{"record":{"id":"dae8db412c247f9c","repo":"BerriAI/litellm","slug":"azure-sentinel-client-secret-or-azure-client-secre","errorCode":null,"errorMessage":"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.","messagePattern":"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required\\. Set it as an environment variable or pass client_secret parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":121,"sourceCode":"\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name\n        self.endpoint = resolved_endpoint\n        self.tenant_id = resolved_tenant_id\n        self.client_id = resolved_client_id\n        self.client_secret = resolved_client_secret\n\n        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01\n        self.api_endpoint = self._build_api_endpoint(\n            endpoint=resolved_endpoint,\n            dcr_immutable_id=resolved_dcr_immutable_id,\n            stream_name=resolved_stream_name,\n        )\n        self.audit_api_endpoint = self._build_api_endpoint(","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/integrations/azure_sentinel/azure_sentinel.py#L103-L139","documentation":"AzureSentinelLogger.__init__ resolves the credential from the client_secret kwarg, AZURE_SENTINEL_CLIENT_SECRET, or the generic AZURE_CLIENT_SECRET fallback, and raises when none is set. This client is a pure client-secret flow — there is no managed-identity or certificate path here, so a secret must always be supplied.","triggerScenarios":"Enabling azure_sentinel with tenant and client id set but no secret; expecting DefaultAzureCredential / managed identity to cover it (it will not); an expired secret removed from env during rotation; pod secret volume not mounted in one environment.","commonSituations":"Secret expiry forcing rotation but the new value not propagated to the proxy deployment; using the secret's ID instead of its value; local runs where the dev relies on az cli auth that this integration does not use.","solutions":["Create a client secret on the app registration (Entra ID -> App registrations -> Certificates & secrets) and export AZURE_SENTINEL_CLIENT_SECRET=<secret VALUE, not its id>","Or pass client_secret=\"...\" to the constructor","Automate rotation: store in a vault and re-inject env on change, since expiry will surface as an auth failure later","If managed identity is required, this integration cannot supply it — use a different sink or contribute a credential-chain option"],"exampleFix":"// before\nexport AZURE_SENTINEL_TENANT_ID=...\nexport AZURE_SENTINEL_CLIENT_ID=...      # secret never set\n// after\nexport AZURE_SENTINEL_TENANT_ID=...\nexport AZURE_SENTINEL_CLIENT_ID=...\nexport AZURE_SENTINEL_CLIENT_SECRET=\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\"","handlingStrategy":"validation","validationCode":"import os\n\nif not (os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")):\n    raise RuntimeError(\"set AZURE_SENTINEL_CLIENT_SECRET to the secret VALUE (not its id)\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["This client is secret-only: no managed identity or cert path — plan rotation accordingly","Automate rotation from your vault and re-inject env; expiry otherwise surfaces as runtime 401s","Strip whitespace when loading secret values","Never assume DefaultAzureCredential covers this integration"],"tags":["azure-sentinel","client-secret","entra-id","litellm","configuration","missing-env-var"],"backgroundTag":"missing-env-var","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}