feat(storage-azure): Support Managed Identities / DefaultAzureCredential for authentication

[Patrickroelofs]

Currently, the @payloadcms/storage-azure plugin only supports authentication via a connectionString. Relying on them in modern cloud environments (like Azure App Service, AKS, or Azure Container Apps) goes against current security best practices, enterprises heavily prefer using Managed Identities.

Describe the solution you'd like

Update the @payloadcms/storage-azure plugin configuration to support standard Azure SDK credentials (like DefaultAzureCredential from @azure/identity).

Internally, the Azure @azure/storage-blob package already supports this via new BlobServiceClient(url, credential). The Payload plugin wrapper just needs to expose this capability.

Proposed API: Make connectionString optional if accountName (or storageURL) and a credential object are provided.

import { azureStorage } from '@payloadcms/storage-azure'
import { DefaultAzureCredential } from '@azure/identity'

export default buildConfig({
  // ...
  plugins: [
    azureStorage({
      collections: {
        media: true,
      },
      containerName: process.env.AZURE_STORAGE_CONTAINER_NAME,
      
      // NEW: Authenticate with Managed Identity
      accountName: process.env.AZURE_STORAGE_ACCOUNT_NAME, 
      credential: new DefaultAzureCredential(),
      
      // EXISTING: Connection string remains supported for backwards compatibility
      // connectionString: process.env.AZURE_STORAGE_CONNECTION_STRING, 
      
      allowContainerCreate: true,
      baseURL: process.env.AZURE_STORAGE_BASE_URL,
    }),
  ],
})

Describe alternatives you've considered

• Continuing to use Connection Strings: This violates internal security and compliance policies regarding zero-secret architectures in cloud deployments.

Additional context

The official Azure documentation recommends migrating away from connection strings and Shared Key authorization in favor of Microsoft Entra ID (Managed Identities) for better security and granular RBAC control: Authorize access to blobs using Microsoft Entra ID.