BerriAI/litellm · error · AzureOpenAIError

AZURE_CLIENT_ID and AZURE_TENANT_ID must be set

Error message

AZURE_CLIENT_ID and AZURE_TENANT_ID must be set

What it means

LiteLLM's Azure AD (OIDC/managed-identity) token flow requires a client ID and tenant ID to build the OAuth 2.0 client-credentials request against Azure's authority host. The code first checks the explicit azure_client_id/azure_tenant_id arguments, then falls back to the AZURE_CLIENT_ID and AZURE_TENANT_ID environment variables. If both lookups fail for either value, it raises AzureOpenAIError 422 because the token request cannot be constructed.

Source

Thrown at litellm/llms/azure/common_utils.py:195

    """
    Get Azure AD token from OIDC token

    Args:
        azure_ad_token: str
        azure_client_id: Optional[str]
        azure_tenant_id: Optional[str]
        scope: str

    Returns:
        `azure_ad_token_access_token` - str
    """
    if scope is None:
        scope = "https://cognitiveservices.azure.com/.default"
    azure_authority_host: Final = os.getenv("AZURE_AUTHORITY_HOST", "https://login.microsoftonline.com")
    azure_client_id = azure_client_id or os.getenv("AZURE_CLIENT_ID")
    azure_tenant_id = azure_tenant_id or os.getenv("AZURE_TENANT_ID")
    if azure_client_id is None or azure_tenant_id is None:
        raise AzureOpenAIError(
            status_code=422,
            message="AZURE_CLIENT_ID and AZURE_TENANT_ID must be set",
        )

    oidc_token: Final = get_secret_str(azure_ad_token)

    if oidc_token is None:
        raise AzureOpenAIError(
            status_code=401,
            message="OIDC token could not be retrieved from secret manager.",
        )

    azure_ad_token_cache_key: Final = json.dumps(
        {
            "azure_client_id": azure_client_id,
            "azure_tenant_id": azure_tenant_id,
            "azure_authority_host": azure_authority_host,
            "oidc_token": oidc_token,

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Set both env vars: export AZURE_CLIENT_ID=<app/client id> and export AZURE_TENANT_ID=<tenant id> (or add them to your .env / container env).
2. Or pass the IDs explicitly where LiteLLM accepts azure AD config (e.g. litellm.modify_params or the proxy model config) instead of relying on env vars.
3. Verify with: python -c "import os; print(os.getenv('AZURE_CLIENT_ID'), os.getenv('AZURE_TENANT_ID'))" before starting the proxy/SDK call.
4. If you did not intend OIDC auth, remove the azure_ad_token input so LiteLLM uses api_key auth instead.

Example fix

# before
os.environ["AZURE_CLIENT_ID"] = ""  # empty string is falsy -> still errors
resp = litellm.completion(model="azure/<dep>", messages=[...], azure_ad_token=oidc)

# after
os.environ["AZURE_CLIENT_ID"] = "11111111-1111-1111-1111-111111111111"
os.environ["AZURE_TENANT_ID"] = "22222222-2222-2222-2222-222222222222"
resp = litellm.completion(model="azure/<dep>", messages=[...], azure_ad_token=oidc)

import os

def validate_azure_oidc_config() -> None:
    missing = [v for v in ("AZURE_CLIENT_ID", "AZURE_TENANT_ID") if not os.getenv(v)]
    if missing:
        raise ConfigError(f"Missing required env vars: {missing}")

try:
    resp = litellm.completion(model="azure/dep", messages=msgs, azure_ad_token=oidc)
except AzureOpenAIError as e:
    if e.status_code == 422 and "AZURE_CLIENT_ID" in str(e):
        raise ConfigError("Azure OIDC env vars not set") from e
    raise

When it happens

Trigger: Calling an Azure deployment with azure_ad_token (an OIDC token, e.g. from a cloud workload identity) but without passing azure_client_id/azure_tenant_id and without AZURE_CLIENT_ID and/or AZURE_TENANT_ID set in the environment. The path is hit whenever get_azure_ad_token_from_oidc runs and either env var (and argument) is absent.

Common situations: Using Azure AD token auth on Azure Kubernetes Service / GitHub Actions OIDC without exporting the workload identity env vars; rotating secrets and dropping AZURE_TENANT_ID from the deployment manifest; running the proxy in a new container image that does not carry the env vars; typos like AZURE_CLIENTID.

Related errors

• AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an en
• AZURE_SENTINEL_ENDPOINT is required. Set it as an environmen
• AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set
• AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set
• AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is requi

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/393ea53c7b339d46. Report an issue: GitHub.