foundry_token_azure_identity: Create a Microsoft Entra ID token provider using AzureAuth

In foundryR: Data Frame Workflows for 'Microsoft Foundry'

Create a Microsoft Entra ID token provider using AzureAuth

Description

Create a provider function for foundry_set_token_provider() that acquires Microsoft Entra ID access tokens through the AzureAuth package. This supports service principals (client secret or certificate), managed identity, and interactive or device-code flows, and refreshes tokens automatically as they approach expiry.

Usage

foundry_token_azure_identity(
  resource = "https://cognitiveservices.azure.com",
  tenant = Sys.getenv("AZURE_TENANT_ID"),
  app = Sys.getenv("AZURE_CLIENT_ID"),
  password = NULL,
  username = NULL,
  certificate = NULL,
  auth_type = NULL,
  managed_identity = FALSE,
  version = 1,
  ...
)

Arguments

resource	Character. The token audience. Defaults to "https://cognitiveservices.azure.com" for resource-level v1 and Content Safety APIs. Use "https://ai.azure.com" for project APIs and register the provider with scope = "project".
tenant	Character. Microsoft Entra ID tenant. Defaults to the AZURE_TENANT_ID environment variable. Ignored when managed_identity = TRUE.
app	Character. Application (client) ID. Defaults to the AZURE_CLIENT_ID environment variable. Ignored when managed_identity = TRUE.
password	Character or NULL. Client secret for a service principal, or the resource-owner password. NULL selects an interactive or device-code flow.
username	Character or NULL. Username for the resource-owner flow.
certificate	Character or NULL. Path to, or contents of, a certificate for certificate-based service-principal authentication.
auth_type	Character or NULL. Explicit AzureAuth authentication type. NULL lets AzureAuth choose based on the other arguments.
managed_identity	Logical. If TRUE, acquire a token from an Azure managed identity via AzureAuth::get_managed_token() and ignore tenant and app. Default FALSE.
version	Integer. Microsoft Entra ID endpoint version, 1 or 2. Default 1, matching the resource-style resource above.
...	Additional arguments passed to AzureAuth::get_azure_token() or AzureAuth::get_managed_token().

Details

The token is acquired lazily on first use, so building the provider never triggers a network call. Tokens are re-acquired within five minutes of expiry; AzureAuth reuses its on-disk cache and refresh tokens under the hood, so re-acquisition is inexpensive and does not re-prompt for interactive flows.

Value

A zero-argument token provider function suitable for foundry_set_token_provider().

See Also

foundry_token_azure_cli() for a provider that shells out to the Azure CLI instead.

Examples

# Creating providers is local: no tokens are acquired or credentials checked.
provider <- foundry_token_azure_identity(
  tenant = "example-tenant-id",
  app = "example-client-id",
  password = "example-client-secret-not-a-secret"
)
is.function(provider)

# A managed-identity provider acquires tokens only when called inside Azure.
managed_provider <- foundry_token_azure_identity(managed_identity = TRUE)
is.function(managed_provider)

# Register this provider with scope = "project" for project APIs.
project_provider <- foundry_token_azure_identity(
  resource = "https://ai.azure.com",
  managed_identity = TRUE
)
is.function(project_provider)

foundryR documentation built on Sept. 25, 2026, 1:10 a.m.