Why do I need a tenant when using @azure/keyvault-keys with @azure/identity, but not when using azure-keyvault?

Question

I was using azure-keyvault but it's now deprecated. I'm using for encrypting and decrypting stuff. All I needed to operate was clientId, clientSecret and the key identifier.

Because now azure-keyvault is deprecated I switched to @azure/keyvault-keys / @azure/identity . For this I need a tenant ( ClientSecretCredential ) which I previously didn't need. Why is that or is there a way to not needing it?

Answer 1

When using a ClientSecretCredential , because a service principal belongs to a particular tenant, you have to specify that tenant rather than it coming back in a callback like the older code.

There are many different credential types, but our recommendation is to use DefaultAzureCredential which supports MSI, environment credentials (service principal using $AZURE_TENANT_ID , $AZURE_CLIENT_ID , and $AZURE_CLIENT_SECRET ), and interactive browser login for most languages - soon with more credentials like azure CLI and Visual Studio. With support for azure CLI, that provides parity with the older packages like you used and then some. Just by using DefaultAzureCredential you get all that and it supports different environments by default, so you don't have to change your code to use different credentials for dev, staging, or production environments.

So like in the referenced example, you just instantiate a DefaultAzureCredenial and thats it. If you have your service principal environment variables defined, they will be used if Managed Identity (MSI) wasn't detected.

import { SecretClient } from '@azure/keyvault-secrets';
import { DefaultAzureCredential } from '@azure/identity';
import { CosmosClient } from '@azure/cosmos';

const keyVaultUrl = process.env('APP_KEY_VAULT_URI');
const credential = new DefaultAzureCredential();
let storageClient;
let cosmosClient;

async function configureClients() {
    const kvClient = new SecretClient(keyVaultUrl, credential);
    const storageUri = await client.getSecret('storageUri');
    const cosmosDbConnectionString = await client.getSecret('cosmosDb');

    cosmosClient = new CosmosClient(cosmosDbConnectonString);
    storageClient = new BlobServiceClient(storageUri, credential);

The order of credentials is optimized for production workloads, but supports developer machines - pretty close to the order I listed them above.