Migrate an application to use passwordless connections with Azure Service Bus

await using ServiceBusClient client = new("<CONNECTION-STRING>");

client, err := azservicebus.NewClientFromConnectionString(
    "<CONNECTION-STRING>",
    nil)

if err != nil {
    // handle error
}

JMS:

ConnectionFactory factory = new ServiceBusJmsConnectionFactory(
    "<CONNECTION-STRING>",
    new ServiceBusJmsConnectionFactorySettings());

Receiver client:

ServiceBusReceiverClient receiver = new ServiceBusClientBuilder()
    .connectionString("<CONNECTION-STRING>")
    .receiver()
    .topicName("<TOPIC-NAME>")
    .subscriptionName("<SUBSCRIPTION-NAME>")
    .buildClient();

Sender client:

ServiceBusSenderClient client = new ServiceBusClientBuilder()
    .connectionString("<CONNECTION-STRING>")
    .sender()
    .queueName("<QUEUE-NAME>")
    .buildClient();

const client = new ServiceBusClient("<CONNECTION-STRING>");

client = ServiceBusClient(
    fully_qualified_namespace = "<CONNECTION-STRING>"
)

1. In the Azure portal, locate your Service Bus namespace using the main search bar or left navigation.

2. On the Service Bus overview page, select Access control (IAM) from the left-hand menu.

3. On the Access control (IAM) page, select the Role assignments tab.

4. Select + Add from the top menu and then Add role assignment from the resulting drop-down menu.

   

5. Use the search box to filter the results to the desired role. For this example, search for Azure Service Bus Data Owner and select the matching result and then choose Next.

6. Under Assign access to, select User, group, or service principal, and then choose + Select members.

7. In the dialog, search for your Microsoft Entra username (usually your user@domain email address) and then choose Select at the bottom of the dialog.

8. Select Review + assign to go to the final page, and then Review + assign again to complete the process.

To assign a role at the resource level using the Azure CLI, you first must retrieve the resource ID using the az servicesbus namespace show command. You can filter the output properties using the --query parameter.

az servicebus namespace show --resource-group '<your-resource-group-name>' --name '<your-service-bus-namespace>' --query id

Copy the output ID from the preceding command. You can then assign roles using the az role command of the Azure CLI.

az role assignment create --assignee "<user@domain>" \
    --role "Azure Service Bus Data Owner" \
    --scope "<your-resource-id>"

To assign a role at the resource level using Azure PowerShell, you first must retrieve the resource ID using the Get-AzResource command.

Get-AzResource -ResourceGroupName "<yourResourceGroupname>" -Name "<yourServiceBusName>"

Copy the ID value from the preceding command output. You can then assign roles using the New-AzRoleAssignment command in PowerShell.

New-AzRoleAssignment -SignInName <user@domain> `
    -RoleDefinitionName "Azure Service Bus Data Owner" `
    -Scope <yourServiceBusId>

Sign-in to Azure through the Azure CLI using the following command:

az login

Select the Sign in button in the top right of Visual Studio.

Sign-in using the Microsoft Entra account you assigned a role to previously.

You will need to install the Azure CLI to work with DefaultAzureCredential through Visual Studio Code.

On the main menu of Visual Studio Code, navigate to Terminal > New Terminal.

Sign-in to Azure through the Azure CLI using the following command:

az login

Sign-in to Azure using PowerShell via the following command:

Connect-AzAccount

1. To use DefaultAzureCredential in a .NET application, install the Azure.Identity package:

   dotnet add package Azure.Identity
   

2. At the top of your file, add the following code:

   using Azure.Identity;
   

3. Identify the code that creates a ServiceBusClient object to connect to Azure Service Bus. Update your code to match the following example:

    var serviceBusNamespace = $"{namespace}.servicebus.windows.net";
    ServiceBusClient client = new(
        serviceBusNamespace,
        new DefaultAzureCredential());
   

1. To use DefaultAzureCredential in a Go application, install the azidentity module:

   go get -u github.com/Azure/azure-sdk-for-go/sdk/azidentity
   

2. At the top of your file, add the following code:

   import (
       "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
   )
   

3. Identify the locations in your code that create a Client instance to connect to Azure Service Bus. Update your code to match the following example:

   credential, err := azidentity.NewDefaultAzureCredential(nil)
   
   if err != nil {
       // handle error
   }
   
   serviceBusNamespace := fmt.Sprintf(
       "%s.servicebus.windows.net",
       namespace)
   client, err := azservicebus.NewClient(serviceBusNamespace, credential, nil)
   
   if err != nil {
       // handle error
   }
   

1. To use DefaultAzureCredential:

   • In a JMS application, add at least version 1.0.0 of the azure-servicebus-jms package to your application:

     <dependency>
         <groupId>com.microsoft.azure</groupId>
         <artifactId>azure-servicebus-jms</artifactId>
         <version>1.0.0</version>
     </dependency>
     

   • In a Java application, install the azure-identity package via one of the following approaches:

     • Include the BOM file.
     • Include a direct dependency.

2. At the top of your file, add the following code:

   import com.azure.identity.DefaultAzureCredentialBuilder;
   

3. Update the code that connects to Azure Service Bus:

   • In a JMS application, identify the code that creates a ServiceBusJmsConnectionFactory object to connect to Azure Service Bus. Update your code to match the following example:

      DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
          .build();
      String serviceBusNamespace = 
          namespace + ".servicebus.windows.net";
     
      ConnectionFactory factory = new ServiceBusJmsConnectionFactory(
          credential,
          serviceBusNamespace,
          new ServiceBusJmsConnectionFactorySettings());
     

   • In a Java application, identify the code that creates a Service Bus sender or receiver client object to connect to Azure Service Bus. Update your code to match one of the following examples:

     Receiver client:

     DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
         .build();
     String serviceBusNamespace = 
         namespace + ".servicebus.windows.net";
     
     ServiceBusReceiverClient receiver = new ServiceBusClientBuilder()
         .credential(serviceBusNamespace, credential)
         .receiver()
         .topicName("<TOPIC-NAME>")
         .subscriptionName("<SUBSCRIPTION-NAME>")
         .buildClient();
     

     Sender client:

     DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
         .build();
     String serviceBusNamespace = 
         namespace + ".servicebus.windows.net";
     
     ServiceBusSenderClient client = new ServiceBusClientBuilder()
         .credential(serviceBusNamespace, credential)
         .sender()
         .queueName("<QUEUE-NAME>")
         .buildClient();
     

1. To use DefaultAzureCredential in a Node.js application, install the @azure/identity package:

   npm install --save @azure/identity
   

2. At the top of your file, add the following code:

   const { DefaultAzureCredential } = require("@azure/identity");
   

3. Identify the code that creates a ServiceBusClient object to connect to Azure Service Bus. Update your code to match the following example:

   const credential = new DefaultAzureCredential();
   const serviceBusNamespace = `${namespace}.servicebus.windows.net`;    
   
   const client = new ServiceBusClient(
     serviceBusNamespace,
     credential
   );
   

1. To use DefaultAzureCredential in a Python application, install the azure-identity package:

   pip install azure-identity
   

2. At the top of your file, add the following code:

   from azure.identity import DefaultAzureCredential
   

3. Identify the code that creates a ServiceBusClient object to connect to Azure Service Bus. Update your code to match the following example:

   credential = DefaultAzureCredential()
   service_bus_namespace = "%s.servicebus.windows.net" % namespace
   
   client = ServiceBusClient(
       fully_qualified_namespace = service_bus_namespace,
       credential = credential
   )
   

Some app hosting environments support Service Connector, which helps you connect Azure compute services to other backing services. Service Connector automatically configures network settings and connection information. You can learn more about Service Connector and which scenarios are supported on the overview page.

The following compute services are currently supported:

• Azure App Service
• Azure Spring Cloud
• Azure Container Apps (preview)

For this migration guide you'll use App Service, but the steps are similar on Azure Spring Apps and Azure Container Apps.

1. On the main overview page of your App Service, select Service Connector from the left navigation.

2. Select + Create from the top menu and the Create connection panel will open. Enter the following values:

   • Service type: Choose Service bus.
   • Subscription: Select the subscription you would like to use.
   • Connection Name: Enter a name for your connection, such as connector_appservice_servicebus.
   • Client type: Leave the default value selected or choose the specific client you'd like to use.

   Select Next: Authentication.

3. Make sure System assigned managed identity (Recommended) is selected, and then choose Next: Networking.

4. Leave the default values selected, and then choose Next: Review + Create.

5. After Azure validates your settings, select Create.

The Service Connector will automatically create a system-assigned managed identity for the app service. The connector will also assign the managed identity a Azure Service Bus Data Owner role for the service bus you selected.

1. On the main overview page of your Azure App Service instance, select Identity from the left navigation.

2. Under the System assigned tab, make sure to set the Status field to on. A system assigned identity is managed by Azure internally and handles administrative tasks for you. The details and IDs of the identity are never exposed in your code.

   

1. On the main overview page of your Azure Spring Apps instance, select Identity from the left navigation.

2. Under the System assigned tab, make sure to set the Status field to on. A system assigned identity is managed by Azure internally and handles administrative tasks for you. The details and IDs of the identity are never exposed in your code.

   

1. On the main overview page of your Azure Container Apps instance, select Identity from the left navigation.

2. Under the System assigned tab, make sure to set the Status field to on. A system assigned identity is managed by Azure internally and handles administrative tasks for you. The details and IDs of the identity are never exposed in your code.

   

1. On the main overview page of your virtual machine, select Identity from the left navigation.

2. Under the System assigned tab, make sure to set the Status field to on. A system assigned identity is managed by Azure internally and handles administrative tasks for you. The details and IDs of the identity are never exposed in your code.

   

You can use Service Connector to create a connection between an Azure compute hosting environment and a target service using the Azure CLI. The CLI automatically handles creating a managed identity and assigns the proper role, as explained in the portal instructions.

If you're using an Azure App Service, use the az webapp connection command:

az webapp connection create servicebus \
    --resource-group <resource-group-name> \
    --name <webapp-name> \
    --target-resource-group <target-resource-group-name> \
    --namespace <target-service-bus-namespace> \
    --system-identity

If you're using Azure Spring Apps, use the az spring connection command:

az spring connection create servicebus \
    --resource-group <resource-group-name> \
    --service <service-instance-name> \
    --app <app-name> \
    --deployment <deployment-name> \
    --target-resource-group <target-resource-group> \
    --namespace <target-service-bus-namespace> \
    --system-identity

If you're using Azure Container Apps, use the az containerapp connection command:

az containerapp connection create servicebus \
    --resource-group <resource-group-name> \
    --name <webapp-name> \
    --target-resource-group <target-resource-group-name> \
    --namespace <target-service-bus-namespace> \
    --system-identity

You can assign a managed identity to an Azure App Service instance with the az webapp identity assign command.

az webapp identity assign \
    --resource-group <resource-group-name> \
    --name <webapp-name>

You can assign a managed identity to an Azure Spring Apps instance with the az spring app identity assign command.

az spring app identity assign \
    --resource-group <resource-group-name> \
    --name <app-name> \
    --service <service-name>

You can assign a managed identity to an Azure Container Apps instance with the az container app identity assign command.

az containerapp identity assign \
    --resource-group <resource-group-name> \
    --name <app-name>

You can assign a managed identity to a virtual machine with the az vm identity assign command.

az vm identity assign \
    --resource-group <resource-group-name> \
    --name <virtual-machine-name>

You can assign a managed identity to an Azure Kubernetes Service (AKS) instance with the az aks update command.

az aks update \
    --resource-group <resource-group-name> \
    --name <virtual-machine-name> \
    --enable-managed-identity

If you connected your services using the Service Connector you don't need to complete this step. The necessary configurations were handled for you:

• If you selected a managed identity while creating the connection, a system-assigned managed identity was created for your app and assigned the Azure Service Bus Data Owner role on the Service Bus.

• If you selected connection string, the connection string was added as an app environment variable.

1. Navigate to your Service Bus overview page and select Access Control (IAM) from the left navigation.

2. Choose Add role assignment.

   

3. In the Role search box, search for Azure Service Bus Data Owner, which is a common role used to manage data operations for blobs. You can assign whatever role is appropriate for your use case. Select the Azure Service Bus Data Owner from the list and choose Next.

4. On the Add role assignment screen, for the Assign access to option, select Managed identity. Then choose +Select members.

5. In the flyout, search for the managed identity you created by entering the name of your app service. Select the system assigned identity, and then choose Select to close the flyout menu.

   

6. Select Next a couple times until you're able to select Review + assign to finish the role assignment.

To assign a role at the resource level using the Azure CLI, you first must retrieve the resource ID using the az servicebus show command. You can filter the output properties using the --query parameter.

az servicebus show \
    --resource-group '<your-resource-group-name>' \
    --name '<your-service-bus-namespace>' \
    --query id

Copy the output ID from the preceding command. You can then assign roles using the az role command of the Azure CLI.

az role assignment create \
    --assignee "<your-username>" \
    --role "Azure Service Bus Data Owner" \
    --scope "<your-resource-id>"