{"record":{"id":"78e6a64dcc090c2b","repo":"BerriAI/litellm","slug":"azure-sentinel-client-id-or-azure-client-id-is-req","errorCode":null,"errorMessage":"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.","messagePattern":"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required\\. Set it as an environment variable or pass client_id parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":117,"sourceCode":"            or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n            or os.getenv(\"AZURE_AUTHORITY_HOST\")\n            or DEFAULT_AZURE_AUTHORITY_HOST\n        )\n\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name\n        self.endpoint = resolved_endpoint\n        self.tenant_id = resolved_tenant_id\n        self.client_id = resolved_client_id\n        self.client_secret = resolved_client_secret\n\n        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01\n        self.api_endpoint = self._build_api_endpoint(\n            endpoint=resolved_endpoint,","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/integrations/azure_sentinel/azure_sentinel.py#L99-L135","documentation":"AzureSentinelLogger.__init__ resolves the app (client) id from the client_id kwarg, AZURE_SENTINEL_CLIENT_ID, or the generic AZURE_CLIENT_ID fallback, and raises when none is present. This is the application (client) ID of the Entra app registration whose service principal authenticates to the Logs Ingestion API.","triggerScenarios":"Enabling azure_sentinel with only tenant + secret exported; the app registration exists but its client id was never captured; AZURE_CLIENT_ID set for another Azure SDK in one environment but not another; helm values file that drops this key.","commonSituations":"Credentials documented as 'secret + tenant' only; multiple app registrations and the wrong id recorded; cross-environment promotion where AZURE_CLIENT_ID was machine-scoped, not user-scoped.","solutions":["Export AZURE_SENTINEL_CLIENT_ID=<application (client) id> from the app registration Overview pane, or set AZURE_CLIENT_ID if your ecosystem already standardizes on it","Or pass client_id=\"...\" to the constructor","Grant that app's service principal access: it must be covered by the DCR association and have the Monitoring Metrics Publisher role on the DCR","Set the client secret as well or the final check fires"],"exampleFix":"// before\nexport AZURE_SENTINEL_TENANT_ID=...\nexport AZURE_SENTINEL_CLIENT_SECRET=...   # client id missing\n// after\nexport AZURE_SENTINEL_TENANT_ID=...\nexport AZURE_SENTINEL_CLIENT_ID=\"11111111-2222-3333-4444-555555555555\"\nexport AZURE_SENTINEL_CLIENT_SECRET=...","handlingStrategy":"validation","validationCode":"import os\n\nif not (os.getenv(\"AZURE_SENTINEL_CLIENT_ID\") or os.getenv(\"AZURE_CLIENT_ID\")):\n    raise RuntimeError(\"set AZURE_SENTINEL_CLIENT_ID to the app registration's application (client) id\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store the app registration's application (client) id — not the object id — in secrets","Document which of several app registrations is the logging principal","Check the DCR association covers that service principal and grants Monitoring Metrics Publisher","Validate env completeness in CI before images ship"],"tags":["azure-sentinel","entra-id","app-registration","litellm","configuration","missing-env-var"],"backgroundTag":"missing-env-var","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}