{"record":{"id":"95fa2ed7fc7092e6","repo":"microsoft/autogen","slug":"only-defaultazurecredential-is-supported","errorCode":null,"errorMessage":"Only DefaultAzureCredential is supported","messagePattern":"Only DefaultAzureCredential is supported","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/packages/autogen-ext/src/autogen_ext/auth/azure/__init__.py","lineNumber":40,"sourceCode":"        self.credential = credential\n        self.scopes = list(scopes)\n        self.provider = get_bearer_token_provider(self.credential, *self.scopes)\n\n    def __call__(self) -> str:\n        return self.provider()\n\n    def _to_config(self) -> TokenProviderConfig:\n        \"\"\"Dump the configuration that would be requite to create a new instance of a component matching the configuration of this instance.\n\n        Returns:\n            T: The configuration of the component.\n        \"\"\"\n\n        if isinstance(self.credential, DefaultAzureCredential):\n            # NOTE: we are not currently inspecting the chained credentials, so this could result in a loss of information\n            return TokenProviderConfig(provider_kind=\"DefaultAzureCredential\", scopes=self.scopes)\n        else:\n            raise ValueError(\"Only DefaultAzureCredential is supported\")\n\n    @classmethod\n    def _from_config(cls, config: TokenProviderConfig) -> Self:\n        \"\"\"Create a new instance of the component from a configuration object.\n\n        Args:\n            config (T): The configuration object.\n\n        Returns:\n            Self: The new instance of the component.\n        \"\"\"\n\n        if config.provider_kind == \"DefaultAzureCredential\":\n            return cls(DefaultAzureCredential(), *config.scopes)\n        else:\n            raise ValueError(\"Only DefaultAzureCredential is supported\")\n","sourceCodeStart":22,"sourceCodeEnd":57,"githubUrl":"https://github.com/microsoft/autogen/blob/027ecf0a379bcc1d09956d46d12d44a3ad9cee14/python/packages/autogen-ext/src/autogen_ext/auth/azure/__init__.py#L22-L57","documentation":"AzureTokenProvider._to_config() serializes the component's configuration but only supports the DefaultAzureCredential type; any other azure.core credential (ClientSecretCredential, ManagedIdentityCredential, UsernamePasswordCredential, ...) triggers ValueError('Only DefaultAzureCredential is supported'). The component system cannot round-trip credentials whose constructor parameters it does not know, so it refuses rather than emit a lossy config.","triggerScenarios":"Creating AzureTokenProvider(ClientSecretCredential(tenant_id, client_id, client_secret), scope) and then calling dump_component()/_to_config() — e.g. when persisting a workflow to config or when the runtime serializes components.","commonSituations":"Apps that already use service-principal secrets in non-Default environments (CI pipelines, apps without managed identity), attempting to save/export an agent graph containing the token provider.","solutions":["Use DefaultAzureCredential, which chains env vars, managed identity, az cli, etc.","For service principals, set AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET env vars so DefaultAzureCredential picks them up via EnvironmentCredential","If you must keep a custom credential, avoid dump_component()/serialization of that provider instance","Consider contributing a provider_kind for your credential type upstream"],"exampleFix":"# before\nfrom azure.identity import ClientSecretCredential\nprovider = AzureTokenProvider(ClientSecretCredential(tid, cid, secret), 'https://cognitiveservices.azure.com/.default')\nprovider.dump_component()  # ValueError\n\n# after\nfrom azure.identity import DefaultAzureCredential\n# export AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET first\nprovider = AzureTokenProvider(DefaultAzureCredential(), 'https://cognitiveservices.azure.com/.default')\nprovider.dump_component()","handlingStrategy":"type-guard","validationCode":"from azure.identity import DefaultAzureCredential\ndef serializable_provider(provider) -> bool:\n    return type(provider.credential) is DefaultAzureCredential","typeGuard":"from azure.identity import DefaultAzureCredential\nfrom autogen_ext.auth.azure import AzureTokenProvider\n\ndef uses_default_credential(provider: AzureTokenProvider) -> bool:\n    return isinstance(provider.credential, DefaultAzureCredential)","tryCatchPattern":"try:\n    cfg = provider.dump_component()\nexcept ValueError as e:\n    if 'Only DefaultAzureCredential' in str(e):\n        raise TypeError('rebuild provider with DefaultAzureCredential before serializing') from e\n    raise","preventionTips":["Standardize on DefaultAzureCredential; feed secrets via AZURE_* env vars","Gate dump_component() behind the isinstance check","Keep unserializable custom credentials out of persisted component graphs"],"tags":["azure","auth","component-serialization","configuration"],"backgroundTag":null,"analyzedSha":"027ecf0a379bcc1d09956d46d12d44a3ad9cee14","analyzedAt":"2026-08-15T03:38:00.719Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}