BerriAI/litellm · error · ValueError

AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set

Error message

AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.

What it means

Azure Sentinel log ingestion uses service-principal (client-credential) auth, which requires an Entra ID tenant. The logger resolves tenant from the tenant_id parameter, AZURE_SENTINEL_TENANT_ID, or the generic AZURE_TENANT_ID fallback; if all are empty it raises ValueError. The generic fallback exists so deployments already using AZURE_TENANT_ID for other Azure integrations work without duplication.

Source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:113

            client_secret or os.getenv("AZURE_SENTINEL_CLIENT_SECRET") or os.getenv("AZURE_CLIENT_SECRET")
        )
        resolved_authority_host: Final = self._normalize_authority_host(
            authority_host
            or os.getenv("AZURE_SENTINEL_AUTHORITY_HOST")
            or os.getenv("AZURE_AUTHORITY_HOST")
            or DEFAULT_AZURE_AUTHORITY_HOST
        )

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name
        self.endpoint = resolved_endpoint
        self.tenant_id = resolved_tenant_id
        self.client_id = resolved_client_id
        self.client_secret = resolved_client_secret

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Set AZURE_SENTINEL_TENANT_ID to the Entra tenant GUID (Azure Portal > Microsoft Entra ID > Overview > Tenant ID), or reuse AZURE_TENANT_ID if it already holds the same tenant
2. Or pass tenant_id=... to the AzureSentinelLogger constructor
3. Confirm the tenant matches the one where the app registration (client_id) lives
4. Audit all five required Sentinel variables at startup with a single check

Example fix

# before
AzureSentinelLogger(dcr_immutable_id=dcr_id, endpoint=url, client_id=c, client_secret=s)  # no tenant

# after
AzureSentinelLogger(
    dcr_immutable_id=dcr_id, endpoint=url,
    tenant_id="11111111-2222-3333-4444-555555555555",
    client_id=c, client_secret=s,
)

import os

tenant_id = os.getenv("AZURE_SENTINEL_TENANT_ID") or os.getenv("AZURE_TENANT_ID")
if not tenant_id:
    raise RuntimeError("Set AZURE_SENTINEL_TENANT_ID (or AZURE_TENANT_ID) to the Entra tenant GUID")

import re
GUID_RE = re.compile(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")

def is_tenant_guid(v: str | None) -> bool:
    return isinstance(v, str) and bool(GUID_RE.match(v))

try:
    AzureSentinelLogger()
except ValueError as e:
    if "TENANT_ID" in str(e):
        raise SystemExit("Azure Sentinel needs AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID") from e
    raise

When it happens

Trigger: Constructing AzureSentinelLogger with no tenant_id parameter while neither AZURE_SENTINEL_TENANT_ID nor AZURE_TENANT_ID is in the environment; the app service/container has client id and secret but tenant was never configured.

Common situations: Secrets configured piecemeal (app registration created, client secret stored, tenant GUID overlooked); using a shared AZURE_TENANT_ID that was removed when another integration was cleaned up; multi-tenant setups where the wrong tenant env var was expected.

Related errors

• AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an en
• AZURE_SENTINEL_ENDPOINT is required. Set it as an environmen
• AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set
• AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is requi
• Missing required environment variable: AZURE_STORAGE_ACCOUNT

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/3cd04be74073bb6f. Report an issue: GitHub.