{"name":"AZURE_AUTHORITY_HOST","slug":"azure-authority-host","family":"env","title":"Environment variables","noun":"environment variable","description":"Read by the bundled Azure Identity library behind Claude Code's Microsoft Foundry sign-in (`DefaultAzureCredential`). It sets the Microsoft Entra sign-in host used when a credential is given no explicit `authorityHost`, default `https:\/\/login.microsoftonline.com`, with the tenant appended as the path. The identity client throws an error if it does not use `https`.","description_source":"code","described_by":{"bundle":"2.1.286","author":"claude-opus-5-5"},"presence":{"first_seen":"2.1.138","removed_in":null,"in_current_build":true,"newest_mined":"2.1.308","builds":149,"mined_builds":149,"first_cited":null},"aliases":[],"entries":[],"entries_total":0,"docs":[],"docs_total":0,"gates":[],"related":[{"name":"AZURE_ADDITIONALLY_ALLOWED_TENANTS","slug":"azure-additionally-allowed-tenants","description":"Read by the bundled Azure Identity `EnvironmentCredential`, part of the `DefaultAzureCredential` chain Claude Code uses for Microsoft Foundry when no Foundry API key or auth token is set. It is split on `;` and passed on as `additionallyAllowedTenantIds`, but the secret, certificate and username\/password credentials built from it read `additionallyAllowedTenants`, so in 2.1.286 the value does not reach their tenant check."},{"name":"AZURE_CLIENT_CERTIFICATE_PASSWORD","slug":"azure-client-certificate-password","description":"Read by the bundled Azure Identity `EnvironmentCredential` (first in the `DefaultAzureCredential` chain Claude Code uses for Microsoft Foundry, unless `AZURE_TOKEN_CREDENTIALS=dev`). When it signs in with a certificate from `AZURE_CLIENT_CERTIFICATE_PATH`, this password decrypts the PEM's private key; it has no effect when `AZURE_CLIENT_SECRET` is also set, since the secret is tried first."},{"name":"AZURE_CLIENT_CERTIFICATE_PATH","slug":"azure-client-certificate-path","description":"Read by the bundled Azure Identity `EnvironmentCredential` (first in the `DefaultAzureCredential` chain Claude Code uses for Microsoft Foundry, unless `AZURE_TOKEN_CREDENTIALS=dev`). With `AZURE_TENANT_ID` and `AZURE_CLIENT_ID` set and no `AZURE_CLIENT_SECRET`, it signs in as a service principal with the PEM certificate at this path, which must contain a PEM-encoded certificate; `AZURE_CLIENT_CERTIFICATE_PASSWORD` decrypts its key."},{"name":"AZURE_CLIENT_ID","slug":"azure-client-id","description":"Read by the bundled Azure Identity `DefaultAzureCredential` that Claude Code uses for Microsoft Foundry when no Foundry API key or auth token is set and `CLAUDE_CODE_SKIP_FOUNDRY_AUTH` is off. It is the application's client ID for environment credentials (with `AZURE_TENANT_ID` and a client secret, certificate, or username and password) and for workload identity (with `AZURE_TENANT_ID` and `AZURE_FEDERATED_TOKEN_FILE`), and otherwise selects a user-assigned managed identity."},{"name":"AZURE_CLIENT_SECRET","slug":"azure-client-secret","description":"Read by the bundled Azure Identity `EnvironmentCredential` (first in the `DefaultAzureCredential` chain Claude Code uses for Microsoft Foundry, unless `AZURE_TOKEN_CREDENTIALS=dev`). With `AZURE_TENANT_ID` and `AZURE_CLIENT_ID` it signs in as a service principal with this secret, which takes precedence over a certificate path or a username and password."},{"name":"AZURE_CLIENT_SEND_CERTIFICATE_CHAIN","slug":"azure-client-send-certificate-chain","description":"Read by the bundled Azure Identity `EnvironmentCredential` used for Microsoft Foundry sign-in. When it is `true` or `1` (case-insensitive), certificate sign-in through `AZURE_CLIENT_CERTIFICATE_PATH` sends the certificate file's contents as the `x5c` chain with the client assertion; any other value or unset leaves it off."},{"name":"AZURE_FEDERATED_TOKEN_FILE","slug":"azure-federated-token-file","description":"Read by the bundled Azure Identity library, whose `DefaultAzureCredential` Claude Code uses for Microsoft Foundry sign-in without a Foundry API key or auth token. It is the path of a federated token file: the workload identity credential reads its client assertion from that file (with `AZURE_CLIENT_ID` and `AZURE_TENANT_ID`), and managed identity switches to token exchange when it, `AZURE_TENANT_ID` and a client ID are all set. Claude Code also lists it as a credential variable to strip when it scrubs secrets from the environment of commands it runs."},{"name":"AZURE_FUNCTIONS_ENVIRONMENT","slug":"azure-functions-environment","description":"Read by deployment-environment detection: when it is set and no earlier check matched, the environment is reported as `azure-functions` in the `deployment_environment` field of Claude Code's telemetry metadata."},{"name":"AZURE_IDENTITY_DISABLE_MULTITENANTAUTH","slug":"azure-identity-disable-multitenantauth","description":"Read by the bundled Azure Identity library, whose `DefaultAzureCredential` Claude Code uses for Microsoft Foundry sign-in without a Foundry API key or auth token. When it is set to any non-empty value, a tenant ID passed with an individual token request is ignored and the credential's own tenant is used."},{"name":"AZURE_PASSWORD","slug":"azure-password","description":"Read by the bundled Azure Identity library, whose `DefaultAzureCredential` Claude Code uses for Microsoft Foundry sign-in without a Foundry API key or auth token. In its environment credential, when `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_USERNAME` and `AZURE_PASSWORD` are set and neither `AZURE_CLIENT_SECRET` nor `AZURE_CLIENT_CERTIFICATE_PATH` is, it signs in with that username and password and logs a warning that the method is deprecated. Claude Code also lists it as a credential variable to strip when it scrubs secrets from the environment of commands it runs."}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/azure-authority-host","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}