BerriAI/litellm · error · ValueError

AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required…

Error message

AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.

What it means

AzureSentinelLogger.__init__ resolves the tenant from the tenant_id kwarg, AZURE_SENTINEL_TENANT_ID, or the generic AZURE_TENANT_ID fallback; if none is set it raises. The tenant is the Microsoft Entra ID (Azure AD) directory that hosts the app registration used for client-credentials authentication against the ingestion API.

Solutions

Export AZURE_SENTINEL_TENANT_ID=<directory/tenant id> (Entra ID -> Overview -> Tenant ID) or rely on AZURE_TENANT_ID if your platform already sets it
Or pass tenant_id="..." to the AzureSentinelLogger constructor
Complete the credential triple (client id + secret) too, otherwise the next check fires

Example fix

// before
export AZURE_SENTINEL_CLIENT_ID=...
export AZURE_SENTINEL_CLIENT_SECRET=...   # no tenant -> ValueError
// after
export AZURE_SENTINEL_TENANT_ID="00000000-0000-0000-0000-000000000000"
export AZURE_SENTINEL_CLIENT_ID=...
export AZURE_SENTINEL_CLIENT_SECRET=...

Defensive patterns

Strategy: validation

Validate before calling

import os

if not (os.getenv("AZURE_SENTINEL_TENANT_ID") or os.getenv("AZURE_TENANT_ID")):
    raise RuntimeError("set AZURE_SENTINEL_TENANT_ID (Entra ID -> Overview -> Tenant ID)")

Prevention

Capture tenant id, client id and secret together when creating the service principal
Prefer the AZURE_SENTINEL_* names over generic AZURE_* to avoid clashes with other Azure SDKs
Include the tenant id in the same secret bundle as the rest of the sentinel config
Validate all sentinel env in a pre-deploy job

When it happens

Trigger: Enabling azure_sentinel logging with only service-principal client id/secret set but no tenant; using AZURE_* vars from another SDK that does not define AZURE_TENANT_ID; misconfigured pod spec where only some secrets are mounted; personal Microsoft accounts with no tenant concept.

Common situations: Service principal created but tenant id never recorded (it is the directory ID on the Entra 'Overview' pane); multi-tenant setups exporting the wrong directory id; local dev using az login without env vars set.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/3cd04be74073bb6f. Report an issue: GitHub.

Appendix: source

Thrown at litellm/integrations/azure_sentinel/azure_sentinel.py:113

            client_secret or os.getenv("AZURE_SENTINEL_CLIENT_SECRET") or os.getenv("AZURE_CLIENT_SECRET")
        )
        resolved_authority_host: Final = self._normalize_authority_host(
            authority_host
            or os.getenv("AZURE_SENTINEL_AUTHORITY_HOST")
            or os.getenv("AZURE_AUTHORITY_HOST")
            or DEFAULT_AZURE_AUTHORITY_HOST
        )

        if not resolved_dcr_immutable_id:
            raise ValueError(
                "AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter."
            )
        if not resolved_endpoint:
            raise ValueError(
                "AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter."
            )
        if not resolved_tenant_id:
            raise ValueError(
                "AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter."
            )
        if not resolved_client_id:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter."
            )
        if not resolved_client_secret:
            raise ValueError(
                "AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter."
            )

        self.dcr_immutable_id = resolved_dcr_immutable_id
        self.stream_name = resolved_stream_name
        self.audit_stream_name = resolved_audit_stream_name
        self.endpoint = resolved_endpoint
        self.tenant_id = resolved_tenant_id
        self.client_id = resolved_client_id
        self.client_secret = resolved_client_secret

View on GitHub (pinned to 77b7c6c40c)