{"record":{"id":"e34ed3e4fc968b96","repo":"mastra-ai/mastra","slug":"azure-management-credentials-missing","errorCode":"AZURE_MANAGEMENT_CREDENTIALS_MISSING","errorMessage":"Management credentials incomplete. Missing: ${missing.join(', ')}. Required fields: tenantId, clientId, clientSecret, subscriptionId, resourceGroup.","messagePattern":"Management credentials incomplete\\. Missing: (.+?)\\. Required fields: tenantId, clientId, clientSecret, subscriptionId, resourceGroup\\.","errorType":"validation","errorClass":"MastraError","httpStatus":null,"severity":"error","filePath":"packages/core/src/llm/model/gateways/azure.ts","lineNumber":341,"sourceCode":"          docUrl: 'https://learn.microsoft.com/en-us/azure/ai-services/openai/',\n          gateway: 'azure-openai',\n        },\n      };\n    }\n  }\n\n  private getManagementCredentials(management: NonNullable<AzureOpenAIGatewayConfig['management']>) {\n    const { tenantId, clientId, clientSecret, subscriptionId, resourceGroup } = management;\n\n    const missing = [];\n    if (!tenantId) missing.push('tenantId');\n    if (!clientId) missing.push('clientId');\n    if (!clientSecret) missing.push('clientSecret');\n    if (!subscriptionId) missing.push('subscriptionId');\n    if (!resourceGroup) missing.push('resourceGroup');\n\n    if (missing.length > 0) {\n      throw new MastraError({\n        id: 'AZURE_MANAGEMENT_CREDENTIALS_MISSING',\n        domain: 'LLM',\n        category: 'UNKNOWN',\n        text: `Management credentials incomplete. Missing: ${missing.join(', ')}. Required fields: tenantId, clientId, clientSecret, subscriptionId, resourceGroup.`,\n      });\n    }\n\n    return {\n      tenantId,\n      clientId,\n      clientSecret,\n      subscriptionId,\n      resourceGroup,\n    };\n  }\n\n  private async getAzureADToken(credentials: {\n    tenantId: string;","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/core/src/llm/model/gateways/azure.ts#L323-L359","documentation":"getManagementCredentials requires all five Azure management-plane credential fields (tenantId, clientId, clientSecret, subscriptionId, resourceGroup) and throws listing exactly which are missing. It is invoked from validateConfig and the credentials accessor, so it surfaces when management features are used with an incomplete config.management object.","triggerScenarios":"Constructing the gateway with a partial management object, or loading management credentials from env vars where one or more of tenantId/clientId/clientSecret/subscriptionId/resourceGroup is undefined or empty — the missing list is included in the message.","commonSituations":"Partially filled .env files; typos in env var names (e.g. AZURE_SUBSCRIPTION_ID unset); copying a management config from another Azure app without updating subscriptionId/resourceGroup; secrets manager returning empty strings for unset keys.","solutions":["Read the error message and provide every listed missing field in config.management.","Verify each env var is set and non-empty in the runtime environment before constructing the gateway.","Confirm subscriptionId and resourceGroup match the Azure OpenAI resource you intend to query (az account show / az resource list).","If management features are not needed, remove the partial management object entirely instead of passing an incomplete one."],"exampleFix":"// before\nmanagement: { tenantId: process.env.AZURE_TENANT_ID, clientId: process.env.AZURE_CLIENT_ID, clientSecret: process.env.AZURE_CLIENT_SECRET }\n// after\nmanagement: { tenantId: process.env.AZURE_TENANT_ID!, clientId: process.env.AZURE_CLIENT_ID!, clientSecret: process.env.AZURE_CLIENT_SECRET!, subscriptionId: process.env.AZURE_SUBSCRIPTION_ID!, resourceGroup: process.env.AZURE_RESOURCE_GROUP! }","handlingStrategy":"validation","validationCode":"const REQUIRED = ['tenantId','clientId','clientSecret','subscriptionId','resourceGroup'] as const;\nfunction managementCredsComplete(m?: Record<string,string|undefined>) {\n  const missing = REQUIRED.filter(k => !m?.[k]);\n  if (missing.length) throw new Error(`Missing management credentials: ${missing.join(', ')}`);\n}\nmanagementCredsComplete(process.env);","typeGuard":"function hasManagementConfig(m: unknown): m is { tenantId: string; clientId: string; clientSecret: string; subscriptionId: string; resourceGroup: string } {\n  return typeof m === 'object' && m !== null &&\n    ['tenantId','clientId','clientSecret','subscriptionId','resourceGroup'].every(k => typeof (m as any)[k] === 'string' && (m as any)[k].length > 0);\n}","tryCatchPattern":"try {\n  const creds = await gateway.getManagementCredentials();\n} catch (e) {\n  if (e instanceof MastraError && e.id === 'AZURE_MANAGEMENT_CREDENTIALS_MISSING') {\n    console.error('Set these fields:', e.message);\n  } else { throw e; }\n}","preventionTips":["List all five management env vars in .env.example and assert them at startup.","Fail fast with a config check before constructing the gateway when management features are required.","Omit the management object entirely if management features are not used, so partial configs never slip through.","Validate secret values are non-empty after loading from a secrets manager (empty strings count as missing)."],"tags":["azure","authentication","credentials","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}