BerriAI/litellm · error · ValueError

AZURE_SENTINEL_ENDPOINT is required. Set it as an…

Error message

AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.

What it means

AzureSentinelLogger.__init__ requires the Azure Monitor Logs Ingestion endpoint: it checks the endpoint kwarg then the AZURE_SENTINEL_ENDPOINT env var and raises if neither resolves. This is the ingestion URI of your Log Analytics workspace (https://<deployment-id>.ingest.monitor.azure.com), not the workspace resource ID and not the analytics/query API endpoint.

Solutions

Get the value from the Log Analytics workspace / DCR environment: portal -> Log Analytics workspace -> 'View data collection rules' / workspace properties 'Ingestion endpoint', or `az monitor log-analytics workspace show --query publicIngestionEnabled`-adjacent properties; use the https://<id>.ingest.monitor.azure.com form
Or pass endpoint="https://<id>.ingest.monitor.azure.com" to the constructor
Fill in the remaining required values (DCR immutable id, tenant, client id, secret) in the same change

Example fix

// before
export AZURE_SENTINEL_ENDPOINT="my-workspace"          # workspace name, wrong shape
// after
export AZURE_SENTINEL_ENDPOINT="https://my-ws-o1.ingest.monitor.azure.com"

Defensive patterns

Strategy: validation

Validate before calling

import os

endpoint = os.getenv("AZURE_SENTINEL_ENDPOINT", "")
if not endpoint.startswith("https://") or ".ingest.monitor.azure.com" not in endpoint:
    raise RuntimeError(
        "AZURE_SENTINEL_ENDPOINT must be the logs ingestion URI "
        "(https://<id>.ingest.monitor.azure.com), got: %r" % endpoint
    )

Type guard

def is_ingestion_endpoint(url: str) -> bool:
    return url.startswith("https://") and url.endswith(".ingest.monitor.azure.com")

Prevention

Record the ingestion endpoint alongside the DCR id when provisioning — they are a pair
Distinguish it from the query API (api.loganalytics.io) and workspace agent endpoints in runbooks
Assert the endpoint shape at deploy time, not at first log write
Template env per region so cross-region copies cannot reuse a stale endpoint

When it happens

Trigger: Enabling the azure_sentinel callback with only the DCR and Entra credentials configured; pasting the workspace ID or customer-id instead of the ingestion URI; exporting AZURE_SENTINEL_ENDPOINT as an empty string; regional workspace whose endpoint differs from the one copied from another environment.

Common situations: Confusing the query endpoint (api.loganalytics.io) or workspace agent endpoints with the logs ingestion endpoint; docs that stop after DCR creation; multi-region deployments copying env between regions.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/dec9b4f893686759. Report an issue: GitHub.

Appendix: source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:109

        resolved_endpoint: Final = endpoint or os.getenv("AZURE_SENTINEL_ENDPOINT")
        resolved_tenant_id: Final = tenant_id or os.getenv("AZURE_SENTINEL_TENANT_ID") or os.getenv("AZURE_TENANT_ID")
        resolved_client_id: Final = client_id or os.getenv("AZURE_SENTINEL_CLIENT_ID") or os.getenv("AZURE_CLIENT_ID")
        resolved_client_secret: Final = (
            client_secret or os.getenv("AZURE_SENTINEL_CLIENT_SECRET") or os.getenv("AZURE_CLIENT_SECRET")
        )
        resolved_authority_host: Final = self._normalize_authority_host(
            authority_host
            or os.getenv("AZURE_SENTINEL_AUTHORITY_HOST")
            or os.getenv("AZURE_AUTHORITY_HOST")
            or DEFAULT_AZURE_AUTHORITY_HOST
        )

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name

View on GitHub (pinned to 77b7c6c40c)