BerriAI/litellm · error · ValueError

AZURE_SENTINEL_ENDPOINT is required. Set it as an environmen

Error message

AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.

What it means

The Azure Sentinel logger needs the Log Analytics data collection endpoint (the ingestion URL of your workspace) to POST logs to. It resolves endpoint from the constructor parameter or AZURE_SENTINEL_ENDPOINT, and raises ValueError when both are empty. The URL is combined with the DCR immutable ID and stream name to form the final ingestion path.

Source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:109

        resolved_endpoint: Final = endpoint or os.getenv("AZURE_SENTINEL_ENDPOINT")
        resolved_tenant_id: Final = tenant_id or os.getenv("AZURE_SENTINEL_TENANT_ID") or os.getenv("AZURE_TENANT_ID")
        resolved_client_id: Final = client_id or os.getenv("AZURE_SENTINEL_CLIENT_ID") or os.getenv("AZURE_CLIENT_ID")
        resolved_client_secret: Final = (
            client_secret or os.getenv("AZURE_SENTINEL_CLIENT_SECRET") or os.getenv("AZURE_CLIENT_SECRET")
        )
        resolved_authority_host: Final = self._normalize_authority_host(
            authority_host
            or os.getenv("AZURE_SENTINEL_AUTHORITY_HOST")
            or os.getenv("AZURE_AUTHORITY_HOST")
            or DEFAULT_AZURE_AUTHORITY_HOST
        )

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Find the endpoint in Azure Portal: Log Analytics workspace > Tables > Data collection endpoint (or via az rest on the table resource), then export AZURE_SENTINEL_ENDPOINT=<that URL>
2. Or pass endpoint=... directly to the AzureSentinelLogger constructor
3. Verify the value is a full https:// ingestion URL for the correct region
4. Check the other four required Sentinel settings are also set (DCR ID, tenant, client id, secret) — init validates each

Example fix

# before
AzureSentinelLogger(dcr_immutable_id=dcr_id, tenant_id=t, client_id=c, client_secret=s)  # missing endpoint

# after
AzureSentinelLogger(
    dcr_immutable_id=dcr_id,
    endpoint="https://myworkspace-0dgb.eastus.ingest.monitor.azure.com",
    tenant_id=t, client_id=c, client_secret=s,
)

import os
from urllib.parse import urlparse

endpoint = os.getenv("AZURE_SENTINEL_ENDPOINT", "")
parsed = urlparse(endpoint)
assert parsed.scheme == "https" and ".ingest.monitor.azure.com" in parsed.netloc, \
    f"AZURE_SENTINEL_ENDPOINT must be a Log Analytics ingestion URL, got {endpoint!r}"

def is_ingest_endpoint(url: str | None) -> bool:
    if not url:
        return False
    p = urlparse(url)
    return p.scheme == "https" and "ingest" in p.netloc and p.netloc.endswith("azure.com")

try:
    AzureSentinelLogger()
except ValueError as e:
    if "AZURE_SENTINEL_ENDPOINT" in str(e):
        raise SystemExit("Set AZURE_SENTINEL_ENDPOINT to the workspace Data collection endpoint URL") from e
    raise

When it happens

Trigger: Initializing AzureSentinelLogger with neither the endpoint parameter nor AZURE_SENTINEL_ENDPOINT set; env var misspelled or scoped to the wrong process; endpoint value present but empty string.

Common situations: Not knowing which endpoint Azure expects (it is the workspace's ingest URL like https://<workspace>-<suffix>.<region>.ingest.monitor.azure.com, from Tables > Data collection endpoint, not the portal URL); rotating to a new workspace without updating env vars; deploying with a partial secret set.

Related errors

• AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an en
• AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set
• AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set
• AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is requi
• Missing required environment variable: AZURE_STORAGE_ACCOUNT

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/dec9b4f893686759. Report an issue: GitHub.