BerriAI/litellm · error · ValueError

AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set

Error message

AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.

What it means

The Azure Sentinel logger authenticates with a service principal, so it needs the app registration's client (application) ID. It resolves client_id from the parameter, AZURE_SENTINEL_CLIENT_ID, or generic AZURE_CLIENT_ID, and raises ValueError when none is set. Without it no OAuth token can be acquired for ingestion.

Source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:117

            or os.getenv("AZURE_SENTINEL_AUTHORITY_HOST")
            or os.getenv("AZURE_AUTHORITY_HOST")
            or DEFAULT_AZURE_AUTHORITY_HOST
        )

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name
        self.endpoint = resolved_endpoint
        self.tenant_id = resolved_tenant_id
        self.client_id = resolved_client_id
        self.client_secret = resolved_client_secret

        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01
        self.api_endpoint = self._build_api_endpoint(
            endpoint=resolved_endpoint,

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Create/reuse an app registration and copy its Application (client) ID, then export AZURE_SENTINEL_CLIENT_ID (or AZURE_CLIENT_ID)
2. Or pass client_id=... to the constructor
3. Grant the service principal access: DCR + Log Analytics workspace permissions (e.g. Monitoring Metrics Publisher on the DCR)
4. Verify the value is the client ID GUID, not the object ID or secret

Example fix

# before
AzureSentinelLogger(dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t, client_secret=s)  # no client id

# after
AzureSentinelLogger(
    dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t,
    client_id="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    client_secret=s,
)

import os

client_id = os.getenv("AZURE_SENTINEL_CLIENT_ID") or os.getenv("AZURE_CLIENT_ID")
if not client_id:
    raise RuntimeError("Set AZURE_SENTINEL_CLIENT_ID (or AZURE_CLIENT_ID) to the app registration's client ID")

import re
GUID_RE = re.compile(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")

def is_client_id(v: str | None) -> bool:
    return isinstance(v, str) and bool(GUID_RE.match(v))

try:
    AzureSentinelLogger()
except ValueError as e:
    if "CLIENT_ID" in str(e):
        raise SystemExit("Azure Sentinel needs the service principal client ID") from e
    raise

When it happens

Trigger: Initializing the logger with neither client_id nor AZURE_SENTINEL_CLIENT_ID/AZURE_CLIENT_ID in the environment; AZURE_CLIENT_ID was expected but the deployment only sets AZURE_CLIENT_ID in another service; app registration exists but its ID was never captured.

Common situations: Only a connection string or workspace key was configured (this logger does not support key auth); shared AZURE_CLIENT_ID removed during a secrets cleanup; the client ID was confused with the object ID of the app registration.

Related errors

• AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an en
• AZURE_SENTINEL_ENDPOINT is required. Set it as an environmen
• AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set
• AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is requi
• Missing required environment variable: AZURE_STORAGE_ACCOUNT

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/78e6a64dcc090c2b. Report an issue: GitHub.