{"record":{"id":"78e6a64dcc090c2b","repo":"BerriAI/litellm","slug":"azure-sentinel-client-id-or-azure-client-id-is-req","errorCode":null,"errorMessage":"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.","messagePattern":"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required\\. Set it as an environment variable or pass client_id parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":117,"sourceCode":"            or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n            or os.getenv(\"AZURE_AUTHORITY_HOST\")\n            or DEFAULT_AZURE_AUTHORITY_HOST\n        )\n\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name\n        self.endpoint = resolved_endpoint\n        self.tenant_id = resolved_tenant_id\n        self.client_id = resolved_client_id\n        self.client_secret = resolved_client_secret\n\n        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01\n        self.api_endpoint = self._build_api_endpoint(\n            endpoint=resolved_endpoint,","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/integrations/azure_sentinel/azure_sentinel.py#L99-L135","documentation":"The Azure Sentinel logger authenticates with a service principal, so it needs the app registration's client (application) ID. It resolves client_id from the parameter, AZURE_SENTINEL_CLIENT_ID, or generic AZURE_CLIENT_ID, and raises ValueError when none is set. Without it no OAuth token can be acquired for ingestion.","triggerScenarios":"Initializing the logger with neither client_id nor AZURE_SENTINEL_CLIENT_ID/AZURE_CLIENT_ID in the environment; AZURE_CLIENT_ID was expected but the deployment only sets AZURE_CLIENT_ID in another service; app registration exists but its ID was never captured.","commonSituations":"Only a connection string or workspace key was configured (this logger does not support key auth); shared AZURE_CLIENT_ID removed during a secrets cleanup; the client ID was confused with the object ID of the app registration.","solutions":["Create/reuse an app registration and copy its Application (client) ID, then export AZURE_SENTINEL_CLIENT_ID (or AZURE_CLIENT_ID)","Or pass client_id=... to the constructor","Grant the service principal access: DCR + Log Analytics workspace permissions (e.g. Monitoring Metrics Publisher on the DCR)","Verify the value is the client ID GUID, not the object ID or secret"],"exampleFix":"# before\nAzureSentinelLogger(dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t, client_secret=s)  # no client id\n\n# after\nAzureSentinelLogger(\n    dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t,\n    client_id=\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\",\n    client_secret=s,\n)","handlingStrategy":"validation","validationCode":"import os\n\nclient_id = os.getenv(\"AZURE_SENTINEL_CLIENT_ID\") or os.getenv(\"AZURE_CLIENT_ID\")\nif not client_id:\n    raise RuntimeError(\"Set AZURE_SENTINEL_CLIENT_ID (or AZURE_CLIENT_ID) to the app registration's client ID\")","typeGuard":"import re\nGUID_RE = re.compile(r\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\")\n\ndef is_client_id(v: str | None) -> bool:\n    return isinstance(v, str) and bool(GUID_RE.match(v))","tryCatchPattern":"try:\n    AzureSentinelLogger()\nexcept ValueError as e:\n    if \"CLIENT_ID\" in str(e):\n        raise SystemExit(\"Azure Sentinel needs the service principal client ID\") from e\n    raise","preventionTips":["Copy the Application (client) ID, not the Object ID, from the app registration Overview page","Group all Sentinel credentials in one secret store entry so they are updated atomically","Add a CI check for all five required env vars when the azure_sentinel callback is enabled"],"tags":["azure","azure-sentinel","service-principal","environment-variables","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}