[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6G91TEEXBNPFT9B8DTA3ZXB":3,"skill-same:01M6G91TEEXBNPFT9B8DTA3ZXB":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":13,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M6G91TEEXBNPFT9B8DTA3ZXB","azure-identity-java",null,"Azure Identity Java SDK for authentication with Azure services. Use when implementing DefaultAzureCredential, managed identity, service principal, or any Azure authentication pattern in Java applications.","ricardoaevt\u002Fnexus-roms","ricardoaevt","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F164531880?v=4","01M6DGFGSV6CF9AKPHABBREC79","01M6DGFGYNNPJVDFQA05TDPSBN",0,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fmicrosoft_skills\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-identity-java\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29],"identity","azure","azure identity java","java","sdk","authentication","services","applications","use","pattern","service","with","2026-11-10 10:12:30",false,"---\nname: azure-identity-java\ndescription: Azure Identity Java SDK for authentication with Azure services. Use when implementing DefaultAzureCredential, managed identity, service principal, or any Azure authentication pattern in Java applications.\npackage: com.azure:azure-identity\n---\n\n# Azure Identity (Java)\n\nAuthenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-identity\u003C\u002FartifactId>\n    \u003Cversion>1.15.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Key Concepts\n\n| Credential | Use Case |\n|------------|----------|\n| `DefaultAzureCredential` | **Recommended** - Works in dev and production |\n| `ManagedIdentityCredential` | Azure-hosted apps (App Service, Functions, VMs) |\n| `EnvironmentCredential` | CI\u002FCD pipelines with env vars |\n| `ClientSecretCredential` | Service principals with secret |\n| `ClientCertificateCredential` | Service principals with certificate |\n| `AzureCliCredential` | Local dev using `az login` |\n| `InteractiveBrowserCredential` | Interactive login flow |\n| `DeviceCodeCredential` | Headless device authentication |\n\n## DefaultAzureCredential (Recommended)\n\nThe `DefaultAzureCredential` tries multiple authentication methods in order:\n\n1. Environment variables\n2. Workload Identity\n3. Managed Identity\n4. Azure CLI\n5. Azure PowerShell\n6. Azure Developer CLI\n\n```java\nimport com.azure.identity.DefaultAzureCredential;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Simple usage\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();\n\n\u002F\u002F Use with any Azure client\nBlobServiceClient blobClient = new BlobServiceClientBuilder()\n    .endpoint(\"https:\u002F\u002F\u003Cstorage-account>.blob.core.windows.net\")\n    .credential(credential)\n    .buildClient();\n\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(credential)\n    .buildClient();\n```\n\n### Configure DefaultAzureCredential\n\n```java\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder()\n    .managedIdentityClientId(\"\u003Cuser-assigned-identity-client-id>\")  \u002F\u002F For user-assigned MI\n    .tenantId(\"\u003Ctenant-id>\")                                        \u002F\u002F Limit to specific tenant\n    .excludeEnvironmentCredential()                                 \u002F\u002F Skip env vars\n    .excludeAzureCliCredential()                                    \u002F\u002F Skip Azure CLI\n    .build();\n```\n\n## Managed Identity\n\nFor Azure-hosted applications (App Service, Functions, AKS, VMs).\n\n```java\nimport com.azure.identity.ManagedIdentityCredential;\nimport com.azure.identity.ManagedIdentityCredentialBuilder;\n\n\u002F\u002F System-assigned managed identity\nManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()\n    .build();\n\n\u002F\u002F User-assigned managed identity (by client ID)\nManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()\n    .clientId(\"\u003Cuser-assigned-client-id>\")\n    .build();\n\n\u002F\u002F User-assigned managed identity (by resource ID)\nManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()\n    .resourceId(\"\u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F\u003Crg>\u002Fproviders\u002FMicrosoft.ManagedIdentity\u002FuserAssignedIdentities\u002F\u003Cname>\")\n    .build();\n```\n\n## Service Principal with Secret\n\n```java\nimport com.azure.identity.ClientSecretCredential;\nimport com.azure.identity.ClientSecretCredentialBuilder;\n\nClientSecretCredential credential = new ClientSecretCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .clientSecret(\"\u003Cclient-secret>\")\n    .build();\n```\n\n## Service Principal with Certificate\n\n```java\nimport com.azure.identity.ClientCertificateCredential;\nimport com.azure.identity.ClientCertificateCredentialBuilder;\n\n\u002F\u002F From PEM file\nClientCertificateCredential credential = new ClientCertificateCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .pemCertificate(\"\u003Cpath-to-cert.pem>\")\n    .build();\n\n\u002F\u002F From PFX file with password\nClientCertificateCredential credential = new ClientCertificateCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .pfxCertificate(\"\u003Cpath-to-cert.pfx>\", \"\u003Cpfx-password>\")\n    .build();\n\n\u002F\u002F Send certificate chain for SNI\nClientCertificateCredential credential = new ClientCertificateCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .pemCertificate(\"\u003Cpath-to-cert.pem>\")\n    .sendCertificateChain(true)\n    .build();\n```\n\n## Environment Credential\n\nReads credentials from environment variables.\n\n```java\nimport com.azure.identity.EnvironmentCredential;\nimport com.azure.identity.EnvironmentCredentialBuilder;\n\nEnvironmentCredential credential = new EnvironmentCredentialBuilder().build();\n```\n\n### Required Environment Variables\n\n**For service principal with secret:**\n```bash\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_CLIENT_SECRET=\u003Cclient-secret>\n```\n\n**For service principal with certificate:**\n```bash\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_CLIENT_CERTIFICATE_PATH=\u002Fpath\u002Fto\u002Fcert.pem\nAZURE_CLIENT_CERTIFICATE_PASSWORD=\u003Coptional-password>\n```\n\n**For username\u002Fpassword:**\n```bash\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_USERNAME=\u003Cusername>\nAZURE_PASSWORD=\u003Cpassword>\n```\n\n## Azure CLI Credential\n\nFor local development using `az login`.\n\n```java\nimport com.azure.identity.AzureCliCredential;\nimport com.azure.identity.AzureCliCredentialBuilder;\n\nAzureCliCredential credential = new AzureCliCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")  \u002F\u002F Optional: specific tenant\n    .build();\n```\n\n## Interactive Browser\n\nFor desktop applications requiring user login.\n\n```java\nimport com.azure.identity.InteractiveBrowserCredential;\nimport com.azure.identity.InteractiveBrowserCredentialBuilder;\n\nInteractiveBrowserCredential credential = new InteractiveBrowserCredentialBuilder()\n    .clientId(\"\u003Cclient-id>\")\n    .redirectUrl(\"http:\u002F\u002Flocalhost:8080\")  \u002F\u002F Must match app registration\n    .build();\n```\n\n## Device Code\n\nFor headless devices (IoT, CLI tools).\n\n```java\nimport com.azure.identity.DeviceCodeCredential;\nimport com.azure.identity.DeviceCodeCredentialBuilder;\n\nDeviceCodeCredential credential = new DeviceCodeCredentialBuilder()\n    .clientId(\"\u003Cclient-id>\")\n    .challengeConsumer(challenge -> {\n        \u002F\u002F Display to user\n        System.out.println(challenge.getMessage());\n    })\n    .build();\n```\n\n## Chained Credential\n\nCreate custom authentication chains.\n\n```java\nimport com.azure.identity.ChainedTokenCredential;\nimport com.azure.identity.ChainedTokenCredentialBuilder;\n\nChainedTokenCredential credential = new ChainedTokenCredentialBuilder()\n    .addFirst(new ManagedIdentityCredentialBuilder().build())\n    .addLast(new AzureCliCredentialBuilder().build())\n    .build();\n```\n\n## Workload Identity (AKS)\n\nFor Azure Kubernetes Service with workload identity.\n\n```java\nimport com.azure.identity.WorkloadIdentityCredential;\nimport com.azure.identity.WorkloadIdentityCredentialBuilder;\n\n\u002F\u002F Reads from AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE\nWorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder().build();\n\n\u002F\u002F Or explicit configuration\nWorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .tokenFilePath(\"\u002Fvar\u002Frun\u002Fsecrets\u002Fazure\u002Ftokens\u002Fazure-identity-token\")\n    .build();\n```\n\n## Token Caching\n\nEnable persistent token caching for better performance.\n\n```java\n\u002F\u002F Enable token caching (in-memory by default)\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder()\n    .enableAccountIdentifierLogging()\n    .build();\n\n\u002F\u002F With shared token cache (for multi-credential scenarios)\nSharedTokenCacheCredential credential = new SharedTokenCacheCredentialBuilder()\n    .clientId(\"\u003Cclient-id>\")\n    .build();\n```\n\n## Sovereign Clouds\n\n```java\nimport com.azure.identity.AzureAuthorityHosts;\n\n\u002F\u002F Azure Government\nDefaultAzureCredential govCredential = new DefaultAzureCredentialBuilder()\n    .authorityHost(AzureAuthorityHosts.AZURE_GOVERNMENT)\n    .build();\n\n\u002F\u002F Azure China\nDefaultAzureCredential chinaCredential = new DefaultAzureCredentialBuilder()\n    .authorityHost(AzureAuthorityHosts.AZURE_CHINA)\n    .build();\n```\n\n## Error Handling\n\n```java\nimport com.azure.identity.CredentialUnavailableException;\nimport com.azure.core.exception.ClientAuthenticationException;\n\ntry {\n    DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();\n    AccessToken token = credential.getToken(new TokenRequestContext()\n        .addScopes(\"https:\u002F\u002Fmanagement.azure.com\u002F.default\"));\n} catch (CredentialUnavailableException e) {\n    \u002F\u002F No credential could authenticate\n    System.out.println(\"Authentication failed: \" + e.getMessage());\n} catch (ClientAuthenticationException e) {\n    \u002F\u002F Authentication error (wrong credentials, expired, etc.)\n    System.out.println(\"Auth error: \" + e.getMessage());\n}\n```\n\n## Logging\n\nEnable authentication logging for debugging.\n\n```java\n\u002F\u002F Via environment variable\n\u002F\u002F AZURE_LOG_LEVEL=verbose\n\n\u002F\u002F Or programmatically\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder()\n    .enableAccountIdentifierLogging()  \u002F\u002F Log account info\n    .build();\n```\n\n## Environment Variables\n\n```bash\n# DefaultAzureCredential configuration\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_CLIENT_SECRET=\u003Cclient-secret>\n\n# Managed Identity\nAZURE_CLIENT_ID=\u003Cuser-assigned-mi-client-id>\n\n# Workload Identity (AKS)\nAZURE_FEDERATED_TOKEN_FILE=\u002Fvar\u002Frun\u002Fsecrets\u002Fazure\u002Ftokens\u002Fazure-identity-token\n\n# Logging\nAZURE_LOG_LEVEL=verbose\n\n# Authority host\nAZURE_AUTHORITY_HOST=https:\u002F\u002Flogin.microsoftonline.com\u002F\n```\n\n## Best Practices\n\n1. **Use DefaultAzureCredential** - Works seamlessly from dev to production\n2. **Managed Identity in Production** - No secrets to manage, automatic rotation\n3. **Azure CLI for Local Dev** - Run `az login` before running your app\n4. **Least Privilege** - Grant only required permissions to service principals\n5. **Token Caching** - Enabled by default, reduces auth round-trips\n6. **Environment Variables** - Use for CI\u002FCD, not hardcoded secrets\n\n## Credential Selection Matrix\n\n| Environment | Recommended Credential |\n|-------------|----------------------|\n| Local Development | `DefaultAzureCredential` (uses Azure CLI) |\n| Azure App Service | `DefaultAzureCredential` (uses Managed Identity) |\n| Azure Functions | `DefaultAzureCredential` (uses Managed Identity) |\n| Azure Kubernetes Service | `WorkloadIdentityCredential` |\n| Azure VMs | `DefaultAzureCredential` (uses Managed Identity) |\n| CI\u002FCD Pipeline | `EnvironmentCredential` |\n| Desktop App | `InteractiveBrowserCredential` |\n| CLI Tool | `DeviceCodeCredential` |\n\n## Trigger Phrases\n\n- \"Azure authentication Java\", \"DefaultAzureCredential Java\"\n- \"managed identity Java\", \"service principal Java\"\n- \"Azure login Java\", \"Azure credentials Java\"\n- \"AZURE_CLIENT_ID\", \"AZURE_TENANT_ID\"\n","# Azure Identity (Java)\n\nAuthenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).\n\n## Installation\n\n```xml\n\u003Cdependency>\n    \u003CgroupId>com.azure\u003C\u002FgroupId>\n    \u003CartifactId>azure-identity\u003C\u002FartifactId>\n    \u003Cversion>1.15.0\u003C\u002Fversion>\n\u003C\u002Fdependency>\n```\n\n## Key Concepts\n\n| Credential | Use Case |\n|------------|----------|\n| `DefaultAzureCredential` | **Recommended** - Works in dev and production |\n| `ManagedIdentityCredential` | Azure-hosted apps (App Service, Functions, VMs) |\n| `EnvironmentCredential` | CI\u002FCD pipelines with env vars |\n| `ClientSecretCredential` | Service principals with secret |\n| `ClientCertificateCredential` | Service principals with certificate |\n| `AzureCliCredential` | Local dev using `az login` |\n| `InteractiveBrowserCredential` | Interactive login flow |\n| `DeviceCodeCredential` | Headless device authentication |\n\n## DefaultAzureCredential (Recommended)\n\nThe `DefaultAzureCredential` tries multiple authentication methods in order:\n\n1. Environment variables\n2. Workload Identity\n3. Managed Identity\n4. Azure CLI\n5. Azure PowerShell\n6. Azure Developer CLI\n\n```java\nimport com.azure.identity.DefaultAzureCredential;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\n\n\u002F\u002F Simple usage\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();\n\n\u002F\u002F Use with any Azure client\nBlobServiceClient blobClient = new BlobServiceClientBuilder()\n    .endpoint(\"https:\u002F\u002F\u003Cstorage-account>.blob.core.windows.net\")\n    .credential(credential)\n    .buildClient();\n\nKeyClient keyClient = new KeyClientBuilder()\n    .vaultUrl(\"https:\u002F\u002F\u003Cvault-name>.vault.azure.net\")\n    .credential(credential)\n    .buildClient();\n```\n\n### Configure DefaultAzureCredential\n\n```java\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder()\n    .managedIdentityClientId(\"\u003Cuser-assigned-identity-client-id>\")  \u002F\u002F For user-assigned MI\n    .tenantId(\"\u003Ctenant-id>\")                                        \u002F\u002F Limit to specific tenant\n    .excludeEnvironmentCredential()                                 \u002F\u002F Skip env vars\n    .excludeAzureCliCredential()                                    \u002F\u002F Skip Azure CLI\n    .build();\n```\n\n## Managed Identity\n\nFor Azure-hosted applications (App Service, Functions, AKS, VMs).\n\n```java\nimport com.azure.identity.ManagedIdentityCredential;\nimport com.azure.identity.ManagedIdentityCredentialBuilder;\n\n\u002F\u002F System-assigned managed identity\nManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()\n    .build();\n\n\u002F\u002F User-assigned managed identity (by client ID)\nManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()\n    .clientId(\"\u003Cuser-assigned-client-id>\")\n    .build();\n\n\u002F\u002F User-assigned managed identity (by resource ID)\nManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()\n    .resourceId(\"\u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F\u003Crg>\u002Fproviders\u002FMicrosoft.ManagedIdentity\u002FuserAssignedIdentities\u002F\u003Cname>\")\n    .build();\n```\n\n## Service Principal with Secret\n\n```java\nimport com.azure.identity.ClientSecretCredential;\nimport com.azure.identity.ClientSecretCredentialBuilder;\n\nClientSecretCredential credential = new ClientSecretCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .clientSecret(\"\u003Cclient-secret>\")\n    .build();\n```\n\n## Service Principal with Certificate\n\n```java\nimport com.azure.identity.ClientCertificateCredential;\nimport com.azure.identity.ClientCertificateCredentialBuilder;\n\n\u002F\u002F From PEM file\nClientCertificateCredential credential = new ClientCertificateCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .pemCertificate(\"\u003Cpath-to-cert.pem>\")\n    .build();\n\n\u002F\u002F From PFX file with password\nClientCertificateCredential credential = new ClientCertificateCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .pfxCertificate(\"\u003Cpath-to-cert.pfx>\", \"\u003Cpfx-password>\")\n    .build();\n\n\u002F\u002F Send certificate chain for SNI\nClientCertificateCredential credential = new ClientCertificateCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .pemCertificate(\"\u003Cpath-to-cert.pem>\")\n    .sendCertificateChain(true)\n    .build();\n```\n\n## Environment Credential\n\nReads credentials from environment variables.\n\n```java\nimport com.azure.identity.EnvironmentCredential;\nimport com.azure.identity.EnvironmentCredentialBuilder;\n\nEnvironmentCredential credential = new EnvironmentCredentialBuilder().build();\n```\n\n### Required Environment Variables\n\n**For service principal with secret:**\n```bash\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_CLIENT_SECRET=\u003Cclient-secret>\n```\n\n**For service principal with certificate:**\n```bash\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_CLIENT_CERTIFICATE_PATH=\u002Fpath\u002Fto\u002Fcert.pem\nAZURE_CLIENT_CERTIFICATE_PASSWORD=\u003Coptional-password>\n```\n\n**For username\u002Fpassword:**\n```bash\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_USERNAME=\u003Cusername>\nAZURE_PASSWORD=\u003Cpassword>\n```\n\n## Azure CLI Credential\n\nFor local development using `az login`.\n\n```java\nimport com.azure.identity.AzureCliCredential;\nimport com.azure.identity.AzureCliCredentialBuilder;\n\nAzureCliCredential credential = new AzureCliCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")  \u002F\u002F Optional: specific tenant\n    .build();\n```\n\n## Interactive Browser\n\nFor desktop applications requiring user login.\n\n```java\nimport com.azure.identity.InteractiveBrowserCredential;\nimport com.azure.identity.InteractiveBrowserCredentialBuilder;\n\nInteractiveBrowserCredential credential = new InteractiveBrowserCredentialBuilder()\n    .clientId(\"\u003Cclient-id>\")\n    .redirectUrl(\"http:\u002F\u002Flocalhost:8080\")  \u002F\u002F Must match app registration\n    .build();\n```\n\n## Device Code\n\nFor headless devices (IoT, CLI tools).\n\n```java\nimport com.azure.identity.DeviceCodeCredential;\nimport com.azure.identity.DeviceCodeCredentialBuilder;\n\nDeviceCodeCredential credential = new DeviceCodeCredentialBuilder()\n    .clientId(\"\u003Cclient-id>\")\n    .challengeConsumer(challenge -> {\n        \u002F\u002F Display to user\n        System.out.println(challenge.getMessage());\n    })\n    .build();\n```\n\n## Chained Credential\n\nCreate custom authentication chains.\n\n```java\nimport com.azure.identity.ChainedTokenCredential;\nimport com.azure.identity.ChainedTokenCredentialBuilder;\n\nChainedTokenCredential credential = new ChainedTokenCredentialBuilder()\n    .addFirst(new ManagedIdentityCredentialBuilder().build())\n    .addLast(new AzureCliCredentialBuilder().build())\n    .build();\n```\n\n## Workload Identity (AKS)\n\nFor Azure Kubernetes Service with workload identity.\n\n```java\nimport com.azure.identity.WorkloadIdentityCredential;\nimport com.azure.identity.WorkloadIdentityCredentialBuilder;\n\n\u002F\u002F Reads from AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE\nWorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder().build();\n\n\u002F\u002F Or explicit configuration\nWorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()\n    .tenantId(\"\u003Ctenant-id>\")\n    .clientId(\"\u003Cclient-id>\")\n    .tokenFilePath(\"\u002Fvar\u002Frun\u002Fsecrets\u002Fazure\u002Ftokens\u002Fazure-identity-token\")\n    .build();\n```\n\n## Token Caching\n\nEnable persistent token caching for better performance.\n\n```java\n\u002F\u002F Enable token caching (in-memory by default)\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder()\n    .enableAccountIdentifierLogging()\n    .build();\n\n\u002F\u002F With shared token cache (for multi-credential scenarios)\nSharedTokenCacheCredential credential = new SharedTokenCacheCredentialBuilder()\n    .clientId(\"\u003Cclient-id>\")\n    .build();\n```\n\n## Sovereign Clouds\n\n```java\nimport com.azure.identity.AzureAuthorityHosts;\n\n\u002F\u002F Azure Government\nDefaultAzureCredential govCredential = new DefaultAzureCredentialBuilder()\n    .authorityHost(AzureAuthorityHosts.AZURE_GOVERNMENT)\n    .build();\n\n\u002F\u002F Azure China\nDefaultAzureCredential chinaCredential = new DefaultAzureCredentialBuilder()\n    .authorityHost(AzureAuthorityHosts.AZURE_CHINA)\n    .build();\n```\n\n## Error Handling\n\n```java\nimport com.azure.identity.CredentialUnavailableException;\nimport com.azure.core.exception.ClientAuthenticationException;\n\ntry {\n    DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();\n    AccessToken token = credential.getToken(new TokenRequestContext()\n        .addScopes(\"https:\u002F\u002Fmanagement.azure.com\u002F.default\"));\n} catch (CredentialUnavailableException e) {\n    \u002F\u002F No credential could authenticate\n    System.out.println(\"Authentication failed: \" + e.getMessage());\n} catch (ClientAuthenticationException e) {\n    \u002F\u002F Authentication error (wrong credentials, expired, etc.)\n    System.out.println(\"Auth error: \" + e.getMessage());\n}\n```\n\n## Logging\n\nEnable authentication logging for debugging.\n\n```java\n\u002F\u002F Via environment variable\n\u002F\u002F AZURE_LOG_LEVEL=verbose\n\n\u002F\u002F Or programmatically\nDefaultAzureCredential credential = new DefaultAzureCredentialBuilder()\n    .enableAccountIdentifierLogging()  \u002F\u002F Log account info\n    .build();\n```\n\n## Environment Variables\n\n```bash\n# DefaultAzureCredential configuration\nAZURE_TENANT_ID=\u003Ctenant-id>\nAZURE_CLIENT_ID=\u003Cclient-id>\nAZURE_CLIENT_SECRET=\u003Cclient-secret>\n\n# Managed Identity\nAZURE_CLIENT_ID=\u003Cuser-assigned-mi-client-id>\n\n# Workload Identity (AKS)\nAZURE_FEDERATED_TOKEN_FILE=\u002Fvar\u002Frun\u002Fsecrets\u002Fazure\u002Ftokens\u002Fazure-identity-token\n\n# Logging\nAZURE_LOG_LEVEL=verbose\n\n# Authority host\nAZURE_AUTHORITY_HOST=https:\u002F\u002Flogin.microsoftonline.com\u002F\n```\n\n## Best Practices\n\n1. **Use DefaultAzureCredential** - Works seamlessly from dev to production\n2. **Managed Identity in Production** - No secrets to manage, automatic rotation\n3. **Azure CLI for Local Dev** - Run `az login` before running your app\n4. **Least Privilege** - Grant only required permissions to service principals\n5. **Token Caching** - Enabled by default, reduces auth round-trips\n6. **Environment Variables** - Use for CI\u002FCD, not hardcoded secrets\n\n## Credential Selection Matrix\n\n| Environment | Recommended Credential |\n|-------------|----------------------|\n| Local Development | `DefaultAzureCredential` (uses Azure CLI) |\n| Azure App Service | `DefaultAzureCredential` (uses Managed Identity) |\n| Azure Functions | `DefaultAzureCredential` (uses Managed Identity) |\n| Azure Kubernetes Service | `WorkloadIdentityCredential` |\n| Azure VMs | `DefaultAzureCredential` (uses Managed Identity) |\n| CI\u002FCD Pipeline | `EnvironmentCredential` |\n| Desktop App | `InteractiveBrowserCredential` |\n| CLI Tool | `DeviceCodeCredential` |\n\n## Trigger Phrases\n\n- \"Azure authentication Java\", \"DefaultAzureCredential Java\"\n- \"managed identity Java\", \"service principal Java\"\n- \"Azure login Java\", \"Azure credentials Java\"\n- \"AZURE_CLIENT_ID\", \"AZURE_TENANT_ID\"\n",{"name":5,"package":35,"description":7},"com.azure:azure-identity","main","d41309588593cee5c2fb44062474efc3a99fbcb6",".agent\u002Fskills\u002Fmicrosoft_skills\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-identity-java","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms","https:\u002F\u002Fgithub.com\u002Fricardoaevt","2026-03-23 00:05:03",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add ricardoaevt\u002Fnexus-roms --skill azure-identity-java",{"tool":48,"command":49},"bunx","bunx skills add ricardoaevt\u002Fnexus-roms --skill azure-identity-java",{"tool":51,"command":52},"pnpm","pnpm dlx skills add ricardoaevt\u002Fnexus-roms --skill azure-identity-java","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fmicrosoft_skills\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-identity-java\u002FSKILL.md",true,[56,62],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"references\u002Facceptance-criteria.md","REFERENCE","参考文档",11090,"https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fmicrosoft_skills\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-identity-java\u002Freferences\u002Facceptance-criteria.md",{"path":63,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":64,"sourceHtmlUrl":65},"references\u002Fexamples.md",14588,"https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fmicrosoft_skills\u002F.github\u002Fplugins\u002Fazure-sdk-java\u002Fskills\u002Fazure-identity-java\u002Freferences\u002Fexamples.md",[67,90,106,121,132,141],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":71,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":30},"01M6G9HYKQRK6HBKVTZM3258M3","openspec-propose","Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.","MIT","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fopenspec-propose\u002FSKILL.md",[],[75,76,77,78,29,79,80,81,82,83,84,26,85,86,87,88,89],"openspec propose","openspec","cli","generated","proposal","complete","get","build","implementation","ready","user","artifacts","tasks","change","design",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":71,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":30},"01M6G9HV9V20WFCHYVSDNQMJVK","openspec-new-change","Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fopenspec-new-change\u002FSKILL.md",[],[76,97,88,98,77,99,100,101,26,85,102,103,104,105,29],"openspec new change","new feature","structured","artifact","workflow","create","start","fix","feature",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":71,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":30},"01M6G9HRF6R89QZXGSFC9DRQW3","openspec-explore","Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fopenspec-explore\u002FSKILL.md",[],[113,114,76,26,115,77,88,85,116,117,118,119,120],"openspec explore","explore","partner","think","thinking partner","thinking","ideas","requirements",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":71,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":30},"01M6G9HP3APFCXZG7XRWBMM524","openspec-continue-change","Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fopenspec-continue-change\u002FSKILL.md",[],[76,128,129,88,101,77,102,85,26,130,100,131],"continue","openspec continue change","next","progress",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":71,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":30},"01M6G9HKT3WMSDBSKA7YM4MSSQ","openspec-archive-change","Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fopenspec-archive-change\u002FSKILL.md",[],[139,76,140,88,77,101,85,26,83,80],"openspec archive change","archive",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":71,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":30},"01M6G9HHEG0RJK4E0YTVZZ6A8T","openspec-apply-change","Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.","https:\u002F\u002Fgithub.com\u002Fricardoaevt\u002Fnexus-roms\u002Fblob\u002Fmain\u002F.agent\u002Fskills\u002Fopenspec-apply-change\u002FSKILL.md",[],[76,88,148,149,87,103,128,150,85,26,83,77],"openspec apply change","implement","work"]