{"record":{"id":"dae8db412c247f9c","repo":"BerriAI/litellm","slug":"azure-sentinel-client-secret-or-azure-client-secre","errorCode":null,"errorMessage":"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.","messagePattern":"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required\\. Set it as an environment variable or pass client_secret parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":121,"sourceCode":"\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name\n        self.endpoint = resolved_endpoint\n        self.tenant_id = resolved_tenant_id\n        self.client_id = resolved_client_id\n        self.client_secret = resolved_client_secret\n\n        # Build API endpoint: {Endpoint}/dataCollectionRules/{DCR Immutable ID}/streams/{Stream Name}?api-version=2023-01-01\n        self.api_endpoint = self._build_api_endpoint(\n            endpoint=resolved_endpoint,\n            dcr_immutable_id=resolved_dcr_immutable_id,\n            stream_name=resolved_stream_name,\n        )\n        self.audit_api_endpoint = self._build_api_endpoint(","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/integrations/azure_sentinel/azure_sentinel.py#L103-L139","documentation":"The final required Azure Sentinel credential: the service principal's client secret. It is resolved from the client_secret parameter, AZURE_SENTINEL_CLIENT_SECRET, or generic AZURE_CLIENT_SECRET; if empty, init raises ValueError. Note the message is slightly misleading — the parameter name is client_secret while the message says client_secret parameter too, but it also accepts the AZURE_CLIENT_SECRET fallback.","triggerScenarios":"Constructing AzureSentinelLogger without client_secret and without AZURE_SENTINEL_CLIENT_SECRET/AZURE_CLIENT_SECRET; secret stored in a vault but never exported to the runtime env; cert-based credential intended but unsupported by this logger.","commonSituations":"Expired client secret ( Azure shows secrets with expiry; an expired secret yields a later auth error, but a never-configured one yields this error first); secret injected into CI but not the runtime container; copy-paste captured whitespace or quotes around the value making it effectively empty after shell parsing.","solutions":["Create a client secret on the app registration (Entra ID > App registrations > Certificates & secrets) and export AZURE_SENTINEL_CLIENT_SECRET (or pass client_secret=...)","If using a secret vault, wire it to inject the env var at container start","Check for expiry date on the secret and set a rotation reminder","Verify no trailing whitespace/newline in the exported value"],"exampleFix":"# before\nAzureSentinelLogger(dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t, client_id=c)  # no secret\n\n# after\nAzureSentinelLogger(\n    dcr_immutable_id=dcr_id, endpoint=url, tenant_id=t, client_id=c,\n    client_secret=\"~F8Q...generated-secret...\",\n)","handlingStrategy":"validation","validationCode":"import os\n\nsecret = os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")\nif not secret:\n    raise RuntimeError(\"Set AZURE_SENTINEL_CLIENT_SECRET (or AZURE_CLIENT_SECRET) to the app registration's client secret\")","typeGuard":"def is_non_empty_secret(v: str | None) -> bool:\n    return isinstance(v, str) and v.strip() != \"\"","tryCatchPattern":"try:\n    AzureSentinelLogger()\nexcept ValueError as e:\n    if \"CLIENT_SECRET\" in str(e):\n        raise SystemExit(\"Azure Sentinel needs a client secret; cert auth is not supported\") from e\n    raise","preventionTips":["Track client secret expiry dates and rotate before expiry","Strip whitespace when loading secrets from env or vault","This logger supports secrets only — do not attempt certificate credentials","Combine with the other four Sentinel vars in one startup check"],"tags":["azure","azure-sentinel","secrets","environment-variables","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}