Most of what I write about Azure comes down to one question: how does my .NET application prove who it is? This page puts my Azure posts in reading order and answers the questions I get most often.
What Is DefaultAzureCredential?
DefaultAzureCredential is a credential class in the Azure.Identity library for .NET. It holds a fixed list of other credential types and tries them one at a time (environment variables, workload identity, managed identity, Visual Studio, the Azure CLI and more) until one of them gets an access token from Entra ID. That is why the same line of code works both on your developer machine and in Azure.
All these classes inherit from TokenCredential, the abstract base class that Azure SDK clients such as BlobServiceClient and SecretClient take when you create them. You can pass any of them, but DefaultAzureCredential saves you from picking one per environment.
What Is a Managed Identity?
A managed identity is an identity in Entra ID that Azure creates and manages for a resource, such as an App Service. Your application uses it to get tokens for other Azure services, so you don't need to store a password or key for that in your configuration. There are two kinds:
- A system-assigned identity is created together with the resource, belongs only to that resource, and is deleted with it.
- A user-assigned identity is a separate resource that you create yourself. You can assign it to several resources, and you manage its lifecycle.
In code, ManagedIdentityCredential gets the token. It is also one of the credentials that DefaultAzureCredential tries.
Why I Write About Azure
DefaultAzureCredential is a good example of why I dig into things. From the outside, it just works. On the inside, a lot is going on, and you need to understand those tradeoffs, for example which credential it picks and how long it takes when it finds nothing. So I downloaded the Azure Identity source code, turned it into my own class library and added logging to see what it actually does. That work became the post below, and later the talk The .NET Developer's Guide to Azure TokenCredentials, which I gave at Øredev in 2025.
I also built the Cloud Debugger for Azure, an open-source tool for exploring Azure services from the inside. I created it as part of my Azure training workshop, so that developers get hands-on exercises against real Azure services instead of only theory. It started while I studied for the AZ-204 Azure Developer certification, where I felt that the included exercises were not enough to really understand the services.
What Goes Wrong in Practice
These are problems I have run into myself. Each one has a post below.
- DefaultAzureCredential picks a credential you didn't expect. On a developer machine with several logins (Visual Studio, the Azure CLI, environment variables), the wrong one can win, and it is not easy to see which one it used.
- It is slow when it finds nothing. On a machine without credentials, it takes 3 to 8 seconds to try every type before it throws an exception.
- A new credential for every client. The credential caches the access token, so create one instance and share it between your clients.
- The tenant is missing. Many credential problems come down to a missing
TenantId. You can set it in the credential options or in an environment variable. - App Service can't pull the image from Azure Container Registry. A container App Service has two identity settings: the identity of the app, and the identity it uses to pull from the registry.
az webapp createcan't set the second one, and the commands in the documentation didn't work for me. - SAS tokens are signed with the account key. If that key leaks, every SAS token signed with it is compromised. A user delegation SAS is signed with a key the application gets from Entra ID with its own identity.
- Docker won't start in a new Azure Windows VM. Trusted Launch is the default security type, and it turns off virtualization inside the VM.
Start Here
1. Authenticate to Azure from .NET
- DefaultAzureCredentials Under the Hood: what TokenCredential and DefaultAzureCredential do, why it can be slow, how to see which credential it used, and when ChainedTokenCredential is the better choice.
2. Explore Azure with the Cloud Debugger
- Introducing the Cloud Debugger for Azure: my open-source tool with over 30 small tools for App Service, storage, messaging and identity. You deploy it to Azure and see what DefaultAzureCredential, token caching, user delegation SAS tokens and the other services do. I built it for my Azure workshop, and it works just as well on your own.
3. Managed identities and containers
Read these two in order. The first one does the full setup and runs into the problems. The second shows how much simpler it gets with a system-assigned identity.
- Deploy containers to Azure App Services using user-assigned managed identity: a container from a private Azure Container Registry, deployed with the Azure CLI and PowerShell, and how to fix the image pull.
- Deploy Container to Azure App Services with System-Assigned Identity: the same deployment with a system-assigned identity, and how the two identity types differ.
4. Storage access without account keys
- User Delegation SAS Tokens In Azure Explained: why SAS tokens signed with account keys are risky, and how an application issues its own SAS tokens with a managed identity.
5. Keys in Azure Key Vault
- Persisting the ASP.NET Core Data Protection Key Ring in Azure Key Vault: store the key ring that protects your ASP.NET Core cookies in Key Vault, and the secret size limit to plan for.
6. Azure in practice
- Running Docker in an Azure Windows Virtual Machine – Not so fast!: why Docker wouldn't start, and the VM setting behind it.
- How to Use KurrentDB for Event Sourcing in C# on Azure: a test KurrentDB in Azure Container Instances, used from C#.
Frequently Asked Questions
What is the difference between DefaultAzureCredential and ChainedTokenCredential?
Both try a list of credentials in order. DefaultAzureCredential comes with a fixed list. ChainedTokenCredential starts empty, and you add only the credentials you need, in the order you want. In production, that gives you full control over which credentials can be used.
Why is DefaultAzureCredential slow?
When it can't find any credentials, it tries every type in its list before it gives up, which takes 3 to 8 seconds. You can turn off the types you don't use with DefaultAzureCredentialOptions, for example ExcludeAzureCliCredential. Reuse one instance as well, so its token cache does its job.
How do I know which credential DefaultAzureCredential used?
Turn on the Azure SDK logging with AzureEventSourceListener and read the events. In DefaultAzureCredentials Under the Hood I also show a reflection hack that reads the selected credential from a private field. The Cloud Debugger can help here too.
What is the difference between a system-assigned and a user-assigned managed identity?
A system-assigned identity is created with the resource and deleted with it. A user-assigned identity is a resource of its own: you create it, you can give it to several resources, and it lives until you delete it. System-assigned is the simpler choice. User-assigned fits when several resources should share one identity, or when the identity must outlive the resource.
Why can't my App Service pull my container image from ACR with a managed identity?
Most often because the registry pull has its own identity setting, separate from the app's identity. Check that acrUseManagedIdentityCreds is true, that acrUserManagedIdentityID holds the client ID of your identity, and that the identity has the AcrPull role on the registry. Also give it time: the first pull can show an error page for 2 to 5 minutes before the container starts.
What is a user delegation SAS token?
It is a SAS token that your application signs with a user delegation key from Entra ID, instead of with the storage account key. The application gets the key with its own identity, and a token can never give more access than the application itself has. It only works with Blob Storage.
Want to Go Further?
I teach Azure to .NET developers in my workshop Introduction to Azure for Developers, where the exercises run on the Cloud Debugger. My Azure talks, including The .NET Developer's Guide to Azure TokenCredentials, are on tn-data.se.
If your team needs help with Azure and .NET, you can hire me.
