[Azure.Core] Phase 2a: AzureCredentialResolver + scope flip + ApiKey deletion by m-nash · Pull Request #59256 · Azure/azure-sdk-for-net

m-nash · 2026-05-14T17:38:41Z

Summary

Phase 2a of the Azure.Core CredentialResolver migration. Introduces Azure.Identity.AzureCredentialResolver (experimental, SCME0002) — an Azure-flavored implementation of System.ClientModel.Primitives.CredentialResolver — plus convenience extensions on IConfiguration, IServiceCollection, and IHostApplicationBuilder. Also flips the Azure OpenAI default-scope quirk to write at the canonical SCM 1.12.0+ location, and stops the resolver from claiming ApiKeyCredential sections.

What's changed

New public API (`SCME0002`)

Azure.Identity.AzureCredentialResolver — a CredentialResolver that resolves Azure token credential sections (AzureCliCredential, ManagedIdentityCredential, ChainedTokenCredential, etc.) into TokenCredential instances.
IConfiguration.GetAzureCredential(sectionName, ...) — returns TokenCredential?; null when no resolver claims the section. Never throws.
IConfiguration.GetAzureClientSettings<T>(sectionName, params CredentialResolver[] resolvers) plus IEnumerable<CredentialResolver> + Action<IConfigurationSection> overloads.
IServiceCollection.AddAzureCredentialResolver() and IHostApplicationBuilder.AddAzureCredentialResolver() — idempotent DI registration.

`ApiKeyCredential` ownership

AzureCredentialResolver does not claim ApiKeyCredential sections. Service-specific Azure clients dispatch on Credential.CredentialSource themselves and read Credential.Key directly. ApiKeyTokenCredential (internal) was deleted.

Azure OpenAI default-scope flip

The default-scope quirk now writes Credential:Scope at the credential-section root (canonical SCM 1.12.0+ location) instead of Credential:AdditionalProperties:Scope. SCM 1.12.0's AuthenticationPolicy.Create reads from both locations (root preferred, AdditionalProperties as fallback) so existing configurations continue to work.

Tests

35 AzureCredentialResolver resolver tests (all token sources, chained, missing sections).
6 Azure OpenAI default-scope tests covering both the resolver-aware path and the legacy path × {OpenAI endpoint writes Scope, non-OpenAI doesn't, pre-set Scope is preserved}.
DI/standalone coverage for GetAzureCredential and GetAzureClientSettings<T>.
Compile-validated doc snippets backing ConfigurationAndDependencyInjection.md and ExperimentalFeatures.md.

Build / test status

All 5 TFMs build clean (net462, net472, netstandard2.0, net8.0, net10.0).
ApiCompat clean.
35/35 CredentialResolvers tests pass on net8.0.
Broader Identity sweep: 4784 passed; the 2 pre-existing BrokerCredentialTests.GetToken_ExceptionType_MatchesExpected failures are unrelated to this PR.

Notes

This is phase 2a of a multi-phase migration. WithAzureCredential and ConfigurableCredential are unchanged in this PR and will be removed in phase 2b.
API surface diff: +14 additive lines, no removals (ApiKeyTokenCredential was internal).

…deletion - Add experimental AzureCredentialResolver (SCME0002) that resolves Azure token credential sections via System.ClientModel.Primitives.CredentialResolver. ApiKeyCredential sections are intentionally not claimed; clients dispatch on Credential.CredentialSource themselves. - Add IConfiguration.GetAzureCredential, IConfiguration.GetAzureClientSettings<T> resolver-aware overloads, and AddAzureCredentialResolver on IServiceCollection and IHostApplicationBuilder. - Flip Azure OpenAI default-scope quirk to write Credential:Scope at the credential section root (canonical SCM 1.12.0+ location). SCM 1.12.0 reads both locations so existing configs continue to work. - Tests: 35 resolver tests + 6 scope-flip tests + DI/standalone coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Phase 2a of the Azure.Core CredentialResolver migration. Introduces a new experimental (SCME0002) Azure.Identity.AzureCredentialResolver plus convenience extensions on IConfiguration, IServiceCollection, and IHostApplicationBuilder for resolving Azure token credentials from configuration. Also flips the Azure OpenAI default-scope quirk to write Credential:Scope at the canonical SCM 1.12.0+ location, and stops claiming ApiKeyCredential sections so consuming clients dispatch on Credential.CredentialSource themselves.

Changes:

New public type AzureCredentialResolver and extension methods GetAzureCredential, resolver-aware GetAzureClientSettings<T>, and AddAzureCredentialResolver on DI/host builders.
Azure OpenAI default-scope is now written at the credential-section root instead of AdditionalProperties:Scope (legacy WithAzureCredential path updated to match).
New tests (resolver behavior, DI idempotency, default-scope quirk on both code paths) and compile-validated doc snippets backing updated ConfigurationAndDependencyInjection.md and ExperimentalFeatures.md.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sdk/core/Azure.Core/src/Identity/AzureCredentialResolver.cs	New resolver with ApiKey opt-out and Chained/single-source dispatch.
sdk/core/Azure.Core/src/Identity/ConfigurationExtensions.cs	New `GetAzureCredential`, resolver-aware `GetAzureClientSettings<T>`, `AddAzureCredentialResolver`; root-scope flip.
sdk/core/Azure.Core/api/Azure.Core.{net462,net472,netstandard2.0,net8.0,net10.0}.cs	Public API baselines updated additively.
sdk/core/Azure.Core/src/docs/ConfigurationAndDependencyInjection.md	Reworked sections + new Custom Credential Resolvers guidance.
sdk/core/Azure.Core/src/docs/ExperimentalFeatures.md	Updated extension list and equivalence snippet.
sdk/core/Azure.Core/CHANGELOG.md	Adds entries describing the new APIs and scope-flip.
sdk/core/Azure.Core/tests/Identity/CredentialResolvers/AzureCredentialResolverTests.cs	Resolver dispatch coverage including ApiKey opt-out and chained path.
sdk/core/Azure.Core/tests/Identity/CredentialResolvers/AzureCredentialResolverDITests.cs	DI registration idempotency.
sdk/core/Azure.Core/tests/Identity/CredentialResolvers/GetAzureCredentialTests.cs	Helper coverage including custom-vs-built-in precedence and overrides.
sdk/core/Azure.Core/tests/Identity/CredentialResolvers/AzureOpenAIDefaultScopeTests.cs	Default-scope quirk on resolver-aware and legacy paths.
sdk/core/Azure.Core/tests/Identity/samples/DocSnippets/*.cs	Compile-validated doc snippet types and snippet methods.

jsquire · 2026-05-14T18:03:49Z

+            params CredentialResolver[] resolvers)
+            where T : ClientSettings, new()
+        {
+            CredentialResolver[] combined = [.. resolvers ?? [], AzureCredentialResolver.Instance];


That's a nifty little splat pattern.

jsquire · 2026-05-14T18:06:34Z

+            using IHost host = builder.Build();
+            CredentialResolver[] resolvers = host.Services.GetServices<CredentialResolver>().ToArray();
+
+            Assert.AreEqual(1, resolvers.Length);


Please move to Assert.That format; it's required by NUnit 4+ and we should try to avoid accumulating more migration debt since we're trying to move the repo.

jsquire · 2026-05-14T18:14:16Z

+        {
+            IConfiguration config = BuildConfig(new Dictionary<string, string>());
+
+            Assert.IsNull(config.GetAzureCredential("Nope"));


…solver-azurecore-phase2

Modern AddAzureClient / AddKeyedAzureClient / GetAzureClientSettings no longer route through WithAzureCredential (which transitively uses ClientSettings.PostConfigure, IClientBuilder.PostConfigure, and the ClientSettings.CredentialProvider shim — all slated for SCM phase 5 removal). They register AzureCredentialResolver.Instance via TryAddEnumerable and apply the Azure OpenAI default-scope quirk by writing the scope directly to the original IConfiguration credential section (when it exists), matching the WithAzureCredential side-effect contract. AddAzureCredentialResolver now registers the static singleton instance instead of activating a new one so DI and standalone paths share the same SCM CredentialCache bucket (cross-path credential instance sharing preserved with the new API surface). Adopt the SCM 1.13.0 surface: rename GetAzureCredential -> GetAzureCredentialSettings (returns CredentialSettings? so ApiKey callers can dispatch on Credential.Key). API baselines regenerated for all 5 TFMs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

jsquire · 2026-05-19T22:14:57Z

-```C# Snippet:Azure_Core_Samples_AzureClient_GetCredential
-TokenCredential credential = configuration.GetAzureCredential("MyClient:Credential");
+```C# Snippet:Azure_Core_Samples_AzureClient_GetCredentialSettings
+CredentialSettings credential = configuration.GetAzureCredentialSettings("MyClient:Credential");


Wasn't there also a case where a true token provider would be returned and you'd have to invoke the factory to create the credential?

jsquire · 2026-05-19T22:21:41Z

+        // the same section. Skips when the configured endpoint is not an
+        // AzureOpenAI endpoint or when the Credential section is absent — we
+        // never materialize a Credential section just to attach a scope.
+        private static void ApplyAzureOpenAIDefaultScopeIfNeeded(IConfiguration configuration, string sectionName)


This is suuuuper specific. What's the story?

Copilot AI review requested due to automatic review settings May 14, 2026 17:38

m-nash requested review from a team, JonathanCrd and christothes as code owners May 14, 2026 17:38

m-nash requested review from KarishmaGhiya, anannya03, maorleger, minhanh-phan and vukelich May 14, 2026 17:38

github-actions Bot added the Azure.Core label May 14, 2026

Copilot AI reviewed May 14, 2026

View reviewed changes

jsquire reviewed May 14, 2026

View reviewed changes

christothes approved these changes May 14, 2026

View reviewed changes

m-nash and others added 2 commits May 19, 2026 13:15

Merge remote-tracking branch 'origin/main' into feature/credential-re…

a1a288a

…solver-azurecore-phase2

jsquire reviewed May 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Azure.Core] Phase 2a: AzureCredentialResolver + scope flip + ApiKey deletion#59256

[Azure.Core] Phase 2a: AzureCredentialResolver + scope flip + ApiKey deletion#59256
m-nash wants to merge 3 commits into
mainfrom
feature/credential-resolver-azurecore-phase2

m-nash commented May 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jsquire May 14, 2026

Uh oh!

jsquire May 14, 2026

Uh oh!

jsquire May 14, 2026

Uh oh!

jsquire May 19, 2026

Uh oh!

jsquire May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

m-nash commented May 14, 2026

Summary

What's changed

New public API (SCME0002)

ApiKeyCredential ownership

Azure OpenAI default-scope flip

Tests

Build / test status

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jsquire May 14, 2026

Choose a reason for hiding this comment

Uh oh!

jsquire May 14, 2026

Choose a reason for hiding this comment

Uh oh!

jsquire May 14, 2026

Choose a reason for hiding this comment

Uh oh!

jsquire May 19, 2026

Choose a reason for hiding this comment

Uh oh!

jsquire May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

New public API (`SCME0002`)

`ApiKeyCredential` ownership