BerriAI/litellm · error · ValueError

AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is…

Error message

AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.

What it means

AzureSentinelLogger.__init__ resolves the credential from the client_secret kwarg, AZURE_SENTINEL_CLIENT_SECRET, or the generic AZURE_CLIENT_SECRET fallback, and raises when none is set. This client is a pure client-secret flow — there is no managed-identity or certificate path here, so a secret must always be supplied.

Solutions

  1. Create a client secret on the app registration (Entra ID -> App registrations -> Certificates & secrets) and export AZURE_SENTINEL_CLIENT_SECRET=<secret VALUE, not its id>
  2. Or pass client_secret="..." to the constructor
  3. Automate rotation: store in a vault and re-inject env on change, since expiry will surface as an auth failure later
  4. If managed identity is required, this integration cannot supply it — use a different sink or contribute a credential-chain option

Example fix

// before
export AZURE_SENTINEL_TENANT_ID=...
export AZURE_SENTINEL_CLIENT_ID=...      # secret never set
// after
export AZURE_SENTINEL_TENANT_ID=...
export AZURE_SENTINEL_CLIENT_ID=...
export AZURE_SENTINEL_CLIENT_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Defensive patterns

Strategy: validation

Validate before calling

import os

if not (os.getenv("AZURE_SENTINEL_CLIENT_SECRET") or os.getenv("AZURE_CLIENT_SECRET")):
    raise RuntimeError("set AZURE_SENTINEL_CLIENT_SECRET to the secret VALUE (not its id)")

Prevention

When it happens

Trigger: Enabling azure_sentinel with tenant and client id set but no secret; expecting DefaultAzureCredential / managed identity to cover it (it will not); an expired secret removed from env during rotation; pod secret volume not mounted in one environment.

Common situations: Secret expiry forcing rotation but the new value not propagated to the proxy deployment; using the secret's ID instead of its value; local runs where the dev relies on az cli auth that this integration does not use.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/dae8db412c247f9c. Report an issue: GitHub.

Appendix: source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:121

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name
        self.endpoint = resolved_endpoint
        self.tenant_id = resolved_tenant_id
        self.client_id = resolved_client_id
        self.client_secret = resolved_client_secret

        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01
        self.api_endpoint = self._build_api_endpoint(
            endpoint=resolved_endpoint,
            dcr_immutable_id=resolved_dcr_immutable_id,
            stream_name=resolved_stream_name,
        )
        self.audit_api_endpoint = self._build_api_endpoint(

View on GitHub (pinned to 77b7c6c40c)