spring-projects/spring-ai · error · IllegalArgumentException

Microsoft Foundry was detected, but no credential was provid

Error message

Microsoft Foundry was detected, but no credential was provided. If you want to use passwordless authentication, you need to add the Azure Identity library (groupId=`com.azure`, artifactId=`azure-identity`) to your classpath.

What it means

azureAuthentication calls AzureInternalOpenAiHelper.getAzureCredential(), which requires the Azure Identity library on the classpath for passwordless (DefaultAzureCredential) authentication. When the JVM raises NoClassDefFoundError because azure-identity is absent, it is rethrown as an IllegalArgumentException explaining that Microsoft Foundry was detected but no credential is available.

Source

Thrown at models/spring-ai-openai/src/main/java/org/springframework/ai/openai/setup/OpenAiSetup.java:343

				throw new IllegalArgumentException("Base URL must be provided for Microsoft Foundry.");
			}
			String tmpUrl = baseUrl;
			if (baseUrl.endsWith("/") || baseUrl.endsWith("?")) {
				tmpUrl = baseUrl.substring(0, baseUrl.length() - 1);
			}
			return tmpUrl;
		}
		else {
			throw new IllegalArgumentException("Unknown model provider: " + modelProvider);
		}
	}

	static Credential azureAuthentication() {
		try {
			return AzureInternalOpenAiHelper.getAzureCredential();
		}
		catch (NoClassDefFoundError e) {
			throw new IllegalArgumentException("Microsoft Foundry was detected, but no credential was provided. "
					+ "If you want to use passwordless authentication, you need to add the Azure Identity library (groupId=`com.azure`, artifactId=`azure-identity`) to your classpath.");
		}
	}

	static @Nullable String detectApiKey(ModelProvider modelProvider) {
		if (modelProvider == ModelProvider.OPEN_AI && System.getenv(OPENAI_API_KEY) != null) {
			return System.getenv(OPENAI_API_KEY);
		}
		else if (modelProvider == ModelProvider.MICROSOFT_FOUNDRY && System.getenv(MICROSOFT_FOUNDRY_API_KEY) != null) {
			return System.getenv(MICROSOFT_FOUNDRY_API_KEY);
		}
		else if (modelProvider == ModelProvider.MICROSOFT_FOUNDRY && System.getenv(OPENAI_API_KEY) != null) {
			return System.getenv(OPENAI_API_KEY);
		}
		else if (modelProvider == ModelProvider.GITHUB_MODELS && System.getenv(GITHUB_TOKEN) != null) {
			return System.getenv(GITHUB_TOKEN);
		}
		return null;

View on GitHub (pinned to 98a7beda4f)

Solutions

1. Add the dependency com.azure:azure-identity to your build (e.g. implementation 'com.azure:azure-identity:1.x').
2. Alternatively provide an explicit API key / credential so passwordless DefaultAzureCredential resolution is not attempted.
3. Verify the packaged artifact (fat jar/container image) actually includes azure-identity classes.

Example fix

// before (Gradle)
dependencies { implementation 'org.springframework.ai:spring-ai-openai' }
// after
dependencies {
    implementation 'org.springframework.ai:spring-ai-openai'
    implementation 'com.azure:azure-identity:1.15.0'
}

try {
    Class.forName("com.azure.identity.DefaultAzureCredential");
} catch (ClassNotFoundException e) {
    throw new IllegalStateException("Add com.azure:azure-identity for Microsoft Foundry passwordless auth");
}

try {
    client = buildClient();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("azure-identity")) {
        throw new IllegalStateException("Missing azure-identity dependency or explicit credential", e);
    }
    throw e;
}

When it happens

Trigger: Configuring ModelProvider.MICROSOFT_FOUNDRY and calling azureAuthentication (via buildClientOptions) when com.azure:azure-identity is not on the runtime classpath and no explicit API key/credential is supplied.

Common situations: Using the light spring-ai starter that does not transitively pull azure-identity; a dependency-exclusion removed azure-identity; running a fat jar that omitted the optional dependency; expecting passwordless auth in production without adding the library.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to load default system message suffix from classpath
• Base URL must be provided for Microsoft Foundry.
• IOException (wrapped RuntimeException)
• ClassNotFoundException (wrapped RuntimeException)
• Failed to read resource

AI-assisted analysis of spring-projects/spring-ai@98a7beda4f (2026-09-11). Data as JSON: /api/errors/b59cad3f47675802. Report an issue: GitHub.