Getting Unhandled exception when using Environment variable for DefaultAzureCredential

Question

Getting Unhandled exception when using Environment variable for DefaultAzureCredential

Jayapriya J 0 Microsoft Employee

We have implemented the best practices or Default Azure Credentials like below to make it work seamlessly for both development and production environment. But after deployment we are getting the following error even though the Environment variables is present for both staging and production function apps. Please help to resolve the issue.

var defaultAzureCredential = new DefaultAzureCredential(DefaultAzureCredential.DefaultEnvironmentVariableName);

Unhandled exception. System.InvalidOperationException: Environment variable 'AZURE_TOKEN_CREDENTIALS' is not set or is empty. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot

Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-04T11:44:09.63+00:00

Hello Jayapriya J,

Could you please share your authentication method?
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-06T15:02:27.1733333+00:00

Hello Jayapriya J,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Jayapriya J 0 Reputation points Microsoft Employee

2025-11-10T07:56:00.1766667+00:00

As mentioned in the query ,we are using this credential to connect to other azure resources. var defaultAzureCredential = new DefaultAzureCredential(DefaultAzureCredential.DefaultEnvironmentVariableName); As per the environment variable it picks up the appropriate credentials . In deployed environment we have used 'managedidentitycredential'. Reference - https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/credential-chains?tabs=dac#usage-guidance-for-defaultazurecredential
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-10T09:44:13.1466667+00:00
Hello Jayapriya J,

The issue is caused by how you are instantiating DefaultAzureCredential. Passing DefaultAzureCredential.DefaultEnvironmentVariableName is not the intended usage—it forces the credential chain to look for a non-standard variable (AZURE_TOKEN_CREDENTIALS).

Environment variable 'AZURE_TOKEN_CREDENTIALS' is not set or is empty.

DefaultAzureCredential is designed to automatically try multiple credential sources in a specific order:

EnvironmentCredential (requires AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET)

ManagedIdentityCredential (when running in Azure with Managed Identity enabled)

Developer tools (Azure CLI, Visual Studio, etc.)

By passing DefaultAzureCredential.DefaultEnvironmentVariableName, you override the default behavior and force it to look for a single variable that is not part of the documented chain.

Please use follow below suggestion.

var defaultAzureCredential = new DefaultAzureCredential();

Checklist for Deployment

Enable Managed Identity in your Function App (System-assigned or User-assigned).

Assign appropriate RBAC roles to that identity for the resources you want to access.

Do NOT set custom environment variables like AZURE_TOKEN_CREDENTIALS—they are not used by the SDK.

If you need service principal authentication in staging/prod (instead of Managed Identity), set:

AZURE_CLIENT_ID

AZURE_TENANT_ID

AZURE_CLIENT_SECRET

Please follow above suggested steps and let me know with an update.
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-18T02:41:30.25+00:00

Hello Jayapriya J,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-04T11:44:09.63+00:00

Hello Jayapriya J,

Could you please share your authentication method?
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-06T15:02:27.1733333+00:00

Hello Jayapriya J,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Jayapriya J 0 Reputation points Microsoft Employee

2025-11-10T07:56:00.1766667+00:00

As mentioned in the query ,we are using this credential to connect to other azure resources. var defaultAzureCredential = new DefaultAzureCredential(DefaultAzureCredential.DefaultEnvironmentVariableName); As per the environment variable it picks up the appropriate credentials . In deployed environment we have used 'managedidentitycredential'. Reference - https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/credential-chains?tabs=dac#usage-guidance-for-defaultazurecredential
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-10T09:44:13.1466667+00:00

Hello Jayapriya J,

The issue is caused by how you are instantiating DefaultAzureCredential. Passing DefaultAzureCredential.DefaultEnvironmentVariableName is not the intended usage—it forces the credential chain to look for a non-standard variable (AZURE_TOKEN_CREDENTIALS).

Environment variable 'AZURE_TOKEN_CREDENTIALS' is not set or is empty.

DefaultAzureCredential is designed to automatically try multiple credential sources in a specific order:

EnvironmentCredential (requires AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET)

ManagedIdentityCredential (when running in Azure with Managed Identity enabled)

Developer tools (Azure CLI, Visual Studio, etc.)

By passing DefaultAzureCredential.DefaultEnvironmentVariableName, you override the default behavior and force it to look for a single variable that is not part of the documented chain.

Please use follow below suggestion.

var defaultAzureCredential = new DefaultAzureCredential();

Checklist for Deployment

Enable Managed Identity in your Function App (System-assigned or User-assigned).

Assign appropriate RBAC roles to that identity for the resources you want to access.

Do NOT set custom environment variables like AZURE_TOKEN_CREDENTIALS—they are not used by the SDK.

If you need service principal authentication in staging/prod (instead of Managed Identity), set:

AZURE_CLIENT_ID

AZURE_TENANT_ID

AZURE_CLIENT_SECRET

Please follow above suggested steps and let me know with an update.
Praveen Kumar Gudipudi 2,195 Reputation points Microsoft External Staff Moderator

2025-11-18T02:41:30.25+00:00

Hello Jayapriya J,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Hello Jayapriya J,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are getting Unhandled exception when using Environment variable for DefaultAzureCredential.

The issue you're having was NOT environment variables but incorrect constructor usage of DefaultAzureCredential

Replace: var defaultAzureCredential = new DefaultAzureCredential(DefaultAzureCredential.DefaultEnvironmentVariableName);

with: var defaultAzureCredential = new DefaultAzureCredential();

Also, avoid: Setting AZURE_TOKEN_CREDENTIALS, over-configuring credentials, and mixing credential types unnecessarily, If environment variables are required, ensure these are set (only if using EnvironmentCredential explicitly):

AZURE_CLIENT_ID
AZURE_TENANT_ID
AZURE_CLIENT_SECRET

https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/azure-iis-errors-reference

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Getting Unhandled exception when using Environment variable for DefaultAzureCredential

Checklist for Deployment

1 answer

Your answer