Azure Authentication Best Practices

Source: Microsoft — Passwordless connections for Azure services and Azure Identity client libraries.

Golden Rule

Use managed identities and Azure RBAC in production. Reserve DefaultAzureCredential for local development only.

Authentication by Environment

Environment	Recommended Credential	Why
Production (Azure-hosted)	ManagedIdentityCredential (system- or user-assigned)	No secrets to manage; auto-rotated by Azure
Production (on-premises)	ClientCertificateCredential or WorkloadIdentityCredential	Deterministic; no fallback chain overhead
CI/CD pipelines	AzurePipelinesCredential / WorkloadIdentityCredential	Scoped to pipeline identity
Local development	DefaultAzureCredential	Chains CLI, PowerShell, and VS Code credentials for convenience

Why Not DefaultAzureCredential in Production?

1. Unpredictable fallback chain — walks through multiple credential types, adding latency and making failures harder to diagnose.
2. Broad surface area — checks environment variables, CLI tokens, and other sources that should not exist in production.
3. Non-deterministic — which credential actually authenticates depends on the environment, making behavior inconsistent across deployments.
4. Performance — each failed credential attempt adds network round-trips before falling back to the next.

Production Patterns

.NET

using Azure.Identity;

var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain