Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Azure Identity (Java) · sickn33 | DecimalAI

Azure Identity Java

SkillScore26Maintained

azure-identity-java

Authenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).

codingby sickn33

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/azure-identity-java/SKILL.md

decimalai skills pull azure-identity-java --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/azure-identity-java/SKILL.md https://app.decimal.ai/s/azure-identity-java/SKILL.md

Raw file: /s/azure-identity-java/SKILL.md ↗ · machine-readable summary at /s/azure-identity-java.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 57d ago

Yes — +17% lift · at higher cost+137% tokens0% turns26% of whole cases pass with skill (6/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-10	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—
case-05	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-03	✓→✓	＝ Same ✓	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sickn33 / antigravity-awesome-skills

skills/azure-identity-java/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

Azure Identity (Java)

Authenticate Java applications with Azure services using Microsoft Entra ID (Azure AD).

Installation

xml
<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
    <version>1.15.0</version>
</dependency>

Key Concepts

| Credential | Use Case | |------------|----------| | DefaultAzureCredential | Recommended - Works in dev and production | | ManagedIdentityCredential | Azure-hosted apps (App Service, Functions, VMs) | | EnvironmentCredential | CI/CD pipelines with env vars | | ClientSecretCredential | Service principals with secret | | ClientCertificateCredential | Service principals with certificate | | AzureCliCredential | Local dev using az login | | InteractiveBrowserCredential | Interactive login flow | | DeviceCodeCredential | Headless device authentication |

DefaultAzureCredential (Recommended)

The DefaultAzureCredential tries multiple authentication methods in order:

Environment variables
Workload Identity
Managed Identity
Azure CLI
Azure PowerShell
Azure Developer CLI

java
import com.azure.identity.DefaultAzureCredential;
import com.azure.identity.DefaultAzureCredentialBuilder;

// Simple usage
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();

// Use with any Azure client
BlobServiceClient blobClient = new BlobServiceClientBuilder()
    .endpoint("https://<storage-account>.blob.core.windows.net")
    .credential(credential)
    .buildClient();

KeyClient keyClient = new KeyClientBuilder()
    .vaultUrl("https://<vault-name>.vault.azure.net")
    .credential(credential)
    .buildClient();

Configure DefaultAzureCredential

java
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
    .managedIdentityClientId("<user-assigned-identity-client-id>")  // For user-assigned MI
    .tenantId("<tenant-id>")                                        // Limit to specific tenant
    .excludeEnvironmentCredential()                                 // Skip env vars
    .excludeAzureCliCredential()                                    // Skip Azure CLI
    .build();

Managed Identity

For Azure-hosted applications (App Service, Functions, AKS, VMs).

java
import com.azure.identity.ManagedIdentityCredential;
import com.azure.identity.ManagedIdentityCredentialBuilder;

// System-assigned managed identity
ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
    .build();

// User-assigned managed identity (by client ID)
ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
    .clientId("<user-assigned-client-id>")
    .build();

// User-assigned managed identity (by resource ID)
ManagedIdentityCredential credential = new ManagedIdentityCredentialBuilder()
    .resourceId("/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>")
    .build();

Service Principal with Secret

java
import com.azure.identity.ClientSecretCredential;
import com.azure.identity.ClientSecretCredentialBuilder;

ClientSecretCredential credential = new ClientSecretCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .clientSecret("<client-secret>")
    .build();

Service Principal with Certificate

java
import com.azure.identity.ClientCertificateCredential;
import com.azure.identity.ClientCertificateCredentialBuilder;

// From PEM file
ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .pemCertificate("<path-to-cert.pem>")
    .build();

// From PFX file with password
ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .pfxCertificate("<path-to-cert.pfx>", "<pfx-password>")
    .build();

// Send certificate chain for SNI
ClientCertificateCredential credential = new ClientCertificateCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .pemCertificate("<path-to-cert.pem>")
    .sendCertificateChain(true)
    .build();

Environment Credential

Reads credentials from environment variables.

java
import com.azure.identity.EnvironmentCredential;
import com.azure.identity.EnvironmentCredentialBuilder;

EnvironmentCredential credential = new EnvironmentCredentialBuilder().build();

Required Environment Variables

For service principal with secret:

bash
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

For service principal with certificate:

bash
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>

For username/password:

bash
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_USERNAME=<username>
AZURE_PASSWORD=<password>

Azure CLI Credential

For local development using az login.

java
import com.azure.identity.AzureCliCredential;
import com.azure.identity.AzureCliCredentialBuilder;

AzureCliCredential credential = new AzureCliCredentialBuilder()
    .tenantId("<tenant-id>")  // Optional: specific tenant
    .build();

Interactive Browser

For desktop applications requiring user login.

java
import com.azure.identity.InteractiveBrowserCredential;
import com.azure.identity.InteractiveBrowserCredentialBuilder;

InteractiveBrowserCredential credential = new InteractiveBrowserCredentialBuilder()
    .clientId("<client-id>")
    .redirectUrl("http://localhost:8080")  // Must match app registration
    .build();

Device Code

For headless devices (IoT, CLI tools).

java
import com.azure.identity.DeviceCodeCredential;
import com.azure.identity.DeviceCodeCredentialBuilder;

DeviceCodeCredential credential = new DeviceCodeCredentialBuilder()
    .clientId("<client-id>")
    .challengeConsumer(challenge -> {
        // Display to user
        System.out.println(challenge.getMessage());
    })
    .build();

Chained Credential

Create custom authentication chains.

java
import com.azure.identity.ChainedTokenCredential;
import com.azure.identity.ChainedTokenCredentialBuilder;

ChainedTokenCredential credential = new ChainedTokenCredentialBuilder()
    .addFirst(new ManagedIdentityCredentialBuilder().build())
    .addLast(new AzureCliCredentialBuilder().build())
    .build();

Workload Identity (AKS)

For Azure Kubernetes Service with workload identity.

java
import com.azure.identity.WorkloadIdentityCredential;
import com.azure.identity.WorkloadIdentityCredentialBuilder;

// Reads from AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_FEDERATED_TOKEN_FILE
WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder().build();

// Or explicit configuration
WorkloadIdentityCredential credential = new WorkloadIdentityCredentialBuilder()
    .tenantId("<tenant-id>")
    .clientId("<client-id>")
    .tokenFilePath("/var/run/secrets/azure/tokens/azure-identity-token")
    .build();

Token Caching

Enable persistent token caching for better performance.

java
// Enable token caching (in-memory by default)
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
    .enableAccountIdentifierLogging()
    .build();

// With shared token cache (for multi-credential scenarios)
SharedTokenCacheCredential credential = new SharedTokenCacheCredentialBuilder()
    .clientId("<client-id>")
    .build();

Sovereign Clouds

java
import com.azure.identity.AzureAuthorityHosts;

// Azure Government
DefaultAzureCredential govCredential = new DefaultAzureCredentialBuilder()
    .authorityHost(AzureAuthorityHosts.AZURE_GOVERNMENT)
    .build();

// Azure China
DefaultAzureCredential chinaCredential = new DefaultAzureCredentialBuilder()
    .authorityHost(AzureAuthorityHosts.AZURE_CHINA)
    .build();

Error Handling

java
import com.azure.identity.CredentialUnavailableException;
import com.azure.core.exception.ClientAuthenticationException;

try {
    DefaultAzureCredential credential = new DefaultAzureCredentialBuilder().build();
    AccessToken token = credential.getToken(new TokenRequestContext()
        .addScopes("https://management.azure.com/.default"));
} catch (CredentialUnavailableException e) {
    // No credential could authenticate
    System.out.println("Authentication failed: " + e.getMessage());
} catch (ClientAuthenticationException e) {
    // Authentication error (wrong credentials, expired, etc.)
    System.out.println("Auth error: " + e.getMessage());
}

Logging

Enable authentication logging for debugging.

java
// Via environment variable
// AZURE_LOG_LEVEL=verbose

// Or programmatically
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
    .enableAccountIdentifierLogging()  // Log account info
    .build();

Environment Variables

bash
# DefaultAzureCredential configuration
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

# Managed Identity
AZURE_CLIENT_ID=<user-assigned-mi-client-id>

# Workload Identity (AKS)
AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token

# Logging
AZURE_LOG_LEVEL=verbose

# Authority host
AZURE_AUTHORITY_HOST=https://login.microsoftonline.com/

Best Practices

Use DefaultAzureCredential - Works seamlessly from dev to production
Managed Identity in Production - No secrets to manage, automatic rotation
Azure CLI for Local Dev - Run az login before running your app
Least Privilege - Grant only required permissions to service principals
Token Caching - Enabled by default, reduces auth round-trips
Environment Variables - Use for CI/CD, not hardcoded secrets

Credential Selection Matrix

| Environment | Recommended Credential | |-------------|----------------------| | Local Development | DefaultAzureCredential (uses Azure CLI) | | Azure App Service | DefaultAzureCredential (uses Managed Identity) | | Azure Functions | DefaultAzureCredential (uses Managed Identity) | | Azure Kubernetes Service | WorkloadIdentityCredential | | Azure VMs | DefaultAzureCredential (uses Managed Identity) | | CI/CD Pipeline | EnvironmentCredential | | Desktop App | InteractiveBrowserCredential | | CLI Tool | DeviceCodeCredential |

Trigger Phrases

"Azure authentication Java", "DefaultAzureCredential Java"
"managed identity Java", "service principal Java"
"Azure login Java", "Azure credentials Java"
"AZURE_CLIENT_ID", "AZURE_TENANT_ID"

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Illustrative Want to see what azure-identity-java would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 16:31 UTC · 23 cases

Lift

+17%

26% vs 9%

Agent turns

0%

1.0 vs 1.0

Tokens

+137%

3,446.35 vs 1,454.35

fail → pass · 4pass → pass · 2fail → fail · 17

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-11 Write Java code using Azure Identity SDK to configure authentication for an app running in Azure Kubernetes Service using Workload Identity with an explicit federated token file path '/var/run/secrets/tokens/azure-token', tenant 'tenant-xyz', and client ID 'client-xyz'.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Show how to configure DefaultAzureCredentialBuilder in Java to direct authentication requests to the Azure Government sovereign cloud instead of the public cloud.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Show how to construct a custom fallback authentication chain in Java using Azure Identity SDK that first attempts Managed Identity and falls back to Azure CLI.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 Provide Java code using Azure Identity SDK to create a credential specifically for a user-assigned managed identity using its full Azure resource ID '/subscriptions/000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-id'.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 In Java using Azure Identity SDK, configure the default credential builder to skip checking environment variables while retaining the remaining default mechanisms.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Write a Java code snippet using the standalone MSAL Java library (com.microsoft.aad.msal4j.ConfidentialClientApplication) to acquire a token using client secret.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 Show how to configure interactive browser authentication in a Java desktop app using Azure Identity SDK, setting the client ID to 'client-app-id' and redirect URI to 'http://localhost:8080'.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 In a Java service using client certificate authentication with Azure Identity SDK, configure the builder to send the full certificate chain for Subject Name Issuer (SNI) support.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Write Java code using Azure Identity SDK to instantiate credentials for a service principal using tenant 't-1', client ID 'c-1', and secret 's-1'.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Write a Java code snippet to instantiate the standard Azure SDK credential builder that automatically checks local dev environments and Azure hosting environments sequentially, and use it to build a credential.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Write Java code using Azure Identity SDK to configure a certificate credential using a PKCS12 / PFX certificate file at '/certs/app.pfx' with password 'secretPass', tenant 'tenant-1', and client ID 'client-1'.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Write a Java catch block for the exception thrown by Azure Identity SDK when authentication credentials are provided but invalid or expired.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-23 How do you perform a raw OAuth2 client credentials grant HTTP POST request to Microsoft Entra ID using Java's standard java.net.http.HttpClient without any Azure SDK libraries?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Create a Java code snippet using Azure Identity SDK to authenticate a service principal with tenant ID 'tenant-123', client ID 'app-456', and a PEM certificate file at '/certs/app.pem'.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 What environment variable name can be set to direct Azure Identity authentication across the application to a sovereign cloud endpoint without changing code?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 In an Azure App Service Java application, which credential class from com.azure.identity is recommended for authenticating to Azure services both locally and in production?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 In a Java application using Azure SDK, configure the default authentication builder so that when it attempts Managed Identity authentication, it specifically targets a user-assigned managed identity with client ID '11111111-2222-3333-4444-555555555555'.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Write Python code using azure.identity to authenticate using DefaultAzureCredential and create a BlobServiceClient.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Write Java code using Azure Identity SDK to construct a credential that uses a shared token cache across applications for client ID 'client-123'.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 In Java, when acquiring a token via Azure Identity SDK, write a catch block specifically for the exception thrown when no credential in a credential chain was able to authenticate.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Specify the exact environment variable names required by Azure Identity Java SDK's EnvironmentCredential when authenticating a service principal using client ID, tenant ID, and client secret.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Write Java code using Azure Identity SDK to authenticate a headless device application where the user must complete login on another device by viewing a URL and code displayed in the console.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When using EnvironmentCredential with a client certificate file in Java, what environment variable specifies the certificate path?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +17 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 8.7%
Pass rate with the skill: 26.1%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 16:31 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run26

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+75% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.