Azure Identity 101 - DefaultAzureCredential

var client = new SecretClient(vaultUri, new DefaultAzureCredential());

```text

```java

public void createDefaultAzureCredential() {
    DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder().build();

    SecretClient client = new SecretClientBuilder()
        .vaultUrl(vaultUri)
        .credential(defaultCredential)
        .buildClient();
}

```text

```python

cred = DefaultAzureCredential()

client = SecretClient(vault_url=vault_url, credential=cred)

```text

```typescript

const credential = new DefaultAzureCredential();

const client = new SecretClient(vaultUrl, credential);

```python

Under the covers, `DefaultAzureCredential` will attempt to get a token from a number of token providers including Azure dev tools, such as the Azure CLI, Azure PowerShell, VS Code, Visual Studio, and IntelliJ. When deployed to production it also supports [Managed Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) and [Service Principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals) authentication without any code changes.

> You can find all language packages, docs, and samples here: [https://azure.com/sdk](https://azure.com/sdk)

## 1. Installation

Install the Azure Identity package

- [C#](#tabs-1)
- [Java](#tabs-2)
- [Python](#tabs-3)
- [TypeScript](#tabs-4)

```bash

dotnet add package Azure.Identity

```text

```xml

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
    <version>1.3.6</version>
</dependency>

```text

```python

pip install azure-identity

```text

```typescript

npm install --save @azure/identity

```markdown

## 2. Code

Use DefaultAzureCredential in your app

- [C#](#tabs-1)
- [Java](#tabs-2)
- [Python](#tabs-3)
- [TypeScript](#tabs-4)

```csharp

var client = new SecretClient(vaultUri, new DefaultAzureCredential());

```text

```java

public void createDefaultAzureCredential() {
    DefaultAzureCredential defaultCredential = new DefaultAzureCredentialBuilder().build();

    SecretClient client = new SecretClientBuilder()
        .vaultUrl(vaultUri)
        .credential(defaultCredential)
        .buildClient();
}

```text

```python

cred = DefaultAzureCredential()

client = SecretClient(vault_url=vault_url, credential=cred)

```text

```typescript

const credential = new DefaultAzureCredential();

const client = new SecretClient(vaultUrl, credential);

```markdown

## 3. Roles

Configure your account with the appropriate roles for the service you need to call. This explicitly tells Azure to allow your account to execute operations against Azure services.

For example, do the following when you need to give an account permissions to read Key Vault secrets:

1. Get the Role ID

- Go to: [Azure built-in roles](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles)
- Find the “Key Vault Secrets User” role ID: `4633458b-17de-408a-b874-0445c86b69e6`

!["Key Vault Secrets User Role"](/images/azure-identity-101/105.png)

1. Get your Azure account ID

- Use the Azure CLI to find your Azure account ID:

```bash

az ad signed-in-user show --query 'objectId' -o tsv

```sql

In my case it is: `6afb624e-739f-4bf3-b5f8-e11cab190039`

1. Assign your account the role

- Use the Azure CLI to create the role assignment

```bash

az role assignment create --assignee 6afb624e-739f-4bf3-b5f8-e11cab190039 --role 4633458b-17de-408a-b874-0445c86b69e6