BerriAI/litellm · error · ImportError

azure-identity is required for Azure AD Redis…

Error message

azure-identity is required for Azure AD Redis authentication. Install it with: pip install azure-identity

What it means

When Azure AD auth is enabled for Redis (azure_redis_ad_token / REDIS_AZURE_AD_TOKEN set), litellm builds an Entra ID credential via azure.identity. If that package is not installed, the import fails and litellm re-raises ImportError telling you to pip install azure-identity. It is a missing optional dependency for the Azure Redis auth path.

Solutions

pip install azure-identity (match your azure SDK stack, e.g. azure-identity>=1.12)
Or install the broader extra: pip install 'litellm[proxy]'
Rebuild your docker image / refresh requirements and redeploy
If you did not intend Azure AD auth, unset REDIS_AZURE_AD_TOKEN and remove azure_redis_ad_token from cache config

Example fix

# before
export REDIS_AZURE_AD_TOKEN=true
litellm --config config.yaml  # ImportError: azure-identity is required ...

# after
pip install azure-identity
export REDIS_AZURE_AD_TOKEN=true
litellm --config config.yaml

Defensive patterns

Strategy: validation

Validate before calling

import importlib.util

if importlib.util.find_spec("azure.identity") is None:
    raise SystemExit(
        "azure-identity is required for Azure AD Redis auth: pip install azure-identity"
    )

Prevention

Add azure-identity to your requirements whenever REDIS_AZURE_AD_TOKEN can be enabled
Bake the dependency into the docker image rather than relying on litellm's optional extras
Add a dependency smoke test (import azure.identity) to CI for images that use Azure Redis

When it happens

Trigger: Enabling Azure AD Redis auth (azure_redis_ad_token=true or env REDIS_AZURE_AD_TOKEN=true) in an environment where azure-identity is not installed — slim docker images, minimal pip installs of litellm without the proxy/extra deps.

Common situations: Self-built minimal containers that pip install litellm only; CI environments caching a partial dependency set; enabling AAD auth on an existing deployment without adding the new dependency.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/e691e628dbac0290. Report an issue: GitHub.

Appendix: source

Thrown at litellm/_redis.py:232

def _build_azure_credential(
    azure_client_id: str | None = None,
    azure_tenant_id: str | None = None,
    azure_client_secret: str | None = None,
):
    """
    Build a long-lived Azure credential object.

    Azure SDK credentials cache tokens internally and handle expiry/refresh
    transparently, so this should be called once and the result reused.
    """
    try:
        from azure.identity import (
            ClientSecretCredential,
            DefaultAzureCredential,
            ManagedIdentityCredential,
        )
    except ImportError:
        raise ImportError(
            "azure-identity is required for Azure AD Redis authentication. Install it with: pip install azure-identity"
        )

    _client_id: Final = azure_client_id or os.environ.get("AZURE_CLIENT_ID")
    _tenant_id: Final = azure_tenant_id or os.environ.get("AZURE_TENANT_ID")
    _client_secret: Final = azure_client_secret or os.environ.get("AZURE_CLIENT_SECRET")

    if _client_id and _tenant_id and _client_secret:
        return ClientSecretCredential(
            client_id=_client_id,
            tenant_id=_tenant_id,
            client_secret=_client_secret,
        )
    elif _client_id:
        return ManagedIdentityCredential(client_id=_client_id)
    else:
        return DefaultAzureCredential()

View on GitHub (pinned to 77b7c6c40c)