{"record":{"id":"3cd04be74073bb6f","repo":"BerriAI/litellm","slug":"azure-sentinel-tenant-id-or-azure-tenant-id-is-req","errorCode":null,"errorMessage":"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.","messagePattern":"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required\\. Set it as an environment variable or pass tenant_id parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":113,"sourceCode":"            client_secret or os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")\n        )\n        resolved_authority_host: Final = self._normalize_authority_host(\n            authority_host\n            or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n            or os.getenv(\"AZURE_AUTHORITY_HOST\")\n            or DEFAULT_AZURE_AUTHORITY_HOST\n        )\n\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name\n        self.endpoint = resolved_endpoint\n        self.tenant_id = resolved_tenant_id\n        self.client_id = resolved_client_id\n        self.client_secret = resolved_client_secret","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/integrations/azure_sentinel/azure_sentinel.py#L95-L131","documentation":"Azure Sentinel log ingestion uses service-principal (client-credential) auth, which requires an Entra ID tenant. The logger resolves tenant from the tenant_id parameter, AZURE_SENTINEL_TENANT_ID, or the generic AZURE_TENANT_ID fallback; if all are empty it raises ValueError. The generic fallback exists so deployments already using AZURE_TENANT_ID for other Azure integrations work without duplication.","triggerScenarios":"Constructing AzureSentinelLogger with no tenant_id parameter while neither AZURE_SENTINEL_TENANT_ID nor AZURE_TENANT_ID is in the environment; the app service/container has client id and secret but tenant was never configured.","commonSituations":"Secrets configured piecemeal (app registration created, client secret stored, tenant GUID overlooked); using a shared AZURE_TENANT_ID that was removed when another integration was cleaned up; multi-tenant setups where the wrong tenant env var was expected.","solutions":["Set AZURE_SENTINEL_TENANT_ID to the Entra tenant GUID (Azure Portal > Microsoft Entra ID > Overview > Tenant ID), or reuse AZURE_TENANT_ID if it already holds the same tenant","Or pass tenant_id=... to the AzureSentinelLogger constructor","Confirm the tenant matches the one where the app registration (client_id) lives","Audit all five required Sentinel variables at startup with a single check"],"exampleFix":"# before\nAzureSentinelLogger(dcr_immutable_id=dcr_id, endpoint=url, client_id=c, client_secret=s)  # no tenant\n\n# after\nAzureSentinelLogger(\n    dcr_immutable_id=dcr_id, endpoint=url,\n    tenant_id=\"11111111-2222-3333-4444-555555555555\",\n    client_id=c, client_secret=s,\n)","handlingStrategy":"validation","validationCode":"import os\n\ntenant_id = os.getenv(\"AZURE_SENTINEL_TENANT_ID\") or os.getenv(\"AZURE_TENANT_ID\")\nif not tenant_id:\n    raise RuntimeError(\"Set AZURE_SENTINEL_TENANT_ID (or AZURE_TENANT_ID) to the Entra tenant GUID\")","typeGuard":"import re\nGUID_RE = re.compile(r\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\")\n\ndef is_tenant_guid(v: str | None) -> bool:\n    return isinstance(v, str) and bool(GUID_RE.match(v))","tryCatchPattern":"try:\n    AzureSentinelLogger()\nexcept ValueError as e:\n    if \"TENANT_ID\" in str(e):\n        raise SystemExit(\"Azure Sentinel needs AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID\") from e\n    raise","preventionTips":["Standardize on one tenant env var per deployment; set the AZURE_SENTINEL_* variant explicitly to avoid surprises from generic AZURE_TENANT_ID changes","Validate the tenant is a GUID matching the app registration's tenant","Run the five-variable completeness check before enabling the callback"],"tags":["azure","azure-sentinel","entra-id","environment-variables","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}