Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Azure Identity SDK for Rust · sickn33 | DecimalAI

Azure Identity Rust

SkillScore43Maintained

azure-identity-rust

Azure Identity SDK for Rust authentication. Use for DeveloperToolsCredential, ManagedIdentityCredential, ClientSecretCredential, and token-based authentication.

codingby sickn33

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/azure-identity-rust/SKILL.md

decimalai skills pull azure-identity-rust --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/azure-identity-rust/SKILL.md https://app.decimal.ai/s/azure-identity-rust/SKILL.md

Raw file: /s/azure-identity-rust/SKILL.md ↗ · machine-readable summary at /s/azure-identity-rust.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

Runs

all versions · 30d

Used when offered

78%

used / offered · all versions

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 57d ago

Yes — +43% lift-4% tokens0% turns43% of whole cases pass with skill (10/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-08	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sickn33 / antigravity-awesome-skills

skills/azure-identity-rust/SKILL.md

View on GitHub ↗

License MIT LicenseImported 8/2/2026Version v1

Skill contents

SKILL.md

Azure Identity SDK for Rust

Authentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD).

Installation

sh
cargo add azure_identity

Environment Variables

bash
# Service Principal (for production/CI)
AZURE_TENANT_ID=<your-tenant-id>
AZURE_CLIENT_ID=<your-client-id>
AZURE_CLIENT_SECRET=<your-client-secret>

# User-assigned Managed Identity (optional)
AZURE_CLIENT_ID=<managed-identity-client-id>

DeveloperToolsCredential

The recommended credential for local development. Tries developer tools in order (Azure CLI, Azure Developer CLI):

rust
use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_secrets::SecretClient;

let credential = DeveloperToolsCredential::new(None)?;
let client = SecretClient::new(
    "https://my-vault.vault.azure.net/",
    credential.clone(),
    None,
)?;

Credential Chain Order

| Order | Credential | Environment | |-------|-----------|-------------| | 1 | AzureCliCredential | az login | | 2 | AzureDeveloperCliCredential | azd auth login |

Credential Types

| Credential | Usage | |------------|-------| | DeveloperToolsCredential | Local development - tries CLI tools | | ManagedIdentityCredential | Azure VMs, App Service, Functions, AKS | | WorkloadIdentityCredential | Kubernetes workload identity | | ClientSecretCredential | Service principal with secret | | ClientCertificateCredential | Service principal with certificate | | AzureCliCredential | Direct Azure CLI auth | | AzureDeveloperCliCredential | Direct azd CLI auth | | AzurePipelinesCredential | Azure Pipelines service connection | | ClientAssertionCredential | Custom assertions (federated identity) |

ManagedIdentityCredential

For Azure-hosted resources:

rust
use azure_identity::ManagedIdentityCredential;

// System-assigned managed identity
let credential = ManagedIdentityCredential::new(None)?;

// User-assigned managed identity
let options = ManagedIdentityCredentialOptions {
    client_id: Some("<user-assigned-mi-client-id>".into()),
    ..Default::default()
};
let credential = ManagedIdentityCredential::new(Some(options))?;

ClientSecretCredential

For service principal with secret:

rust
use azure_identity::ClientSecretCredential;

let credential = ClientSecretCredential::new(
    "<tenant-id>".into(),
    "<client-id>".into(),
    "<client-secret>".into(),
    None,
)?;

Best Practices

Use DeveloperToolsCredential for local dev — automatically picks up Azure CLI
Use ManagedIdentityCredential in production — no secrets to manage
Clone credentials — credentials are Arc-wrapped and cheap to clone
Reuse credential instances — same credential can be used with multiple clients
Use tokio feature — cargo add azure_identity --features tokio

Reference Links

| Resource | Link | |----------|------| | API Reference | https://docs.rs/azure_identity | | Source Code | https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/identity/azure_identity | | crates.io | https://crates.io/crates/azure_identity |

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Illustrative Want to see what azure-identity-rust would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 16:36 UTC · 23 cases

Lift

+43%

43% vs 0%

Agent turns

1.0 vs 1.0

Tokens

-4%

1,743.74 vs 1,819.87

fail → pass · 10fail → fail · 13

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-11 If I specifically want to bypass the developer tools chain fallback and force authentication strictly through the Azure CLI (`az login`) in my Rust program, which exact credential struct should I instantiate?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 How do I configure custom reqwest HTTP client settings with native-tls vs rustls in a general Rust web scraper application?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I am building a Rust microservice that accesses Azure Key Vault. I want to set up local developer authentication so team members can authenticate seamlessly using their local CLI credentials. Can you show me the Cargo command to add the SDK and a Rust code snippet initializing the recommended developer credential to pass into a Key Vault client?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 In an Azure Pipelines CI/CD task written in Rust, which specific credential type from the Rust Azure identity SDK should be used to authenticate using the pipeline service connection?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When configuring a user-assigned managed identity via standard environment variables in Azure, which environment variable name holds the client ID of the user-assigned identity?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 In a Python FastAPI application using `azure-identity` (PyPI package), how do I instantiate `DefaultAzureCredential` and handle token caching across async request handlers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 In a high-concurrency Rust microservice sharing authentication state across Tokio tasks, what is the memory/performance overhead of cloning Azure SDK credential handles when instantiating multiple Azure service clients?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 What credential struct should be used in Rust when authenticating a service principal using an X.509 certificate rather than a client secret?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When using local developer tools authentication in Rust with Azure SDK, in what exact sequence does the credential chain check local CLI tools when resolving authentication?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are deploying a Rust application to an Azure VM and need to handle authentication using managed identities without storing secrets in our repository. Could you write a Rust example showing how to set up credentials for both system-assigned and user-assigned managed identity options?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are deploying a Rust application to an Azure Kubernetes Service (AKS) cluster using Microsoft Entra Workload Identity. Which credential type from the Azure identity crate in Rust should be instantiated for this Kubernetes workload?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Should a Rust application create a new credential instance for every HTTP request / service client creation, or reuse credential instances across clients?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 What is the standard Cargo CLI command to add the Rust Azure identity library to a project's dependencies?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When establishing authentication in Rust for a federated identity provider using custom client assertions, which credential struct in the Azure identity SDK accepts custom assertions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 I need to authenticate a Rust backend application against Microsoft Entra ID using a service principal with a client secret for our automated deployment pipeline. Please provide the standard environment variables used for this authentication along with a Rust code snippet demonstrating how to instantiate the credential.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 How should I configure the Rust Azure identity crate dependency in Cargo.toml if my service relies on asynchronous I/O with Tokio?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 What options or parameters does `DeveloperToolsCredential::new` accept when initializing default developer authentication in Rust?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 I am using the Rust Azure Storage Blob SDK (`azure_storage_blobs`) to upload a byte buffer to a container called `photos`. How do I call `ContainerClient` or `BlobClient` to put a block blob named `avatar.png`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 If my Rust developer workflow needs to strictly require `azd auth login` authentication without falling back to `az login`, which credential struct should be used?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 What authentication mechanism is recommended as the best practice for production workloads running on Azure-hosted infrastructure (such as VMs, App Service, or Functions) to avoid managing secrets?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 When initializing a system-assigned managed identity in Rust using the Azure identity crate, what argument should be passed to the constructor function?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When calling the constructor for `ClientSecretCredential` in Rust, how must string parameters like tenant ID, client ID, and client secret be passed or converted?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 When writing Rust software that interacts with Azure services, what is the recommended credential implementation for local development on developer workstations?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +43 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 43.5%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 16:36 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run43

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.