Credential Types Reference
Azure Identity credential types for authenticating to Azure services using the @azure/identity TypeScript SDK.
Overview
The Azure Identity library provides various credential classes for different authentication scenarios. Choose the right credential based on your environment and security requirements.
Credential Selection Guide
| Scenario | Recommended Credential |
|---|---|
| Production (any environment) | DefaultAzureCredential |
| Azure VM/App Service | ManagedIdentityCredential |
| Service Principal (secret) | ClientSecretCredential |
| Service Principal (cert) | ClientCertificateCredential |
| Local development | AzureCliCredential or AzureDeveloperCliCredential |
| Browser application | InteractiveBrowserCredential |
| CI/CD pipeline | ClientSecretCredential or WorkloadIdentityCredential |
| Kubernetes (AKS) | WorkloadIdentityCredential |
DefaultAzureCredential (Recommended)
The most versatile credential - automatically tries multiple authentication methods.
typescript
import { DefaultAzureCredential } from "@azure/identity";
const credential = new DefaultAzureCredential();
// Works in all environments - dev and production
import { BlobServiceClient } from "@azure/storage-blob";
const blobClient = new BlobServiceClient(
"https://myaccount.blob.core.windows.net",
credential
);See DefaultAzureCredential overview for the current credential chain order and defaults.
Customizing DefaultAzureCredential
typescript
import { DefaultAzureCredential } from "@azure/identity";
const credential = new DefaultAzureCredential({
// Exclude specific credentials
excludeAzureCliCredential: true,
excludeAzurePowerShellCredential: true,
// For user-assigned managed identity