BerriAI/litellm · error · ValueError

AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required…

Error message

AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.

What it means

AzureSentinelLogger.__init__ resolves the app (client) id from the client_id kwarg, AZURE_SENTINEL_CLIENT_ID, or the generic AZURE_CLIENT_ID fallback, and raises when none is present. This is the application (client) ID of the Entra app registration whose service principal authenticates to the Logs Ingestion API.

Solutions

Export AZURE_SENTINEL_CLIENT_ID=<application (client) id> from the app registration Overview pane, or set AZURE_CLIENT_ID if your ecosystem already standardizes on it
Or pass client_id="..." to the constructor
Grant that app's service principal access: it must be covered by the DCR association and have the Monitoring Metrics Publisher role on the DCR
Set the client secret as well or the final check fires

Example fix

// before
export AZURE_SENTINEL_TENANT_ID=...
export AZURE_SENTINEL_CLIENT_SECRET=...   # client id missing
// after
export AZURE_SENTINEL_TENANT_ID=...
export AZURE_SENTINEL_CLIENT_ID="11111111-2222-3333-4444-555555555555"
export AZURE_SENTINEL_CLIENT_SECRET=...

Defensive patterns

Strategy: validation

Validate before calling

import os

if not (os.getenv("AZURE_SENTINEL_CLIENT_ID") or os.getenv("AZURE_CLIENT_ID")):
    raise RuntimeError("set AZURE_SENTINEL_CLIENT_ID to the app registration's application (client) id")

Prevention

Store the app registration's application (client) id — not the object id — in secrets
Document which of several app registrations is the logging principal
Check the DCR association covers that service principal and grants Monitoring Metrics Publisher
Validate env completeness in CI before images ship

When it happens

Trigger: Enabling azure_sentinel with only tenant + secret exported; the app registration exists but its client id was never captured; AZURE_CLIENT_ID set for another Azure SDK in one environment but not another; helm values file that drops this key.

Common situations: Credentials documented as 'secret + tenant' only; multiple app registrations and the wrong id recorded; cross-environment promotion where AZURE_CLIENT_ID was machine-scoped, not user-scoped.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/78e6a64dcc090c2b. Report an issue: GitHub.

Appendix: source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:117

            or os.getenv("AZURE_SENTINEL_AUTHORITY_HOST")
            or os.getenv("AZURE_AUTHORITY_HOST")
            or DEFAULT_AZURE_AUTHORITY_HOST
        )

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name
        self.endpoint = resolved_endpoint
        self.tenant_id = resolved_tenant_id
        self.client_id = resolved_client_id
        self.client_secret = resolved_client_secret

        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01
        self.api_endpoint = self._build_api_endpoint(
            endpoint=resolved_endpoint,

View on GitHub (pinned to 77b7c6c40c)