{"record":{"id":"3cd04be74073bb6f","repo":"BerriAI/litellm","slug":"azure-sentinel-tenant-id-or-azure-tenant-id-is-req","errorCode":null,"errorMessage":"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.","messagePattern":"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required\\. Set it as an environment variable or pass tenant_id parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":113,"sourceCode":"            client_secret or os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")\n        )\n        resolved_authority_host: Final = self._normalize_authority_host(\n            authority_host\n            or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n            or os.getenv(\"AZURE_AUTHORITY_HOST\")\n            or DEFAULT_AZURE_AUTHORITY_HOST\n        )\n\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name\n        self.endpoint = resolved_endpoint\n        self.tenant_id = resolved_tenant_id\n        self.client_id = resolved_client_id\n        self.client_secret = resolved_client_secret","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/integrations/azure_sentinel/azure_sentinel.py#L95-L131","documentation":"AzureSentinelLogger.__init__ resolves the tenant from the tenant_id kwarg, AZURE_SENTINEL_TENANT_ID, or the generic AZURE_TENANT_ID fallback; if none is set it raises. The tenant is the Microsoft Entra ID (Azure AD) directory that hosts the app registration used for client-credentials authentication against the ingestion API.","triggerScenarios":"Enabling azure_sentinel logging with only service-principal client id/secret set but no tenant; using AZURE_* vars from another SDK that does not define AZURE_TENANT_ID; misconfigured pod spec where only some secrets are mounted; personal Microsoft accounts with no tenant concept.","commonSituations":"Service principal created but tenant id never recorded (it is the directory ID on the Entra 'Overview' pane); multi-tenant setups exporting the wrong directory id; local dev using az login without env vars set.","solutions":["Export AZURE_SENTINEL_TENANT_ID=<directory/tenant id> (Entra ID -> Overview -> Tenant ID) or rely on AZURE_TENANT_ID if your platform already sets it","Or pass tenant_id=\"...\" to the AzureSentinelLogger constructor","Complete the credential triple (client id + secret) too, otherwise the next check fires"],"exampleFix":"// before\nexport AZURE_SENTINEL_CLIENT_ID=...\nexport AZURE_SENTINEL_CLIENT_SECRET=...   # no tenant -> ValueError\n// after\nexport AZURE_SENTINEL_TENANT_ID=\"00000000-0000-0000-0000-000000000000\"\nexport AZURE_SENTINEL_CLIENT_ID=...\nexport AZURE_SENTINEL_CLIENT_SECRET=...","handlingStrategy":"validation","validationCode":"import os\n\nif not (os.getenv(\"AZURE_SENTINEL_TENANT_ID\") or os.getenv(\"AZURE_TENANT_ID\")):\n    raise RuntimeError(\"set AZURE_SENTINEL_TENANT_ID (Entra ID -> Overview -> Tenant ID)\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Capture tenant id, client id and secret together when creating the service principal","Prefer the AZURE_SENTINEL_* names over generic AZURE_* to avoid clashes with other Azure SDKs","Include the tenant id in the same secret bundle as the rest of the sentinel config","Validate all sentinel env in a pre-deploy job"],"tags":["azure-sentinel","entra-id","service-principal","litellm","configuration","missing-env-var"],"backgroundTag":"missing-env-var","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}