Question: Does ManagedIdentityCredential read from env var?

[seesharprun]

In Azure identity libraries from other languages, you can set the AZURE_CLIENT_ID environment variable and the ManagedIdentityCredential class will automatically read that from the environment variable if it's set. You always have the option to override that manually.

It's a technique I use with the .NET/JS/Go/Python/Java Azure SDKs to automatically set the clientId for a user-assigned managed identity with a host like Azure App Service.

Is that implemented in this library? I tried to search for the implementation, but I could only find logic to read from the environment variable with WorkloadIdentityCredential.

https://github.com/Azure/azure-sdk-for-rust/blob/main/sdk/identity/azure_identity/src/credentials/workload_identity_credentials.rs#L73-L78

[seesharprun]

In a perfect world, the functionality for ManagedIdentityCredential would match the other Azure SDKs where you can opt to provide the client_id/object_id/resource_id manually for a user-assigned managed identity or opt to specify it in the environment variable.

If neither is specified, it's inferred to be a system-assigned managed identity.

I would imagine the implementation would be around here somewhere using a match:

https://github.com/Azure/azure-sdk-for-rust/blob/main/sdk/identity/azure_identity/src/managed_identity_credential.rs#L265-L278

Essentially, if none of the options are specified, check the environment variable in a manner similar to WorkloadIdentityCredential above.

I'm not a typical Rust developer, so I apologize for using the wrong terminology.

[chlowell]

I'm surprised this works with other SDKs, I had thought ManagedIdentityCredential read this variable only when configuring a workload identity. Are you using ManagedIdentityCredential directly or via DefaultAzureCredential?

[seesharprun]

@chlowell, It works with both ManagedIdentityCredential and DefaultAzureCredential. I'm using it in 20+ developer quickstart Azure Developer CLI (AZD) templates across .NET, Python, Node.js, Java, and Go.

Rust is the only Azure SDK that I found so far that doesn't support it. Here's a list of locations where the environment variable is called out as an explicit option for the other SDKs (that I could find):

	Documentation
.NET	https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/README.md#managed-identity-defaultazurecredential
Python	https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md#authenticate-with-defaultazurecredential
Node.js	https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#credentials-are-global-to-the-environment (This one is a little less clear in documentation, but it works in practice)
Java	https://github.com/Azure/azure-sdk-for-java/tree/azure-identity_1.16.0/sdk/identity/azure-identity#authenticate-a-user-assigned-managed-identity-with-defaultazurecredential
Go	https://github.com/Azure/azure-sdk-for-go/wiki/Set-up-Your-Environment-for-Authentication#configure-defaultazurecredential

You have the option of setting the client ID on the class itself or setting it in an environment variable. The advantage of the latter is that the application code is "not concerned" with the identity implementation. If I'm debugging locally, deploying to a host with a system-assigned managed identity, or deploying to a host with a user-assigned managed identity; it works the same without needing to change the code.

If you want to repro, here's a list of AZD templates illustrating the user of AZURE_CLIENT_ID in five languages:

	Documentation	AZD template
.NET	azure-samples/cosmos-db-nosql-dotnet-quickstart	azd init --template cosmos-db-nosql-dotnet-quickstart
Node.js	azure-samples/cosmos-db-nosql-nodejs-quickstart	azd init --template cosmos-db-nosql-nodejs-quickstart
Python	azure-samples/cosmos-db-mongodb-vcore-python-quickstart	azd init --template cosmos-db-mongodb-vcore-python-quickstart
Java	azure-samples/cosmos-db-table-java-quickstart	azd init --template cosmos-db-table-java-quickstart
Go	azure-samples/cosmos-db-table-go-quickstart	azd init --template cosmos-db-table-go-quickstart

To sum things up, we've found a universal convention among the other five languages that the DefaultAzureCredential and ManagedIdentityCredential will check the environment variable AZURE_CLIENT_ID if you do not explicitly set it when creating an instance of those types.