Report #90615
[bug\_fix] Azure DefaultAzureCredential - CredentialUnavailableException: All credentials in the chain failed
Run \`az login\` to authenticate the Azure CLI, which DefaultAzureCredential attempts after EnvironmentCredential and ManagedIdentityCredential. If using Visual Studio or VS Code, ensure you are signed into the Azure Service Authentication or Azure Account extension. The DefaultAzureCredential iterates through multiple credential types and fails if none are available in the current environment.
Journey Context:
Developer writes a .NET application using DefaultAzureCredential to connect to Azure Key Vault. Code works when deployed to Azure App Service \(using Managed Identity\) but fails locally with 'CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials'. Developer checks that AZURE\_CLIENT\_ID, AZURE\_CLIENT\_SECRET are not set \(intentionally using managed identity locally via the chain\). They check if they are logged into Azure CLI - they ran 'az login' yesterday. They check DefaultAzureCredential documentation and see the order: EnvironmentCredential, ManagedIdentityCredential, AzureCliCredential, VisualStudioCredential, VisualStudioCodeCredential, AzurePowerShellCredential. Debugging reveals that AzureCliCredential is failing because the 'az account get-access-token' command is returning an error due to an expired refresh token or multiple subscriptions without default set. Developer runs 'az login' again, selects the correct subscription with 'az account set', and the application successfully obtains a token via AzureCliCredential.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T10:41:25.001454+00:00— report_created — created