mastra-ai/mastra · error · MastraError

AZURE_MANAGEMENT_CREDENTIALS_MISSING

AZURE_MANAGEMENT_CREDENTIALS_MISSING

Error message

Management credentials incomplete. Missing: ${missing.join(', ')}. Required fields: tenantId, clientId, clientSecret, subscriptionId, resourceGroup.

What it means

getManagementCredentials requires all five Azure management-plane credential fields (tenantId, clientId, clientSecret, subscriptionId, resourceGroup) and throws listing exactly which are missing. It is invoked from validateConfig and the credentials accessor, so it surfaces when management features are used with an incomplete config.management object.

Source

Thrown at packages/core/src/llm/model/gateways/azure.ts:341

          docUrl: 'https://learn.microsoft.com/en-us/azure/ai-services/openai/',
          gateway: 'azure-openai',
        },
      };
    }
  }

  private getManagementCredentials(management: NonNullable<AzureOpenAIGatewayConfig['management']>) {
    const { tenantId, clientId, clientSecret, subscriptionId, resourceGroup } = management;

    const missing = [];
    if (!tenantId) missing.push('tenantId');
    if (!clientId) missing.push('clientId');
    if (!clientSecret) missing.push('clientSecret');
    if (!subscriptionId) missing.push('subscriptionId');
    if (!resourceGroup) missing.push('resourceGroup');

    if (missing.length > 0) {
      throw new MastraError({
        id: 'AZURE_MANAGEMENT_CREDENTIALS_MISSING',
        domain: 'LLM',
        category: 'UNKNOWN',
        text: `Management credentials incomplete. Missing: ${missing.join(', ')}. Required fields: tenantId, clientId, clientSecret, subscriptionId, resourceGroup.`,
      });
    }

    return {
      tenantId,
      clientId,
      clientSecret,
      subscriptionId,
      resourceGroup,
    };
  }

  private async getAzureADToken(credentials: {
    tenantId: string;

View on GitHub (pinned to 75dd419e61)

Solutions

Read the error message and provide every listed missing field in config.management.
Verify each env var is set and non-empty in the runtime environment before constructing the gateway.
Confirm subscriptionId and resourceGroup match the Azure OpenAI resource you intend to query (az account show / az resource list).
If management features are not needed, remove the partial management object entirely instead of passing an incomplete one.

Example fix

// before
management: { tenantId: process.env.AZURE_TENANT_ID, clientId: process.env.AZURE_CLIENT_ID, clientSecret: process.env.AZURE_CLIENT_SECRET }
// after
management: { tenantId: process.env.AZURE_TENANT_ID!, clientId: process.env.AZURE_CLIENT_ID!, clientSecret: process.env.AZURE_CLIENT_SECRET!, subscriptionId: process.env.AZURE_SUBSCRIPTION_ID!, resourceGroup: process.env.AZURE_RESOURCE_GROUP! }

Defensive patterns

Strategy: validation

Validate before calling

const REQUIRED = ['tenantId','clientId','clientSecret','subscriptionId','resourceGroup'] as const;
function managementCredsComplete(m?: Record<string,string|undefined>) {
  const missing = REQUIRED.filter(k => !m?.[k]);
  if (missing.length) throw new Error(`Missing management credentials: ${missing.join(', ')}`);
}
managementCredsComplete(process.env);

Type guard

function hasManagementConfig(m: unknown): m is { tenantId: string; clientId: string; clientSecret: string; subscriptionId: string; resourceGroup: string } {
  return typeof m === 'object' && m !== null &&
    ['tenantId','clientId','clientSecret','subscriptionId','resourceGroup'].every(k => typeof (m as any)[k] === 'string' && (m as any)[k].length > 0);
}

Try / catch

try {
  const creds = await gateway.getManagementCredentials();
} catch (e) {
  if (e instanceof MastraError && e.id === 'AZURE_MANAGEMENT_CREDENTIALS_MISSING') {
    console.error('Set these fields:', e.message);
  } else { throw e; }
}

Prevention

List all five management env vars in .env.example and assert them at startup.
Fail fast with a config check before constructing the gateway when management features are required.
Omit the management object entirely if management features are not used, so partial configs never slip through.
Validate secret values are non-empty after loading from a secrets manager (empty strings count as missing).

When it happens

Trigger: Constructing the gateway with a partial management object, or loading management credentials from env vars where one or more of tenantId/clientId/clientSecret/subscriptionId/resourceGroup is undefined or empty — the missing list is included in the message.

Common situations: Partially filled .env files; typos in env var names (e.g. AZURE_SUBSCRIPTION_ID unset); copying a management config from another Azure app without updating subscriptionId/resourceGroup; secrets manager returning empty strings for unset keys.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/e34ed3e4fc968b96. Report an issue: GitHub.