BerriAI/litellm · error · ValueError

AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is requi

Error message

AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.

What it means

The final required Azure Sentinel credential: the service principal's client secret. It is resolved from the client_secret parameter, AZURE_SENTINEL_CLIENT_SECRET, or generic AZURE_CLIENT_SECRET; if empty, init raises ValueError. Note the message is slightly misleading — the parameter name is client_secret while the message says client_secret parameter too, but it also accepts the AZURE_CLIENT_SECRET fallback.

Source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:121

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name
        self.endpoint = resolved_endpoint
        self.tenant_id = resolved_tenant_id
        self.client_id = resolved_client_id
        self.client_secret = resolved_client_secret

        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01
        self.api_endpoint = self._build_api_endpoint(
            endpoint=resolved_endpoint,
            dcr_immutable_id=resolved_dcr_immutable_id,
            stream_name=resolved_stream_name,
        )
        self.audit_api_endpoint = self._build_api_endpoint(

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Create a client secret on the app registration (Entra ID > App registrations > Certificates & secrets) and export AZURE_SENTINEL_CLIENT_SECRET (or pass client_secret=...)
2. If using a secret vault, wire it to inject the env var at container start
3. Check for expiry date on the secret and set a rotation reminder
4. Verify no trailing whitespace/newline in the exported value

Example fix

# before
AzureSentinelLogger(dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t, client_id=c)  # no secret

# after
AzureSentinelLogger(
    dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t, client_id=c,
    client_secret="~F8Q...generated-secret...",
)

import os

secret = os.getenv("AZURE_SENTINEL_CLIENT_SECRET") or os.getenv("AZURE_CLIENT_SECRET")
if not secret:
    raise RuntimeError("Set AZURE_SENTINEL_CLIENT_SECRET (or AZURE_CLIENT_SECRET) to the app registration's client secret")

def is_non_empty_secret(v: str | None) -> bool:
    return isinstance(v, str) and v.strip() != ""

try:
    AzureSentinelLogger()
except ValueError as e:
    if "CLIENT_SECRET" in str(e):
        raise SystemExit("Azure Sentinel needs a client secret; cert auth is not supported") from e
    raise

When it happens

Trigger: Constructing AzureSentinelLogger without client_secret and without AZURE_SENTINEL_CLIENT_SECRET/AZURE_CLIENT_SECRET; secret stored in a vault but never exported to the runtime env; cert-based credential intended but unsupported by this logger.

Common situations: Expired client secret ( Azure shows secrets with expiry; an expired secret yields a later auth error, but a never-configured one yields this error first); secret injected into CI but not the runtime container; copy-paste captured whitespace or quotes around the value making it effectively empty after shell parsing.

Related errors

• AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an en
• AZURE_SENTINEL_ENDPOINT is required. Set it as an environmen
• AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set
• AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set
• Missing required environment variable: AZURE_STORAGE_ACCOUNT

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/dae8db412c247f9c. Report an issue: GitHub.