microsoft/autogen · error · ValueError

Only DefaultAzureCredential is supported

Error message

Only DefaultAzureCredential is supported

What it means

AzureTokenProvider._to_config() serializes the component's configuration but only supports the DefaultAzureCredential type; any other azure.core credential (ClientSecretCredential, ManagedIdentityCredential, UsernamePasswordCredential, ...) triggers ValueError('Only DefaultAzureCredential is supported'). The component system cannot round-trip credentials whose constructor parameters it does not know, so it refuses rather than emit a lossy config.

Source

Thrown at python/packages/autogen-ext/src/autogen_ext/auth/azure/__init__.py:40

        self.credential = credential
        self.scopes = list(scopes)
        self.provider = get_bearer_token_provider(self.credential, *self.scopes)

    def __call__(self) -> str:
        return self.provider()

    def _to_config(self) -> TokenProviderConfig:
        """Dump the configuration that would be requite to create a new instance of a component matching the configuration of this instance.

        Returns:
            T: The configuration of the component.
        """

        if isinstance(self.credential, DefaultAzureCredential):
            # NOTE: we are not currently inspecting the chained credentials, so this could result in a loss of information
            return TokenProviderConfig(provider_kind="DefaultAzureCredential", scopes=self.scopes)
        else:
            raise ValueError("Only DefaultAzureCredential is supported")

    @classmethod
    def _from_config(cls, config: TokenProviderConfig) -> Self:
        """Create a new instance of the component from a configuration object.

        Args:
            config (T): The configuration object.

        Returns:
            Self: The new instance of the component.
        """

        if config.provider_kind == "DefaultAzureCredential":
            return cls(DefaultAzureCredential(), *config.scopes)
        else:
            raise ValueError("Only DefaultAzureCredential is supported")

View on GitHub (pinned to 027ecf0a37)

Solutions

1. Use DefaultAzureCredential, which chains env vars, managed identity, az cli, etc.
2. For service principals, set AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET env vars so DefaultAzureCredential picks them up via EnvironmentCredential
3. If you must keep a custom credential, avoid dump_component()/serialization of that provider instance
4. Consider contributing a provider_kind for your credential type upstream

Example fix

# before
from azure.identity import ClientSecretCredential
provider = AzureTokenProvider(ClientSecretCredential(tid, cid, secret), 'https://cognitiveservices.azure.com/.default')
provider.dump_component()  # ValueError

# after
from azure.identity import DefaultAzureCredential
# export AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET first
provider = AzureTokenProvider(DefaultAzureCredential(), 'https://cognitiveservices.azure.com/.default')
provider.dump_component()

from azure.identity import DefaultAzureCredential
def serializable_provider(provider) -> bool:
    return type(provider.credential) is DefaultAzureCredential

from azure.identity import DefaultAzureCredential
from autogen_ext.auth.azure import AzureTokenProvider

def uses_default_credential(provider: AzureTokenProvider) -> bool:
    return isinstance(provider.credential, DefaultAzureCredential)

try:
    cfg = provider.dump_component()
except ValueError as e:
    if 'Only DefaultAzureCredential' in str(e):
        raise TypeError('rebuild provider with DefaultAzureCredential before serializing') from e
    raise

When it happens

Trigger: Creating AzureTokenProvider(ClientSecretCredential(tenant_id, client_id, client_secret), scope) and then calling dump_component()/_to_config() — e.g. when persisting a workflow to config or when the runtime serializes components.

Common situations: Apps that already use service-principal secrets in non-Default environments (CI pipelines, apps without managed identity), attempting to save/export an agent graph containing the token provider.

Related errors

• BING_API_KEY environment variable is not set
• Please set AZURE_OPENAI_API_KEY environment variable.
• Please set AZURE_OPENAI_ENDPOINT environment variable.
• Please set environment variable AZURE_OPENAI_API_KEY
• Description not initialized

AI-assisted analysis of microsoft/autogen@027ecf0a37 (2026-08-15). Data as JSON: /api/errors/95fa2ed7fc7092e6. Report an issue: GitHub.