{"record":{"id":"8b02bbff100e006a","repo":"BerriAI/litellm","slug":"azure-sentinel-dcr-immutable-id-is-required-set-i","errorCode":null,"errorMessage":"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.","messagePattern":"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required\\. Set it as an environment variable or pass dcr_immutable_id parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":105,"sourceCode":" resolved_stream_name: Final = stream_name or os.getenv(\"AZURE_SENTINEL_STREAM_NAME\") or \"Custom-LiteLLM\"\n resolved_audit_stream_name: Final = (\n audit_stream_name or os.getenv(\"AZURE_SENTINEL_AUDIT_STREAM_NAME\") or resolved_stream_name\n )\n resolved_endpoint: Final = endpoint or os.getenv(\"AZURE_SENTINEL_ENDPOINT\")\n resolved_tenant_id: Final = tenant_id or os.getenv(\"AZURE_SENTINEL_TENANT_ID\") or os.getenv(\"AZURE_TENANT_ID\")\n resolved_client_id: Final = client_id or os.getenv(\"AZURE_SENTINEL_CLIENT_ID\") or os.getenv(\"AZURE_CLIENT_ID\")\n resolved_client_secret: Final = (\n client_secret or os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")\n )\n resolved_authority_host: Final = self._normalize_authority_host(\n authority_host\n or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n or os.getenv(\"AZURE_AUTHORITY_HOST\")\n or DEFAULT_AZURE_AUTHORITY_HOST\n )\n\n if not resolved_dcr_immutable_id:\n raise ValueError(\n \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n )\n if not resolved_endpoint:\n raise ValueError(\n \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n )\n if not resolved_tenant_id:\n raise ValueError(\n \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n )\n if not resolved_client_id:\n raise ValueError(\n \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n )\n if not resolved_client_secret:\n raise ValueError(\n \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n )","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/integrations/azure_sentinel/azure_sentinel.py#L87-L123","documentation":"The Azure Sentinel (Log Analytics DCR) logger requires a Data Collection Rule immutable ID to build its ingestion URL ({Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/...). At init it resolves dcr_immutable_id from the constructor parameter or AZURE_SENTINEL_DCR_IMMUTABLE_ID; if neither is present it raises ValueError. Unlike some Azure settings there is no generic AZURE_* fallback for this one — it is Sentinel-specific.","triggerScenarios":"Enabling the azure_sentinel callback without setting AZURE_SENTINEL_DCR_IMMUTABLE_ID and without passing dcr_immutable_id=... to the constructor; typos in the env var name; env var set in a different shell/container than the one running litellm.","commonSituations":"Copying the Azure Sentinel docs example but skipping the DCR creation step; DCR created in Azure portal but its immutable ID (the full GUID-like immutableId property, not the rule name) never copied; secrets injected only into the proxy container and not the worker.","solutions":["Get the DCR Immutable ID: az monitor data-collection rule show --name --resource-group --query immutableId","Export it: AZURE_SENTINEL_DCR_IMMUTABLE_ID= in the environment, or pass dcr_immutable_id=... when constructing the logger","Also set the other required values (endpoint, tenant, client) since the same init raises for each of them in turn","If running in Docker/K8s, add the variable to the container env spec and redeploy"],"exampleFix":"# before\nAzureSentinelLogger() # ValueError: AZURE_SENTINEL_DCR_IMMUTABLE_ID is required\n\n# after\nAzureSentinelLogger(\n dcr_immutable_id=\"dcr-0123456789abcdef0123456789abcdef\",\n endpoint=\"https://my-log-analytics-workspace-0dgb.eastus.ingest.monitor.azure.com\",\n tenant_id=\"\",\n client_id=\"\",\n client_secret=\"\",\n)","handlingStrategy":"validation","validationCode":"import os\n\nREQUIRED_SENTINEL_VARS = (\n \"AZURE_SENTINEL_DCR_IMMUTABLE_ID\",\n \"AZURE_SENTINEL_ENDPOINT\",\n \"AZURE_SENTINEL_TENANT_ID\",\n \"AZURE_SENTINEL_CLIENT_ID\",\n \"AZURE_SENTINEL_CLIENT_SECRET\",\n)\nmissing = [v for v in REQUIRED_SENTINEL_VARS if not os.getenv(v)]\nif missing:\n raise RuntimeError(f\"Missing Azure Sentinel config: {missing}\")","typeGuard":"def has_sentinel_config(env: dict) -> bool:\n return all(env.get(v) for v in (\n \"AZURE_SENTINEL_DCR_IMMUTABLE_ID\", \"AZURE_SENTINEL_ENDPOINT\",\n \"AZURE_SENTINEL_TENANT_ID\", \"AZURE_SENTINEL_CLIENT_ID\", \"AZURE_SENTINEL_CLIENT_SECRET\",\n ))","tryCatchPattern":"try:\n logger = AzureSentinelLogger()\nexcept ValueError as e:\n if \"AZURE_SENTINEL_DCR_IMMUTABLE_ID\" in str(e):\n # config incomplete: disable callback or abort deploy; do not start half-configured\n raise SystemExit(f\"Azure Sentinel logger misconfigured: {e}\") from e\n raise","preventionTips":["Use a startup config check that validates all five Sentinel values at once","Store the DCR immutable ID alongside the endpoint in the same secret store entry to keep them in sync","Add the env block to container/K8s specs explicitly; never rely on host shell env","Document that DCR immutable ID is the immutableId property, not the rule name"],"tags":["azure","azure-sentinel","logging-callback","environment-variables","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}