{"record":{"id":"2c63ec4de5fb2a53","repo":"BerriAI/litellm","slug":"failed-to-get-azure-ad-token-e","errorCode":null,"errorMessage":"Failed to get Azure AD token: {e}","messagePattern":"Failed to get Azure AD token: (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"litellm/llms/azure/common_utils.py","lineNumber":381,"sourceCode":"            azure_ad_token_provider = BaseAzureLLM._try_get_default_azure_credential_provider(\n                scope=scope,\n            )\n\n    # Execute the token provider to get the token if available\n    if azure_ad_token_provider and callable(azure_ad_token_provider):\n        try:\n            token: Final = azure_ad_token_provider()\n            if not isinstance(token, str):\n                verbose_logger.error(\"Azure AD token provider returned non-string value: %s\", type(token))\n                raise TypeError(f\"Azure AD token must be a string, got {type(token)}\")\n            else:\n                azure_ad_token = token\n        except TypeError:\n            # Re-raise TypeError directly\n            raise\n        except Exception as e:\n            verbose_logger.error(\"Error calling Azure AD token provider: %s\", e)\n            raise RuntimeError(f\"Failed to get Azure AD token: {e}\") from e\n\n    return azure_ad_token\n\n\nclass BaseAzureLLM(BaseOpenAILLM):\n    @staticmethod\n    def _try_get_default_azure_credential_provider(\n        scope: str,\n    ) -> Callable[[], str] | None:\n        \"\"\"\n        Try to get DefaultAzureCredential provider\n\n        Args:\n            scope: Azure scope for the token\n\n        Returns:\n            Token provider callable if DefaultAzureCredential is enabled and available, None otherwise\n        \"\"\"","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/azure/common_utils.py#L363-L399","documentation":"The azure_ad_token_provider callable raised an exception (anything other than the TypeError from 1025). LiteLLM wraps it in RuntimeError('Failed to get Azure AD token: {e}') chained to the original. The root cause is in the provider itself — credential errors, network failure to IMDS, missing env, etc.","triggerScenarios":"DefaultAzureCredential raising ClientAuthenticationError (no env vars, no managed identity, no CLI login in a container); IMDS endpoint unreachable (169.254.169.254 blocked); azure-identity exceptions like CredentialUnavailableError propagating out of the provider.","commonSituations":"Local code using DefaultAzureCredential works (CLI login) but the Docker container has none of the credential sources; IMDS calls blocked by network policy; expired az login refresh tokens; workloads where SharedTokenCacheCredential throws.","solutions":["Read the chained cause (raise ... from e preserves it; log e.__cause__) — it names the failing credential.","In containers, ensure exactly one credential source is available: managed identity enabled, or AZURE_CLIENT_ID/AZURE_TENANT_ID/client secret env vars, or a mounted CLI token cache.","Allow IMDS traffic (169.254.169.254) and set AZURE_CLIENT_ID for user-assigned managed identity.","Catch the provider error yourself and retry once with a fresh credential instance to handle transient IMDS 410/503s."],"exampleFix":"# before\nlitellm.completion(model=\"azure/dep\", messages=msgs, azure_ad_token_provider=lambda: DefaultAzureCredential().get_token(S).token)\n\n# after (clear failure + actionable message)\ndef provider():\n    try:\n        return DefaultAzureCredential().get_token(S).token\n    except Exception as e:\n        raise RuntimeError(f\"credential chain failed; check managed identity/env: {e}\") from e\nlitellm.completion(model=\"azure/dep\", messages=msgs, azure_ad_token_provider=provider)","handlingStrategy":"try-catch","validationCode":"def probe_credential() -> None:\n    from azure.identity import DefaultAzureCredential\n    DefaultAzureCredential().get_token(\"https://cognitiveservices.azure.com/.default\")  # fails fast, clear error","typeGuard":null,"tryCatchPattern":"try:\n    resp = litellm.completion(..., azure_ad_token_provider=provider)\nexcept RuntimeError as e:\n    cause = e.__cause__\n    log.error(\"token provider failed: %s\", cause)\n    if \"CredentialUnavailable\" in type(cause).__name__:\n        raise ConfigError(\"No Azure credential source in this environment\") from e\n    raise","preventionTips":["Wrap provider bodies in try/except and re-raise with actionable context.","Verify a credential source exists (managed identity, env vars, CLI login) in container images.","Probe DefaultAzureCredential().get_token() during startup healthchecks."],"tags":["azure","authentication","azure-identity","runtime-error","credentials"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}