecretClient;

let credential = DeveloperToolsCredential::new(None)?;
let client = SecretClient::new(
    "https://my-vault.vault.azure.net/",
    credential.clone(),
    None,
)?;

Credential Chain Order

| Order | Credential | Environment | |-------|-----------|-------------| | 1 | AzureCliCredential | az login | | 2 | AzureDeveloperCliCredential | azd auth login |

Credential Types

| Credential | Usage | |------------|-------| | DeveloperToolsCredential | Local development - tries CLI tools | | ManagedIdentityCredential | Azure VMs, App Service, Functions, AKS | | WorkloadIdentityCredential | Kubernetes workload identity | | ClientSecretCredential | Service principal with secret | | ClientCertificateCredential | Service principal with certificate | | AzureCliCredential | Direct Azure CLI auth | | AzureDeveloperCliCredential | Direct azd CLI auth | | AzurePipelinesCredential | Azure Pipelines service connection | | ClientAssertionCredential | Custom assertions (federated identity) |

ManagedIdentityCredential

For Azure-hosted resources:

use azure_identity::ManagedIdentityCredential;

// System-assigned managed identity
let credential = ManagedIdentityCredential::new(None)?;

// User-assigned managed identity
let options = ManagedIdentityCredentialOptions {
    client_id: Some("".into()),
    ..Default::default()
};
let credential = ManagedIdentityCredential::new(Some(options))?;

ClientSecretCredential

For service principal with secret:

use azure_identity::ClientSecretCredential;

let credential = ClientSecretCredential::new(
    "".into(),
    "".into(),
    "".into(),
    None,
)?;

Best Practices

1. Use DeveloperToolsCredential for local dev — automatically picks up Azure CLI
2. Use ManagedIdentityCredential in production — no secrets to manage
3. Clone credentials — credentials are Arc-wrapped and cheap to clone
4. Reuse credential instances — same credential can be used with multiple clients
5. Use tokio feature — cargo add azure_identity --features tokio

Reference Links

| Resource | Link | |----------|------| | API Reference | https://docs.rs/azureidentity | | Source Code | https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/identity/azureidentity | | crates.io | https://crates.io/crates/azure_identity |

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: tmolavi
• Source: tmolavi/mcp-agent-skills-hub
• License: MIT
• Homepage: https://molavi.pro

Install and usage instructions live in the source repository linked above.