# packages

pkgId: eb62a20f5ee296e20f91d4cfcb1b7cd80d664406272a51c0cee39b790bc41e3a
name: python-azure-eventhub-checkpointstoreblob
arch: src
version: 1.1.4
epoch: 0
release: 1
summary: Microsoft Azure Event Hubs checkpointer implementation with Blob Storage Client Library for Python
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-eventhub-checkpointstoreblob-1.1.4-1.src.rpm
checksum_type: sha256
description:
  Azure EventHubs Checkpoint Store is used for storing checkpoints while processing events from Azure Event Hubs.
  This Checkpoint Store package works as a plug-in package to `EventHubConsumerClient`. It uses Azure Storage Blob as the persistent store for maintaining checkpoints and partition ownership information.

  Please note that this is a sync library, for async version of the Azure EventHubs Checkpoint Store client library, please refer to [azure-eventhub-checkpointstoreblob-aio](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio).

  [Source code](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob/) | [Package (PyPi)](https://pypi.org/project/azure-eventhub-checkpointstoreblob) | [API reference documentation](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-eventhub/latest/azure.eventhub.html#azure.eventhub.CheckpointStore) | [Azure Eventhubs documentation](https://docs.microsoft.com/azure/event-hubs/) | [Azure Storage documentation](https://docs.microsoft.com/azure/storage/)





  - Python2.7, Python 3.6 or later.
  - **Microsoft Azure Subscription:**  To use Azure services, including Azure Event Hubs, you'll need a subscription. If you do not have an existing Azure account, you may sign up for a free trial or use your MSDN subscriber benefits when you [create an account](https://azure.microsoft.com/).

  - **Event Hubs namespace with an Event Hub:** To interact with Azure Event Hubs, you'll also need to have a namespace and Event Hub  available.  If you are not familiar with creating Azure resources, you may wish to follow the step-by-step guide for [creating an Event Hub using the Azure portal](https://docs.microsoft.com/azure/event-hubs/event-hubs-create).  There, you can also find detailed instructions for using the Azure CLI, Azure PowerShell, or Azure Resource Manager (ARM) templates to create an Event Hub.

  - **Azure Storage Account:** You'll need to have an Azure Storage Account and create a Azure Blob Storage Block Container to store the checkpoint data with blobs. You may follow the guide [creating an Azure Block Blob Storage Account](https://docs.microsoft.com/azure/storage/blobs/storage-blob-create-account-block-blob).



  ```
  $ pip install azure-eventhub-checkpointstoreblob
  ```





  Checkpointing is a process by which readers mark or commit their position within a partition event sequence.
  Checkpointing is the responsibility of the consumer and occurs on a per-partition basis within a consumer group.
  This responsibility means that for each consumer group, each partition reader must keep track of its current position
  in the event stream, and can inform the service when it considers the data stream complete. If a reader disconnects from
  a partition, when it reconnects it begins reading at the checkpoint that was previously submitted by the last reader of
  that partition in that consumer group. When the reader connects, it passes the offset to the event hub to specify the
  location at which to start reading. In this way, you can use checkpointing to both mark events as "complete" by
  downstream applications, and to provide resiliency if a failover between readers running on different machines occurs.
  It is possible to return to older data by specifying a lower offset from this checkpointing process. Through this
  mechanism, checkpointing enables both failover resiliency and event stream replay.


  Both offset & sequence number refer to the position of an event within a partition. You can think of them as a
  client-side cursor. The offset is a byte numbering of the event. The offset/sequence number enables an event consumer
  (reader) to specify a point in the event stream from which they want to begin reading events. You can specify a
  timestamp such that you receive events enqueued only after the given timestamp. Consumers are responsible for
  storing their own offset values outside of the Event Hubs service. Within a partition, each event includes an offset,
  sequence number and the timestamp of when it was enqueued.


  - [Create an Azure EventHubs `EventHubConsumerClient`](#create-an-eventhubconsumerclient)
  - [Consume events using a `BlobCheckpointStore`](#consume-events-using-a-blobcheckpointstore-to-do-checkpoint)


  The easiest way to create a `EventHubConsumerClient` is to use a connection string.
  ```python
  from azure.eventhub import EventHubConsumerClient
  eventhub_client = EventHubConsumerClient.from_connection_string("my_eventhub_namespace_connection_string", "my_consumer_group", eventhub_name="my_eventhub")
  ```
  For other ways of creating a `EventHubConsumerClient`, refer to [EventHubs library](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub) for more details.


  ```python

  from azure.eventhub import EventHubConsumerClient
  from azure.eventhub.extensions.checkpointstoreblob import BlobCheckpointStore

  connection_str = '<< CONNECTION STRING FOR THE EVENT HUBS NAMESPACE >>'
  consumer_group = '<< CONSUMER GROUP >>'
  eventhub_name = '<< NAME OF THE EVENT HUB >>'
  storage_connection_str = '<< CONNECTION STRING OF THE STORAGE >>'
  container_name = '<< STORAGE CONTAINER NAME>>'


  def on_event(partition_context, event):
      
      partition_context.update_checkpoint(event)  # Or update_checkpoint every N events for better performance.

  def main():
      checkpoint_store = BlobCheckpointStore.from_connection_string(
          storage_connection_str,
          container_name
      )
      client = EventHubConsumerClient.from_connection_string(
          connection_str,
          consumer_group,
          eventhub_name=eventhub_name,
          checkpoint_store=checkpoint_store,
      )

      with client:
          client.receive(on_event)

  if __name__ == '__main__':
      main()
  ```


  Some environments have different versions of Azure Storage Service API.
  `BlobCheckpointStore` by default uses the Storage Service API version 2019-07-07. To use it against a different
  version, specify `api_version` when you create the `BlobCheckpointStore` object.





  Enabling logging will be helpful to do trouble shooting.



  - Enable `azure.eventhub.extensions.checkpointstoreblob` logger to collect traces from the library.
  - Enable `azure.eventhub` logger to collect traces from the main azure-eventhub library.
  - Enable `azure.eventhub.extensions.checkpointstoreblob._vendor.storage` logger to collect traces from azure storage blob library.
  - Enable `uamqp` logger to collect traces from the underlying uAMQP library.
  - Enable AMQP frame level trace by setting `logging_enable=True` when creating the client.





  Get started with our [EventHubs Checkpoint Store samples](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob/samples).

  - [receive_events_using_checkpoint_store.py](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob/samples/receive_events_using_checkpoint_store.py) - EventHubConsumerClient with blob checkpoint store example
  - [receive_events_using_checkpoint_store_storage_api_version.py](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob/samples/receive_events_using_checkpoint_store_storage_api_version.py) - EventHubConsumerClient with blob checkpoint store and storage version example



  Reference documentation is available [here](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-eventhub/latest/azure.eventhub.html#azure.eventhub.CheckpointStore).



  If you encounter any bugs or have suggestions, please file an issue in the [Issues](https://github.com/Azure/azure-sdk-for-python/issues) section of the project.



  This project welcomes contributions and suggestions.  Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
  For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python/sdk/eventhub/azure-eventhub-checkpointstoreblob/README.png)






  This version and all future versions will require Python 2.7 or Python 3.6+, Python 3.5 is no longer supported.

  **New features**
  - Updated `list_ownership`, `claim_ownership`, `update_checkpoint`, `list_checkpoints` on `BlobCheckpointStore` to support taking `**kwargs`.



  This version will be the last version to officially support Python 3.5, future versions will require Python 2.7 or Python 3.6+.

  **Bug fixes**
  - Updated vendor azure-storage-blob dependency to v12.7.1.
    - Fixed storage blob authentication failure due to request date header too old (#16192).



  **Bug fixes**
  - Fixed a bug that `BlobCheckpointStore.list_ownership` and `BlobCheckpointStore.list_checkpoints` triggering `KeyError` due to reading empty metadata of parent node when working with Data Lake enabled Blob Storage.



  **Bug fixes**
  - Fixed a bug that may gradually slow down retrieving checkpoint data from the storage blob if the storage account "File share soft delete" is enabled. #12836



  **New features**
  - Param `api_version` of `BlobCheckpointStore` now supports older versions of Azure Storage Service API.


  Stable release. No new features or API changes.



  **Breaking changes**

  - Renamed `BlobPartitionManager` to `BlobCheckpointStore`.
  - Constructor of `BlobCheckpointStore` has been updated to take the storage container details directly rather than an instance of `ContainerClient`.
  - A `from_connection_string` constructor has been added for Blob Storage connection strings.
  - Module `blobstoragepm` is now internal, all imports should be directly from `azure.eventhub.extensions.checkpointstoreblob`.
  - `BlobCheckpointStore` now has a `close()` function for shutting down an HTTP connection pool, additionally the object can be used in a context manager to manage the connection.



  **New features**

  - `BlobPartitionManager` that uses Azure Blob Storage Block Blob to store EventProcessor checkpoint data

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python/sdk/eventhub/azure-eventhub-checkpointstoreblob/HISTORY.png)

url:
  https://github.com/Azure/azure-sdk-for-python/tree/master/sdk/eventhub/azure-eventhub-checkpointstoreblob


pkgId: a75dcc0e7a89a12e0c71fc354336f9a28fd2be7654048ee6d857328b31427ba4
name: python-azure-eventhub-checkpointstoreblob-aio
arch: src
version: 1.1.4
epoch: 0
release: 1
summary: Microsoft Azure Event Hubs checkpointer implementation with Blob Storage Client Library for Python
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-eventhub-checkpointstoreblob-aio-1.1.4-1.src.rpm
checksum_type: sha256
description:
  Azure EventHubs Checkpoint Store is used for storing checkpoints while processing events from Azure Event Hubs.
  This Checkpoint Store package works as a plug-in package to `EventHubConsumerClient`. It uses Azure Storage Blob as the persistent store for maintaining checkpoints and partition ownership information.

  Please note that this is an async library, for sync version of the Azure EventHubs Checkpoint Store client library, please refer to [azure-eventhub-checkpointstoreblob](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob).

  [Source code](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/) | [Package (PyPi)](https://pypi.org/project/azure-eventhub-checkpointstoreblob-aio/) | [API reference documentation](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-eventhub/latest/azure.eventhub.aio.html#azure.eventhub.aio.CheckpointStore) | [Azure Eventhubs documentation](https://docs.microsoft.com/azure/event-hubs/) | [Azure Storage documentation](https://docs.microsoft.com/azure/storage/)





  - Python 3.6 or later.
  - **Microsoft Azure Subscription:**  To use Azure services, including Azure Event Hubs, you'll need a subscription.  If you do not have an existing Azure account, you may sign up for a free trial or use your MSDN subscriber benefits when you [create an account](https://azure.microsoft.com/).

  - **Event Hubs namespace with an Event Hub:** To interact with Azure Event Hubs, you'll also need to have a namespace and Event Hub  available.  If you are not familiar with creating Azure resources, you may wish to follow the step-by-step guide for [creating an Event Hub using the Azure portal](https://docs.microsoft.com/azure/event-hubs/event-hubs-create).  There, you can also find detailed instructions for using the Azure CLI, Azure PowerShell, or Azure Resource Manager (ARM) templates to create an Event Hub.

  - **Azure Storage Account:** You'll need to have an Azure Storage Account and create a Azure Blob Storage Block Container to store the checkpoint data with blobs. You may follow the guide [creating an Azure Block Blob Storage Account](https://docs.microsoft.com/azure/storage/blobs/storage-blob-create-account-block-blob).



  ```
  $ pip install azure-eventhub-checkpointstoreblob-aio
  ```





  Checkpointing is a process by which readers mark or commit their position within a partition event sequence.
  Checkpointing is the responsibility of the consumer and occurs on a per-partition basis within a consumer group.
  This responsibility means that for each consumer group, each partition reader must keep track of its current position
  in the event stream, and can inform the service when it considers the data stream complete. If a reader disconnects from
  a partition, when it reconnects it begins reading at the checkpoint that was previously submitted by the last reader of
  that partition in that consumer group. When the reader connects, it passes the offset to the event hub to specify the
  location at which to start reading. In this way, you can use checkpointing to both mark events as "complete" by
  downstream applications, and to provide resiliency if a failover between readers running on different machines occurs.
  It is possible to return to older data by specifying a lower offset from this checkpointing process. Through this
  mechanism, checkpointing enables both failover resiliency and event stream replay.


  Both offset & sequence number refer to the position of an event within a partition. You can think of them as a
  client-side cursor. The offset is a byte numbering of the event. The offset/sequence number enables an event consumer
  (reader) to specify a point in the event stream from which they want to begin reading events. You can specify a
  timestamp such that you receive events enqueued only after the given timestamp. Consumers are responsible for
  storing their own offset values outside of the Event Hubs service. Within a partition, each event includes an offset,
  sequence number and the timestamp of when it was enqueued.


  - [Create an Azure EventHubs `EventHubConsumerClient`](#create-an-eventhubconsumerclient)
  - [Consume events using a `BlobCheckpointStore`](#consume-events-using-a-blobcheckpointstore-to-do-checkpoint)


  The easiest way to create a `EventHubConsumerClient` is to use a connection string.
  ```python
  from azure.eventhub.aio import EventHubConsumerClient
  eventhub_client = EventHubConsumerClient.from_connection_string("my_eventhub_namespace_connection_string", "my_consumer_group", eventhub_name="my_eventhub")
  ```
  For other ways of creating a `EventHubConsumerClient`, refer to [EventHubs library](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub) for more details.


  ```python
  import asyncio

  from azure.eventhub.aio import EventHubConsumerClient
  from azure.eventhub.extensions.checkpointstoreblobaio import BlobCheckpointStore

  connection_str = '<< CONNECTION STRING FOR THE EVENT HUBS NAMESPACE >>'
  consumer_group = '<< CONSUMER GROUP >>'
  eventhub_name = '<< NAME OF THE EVENT HUB >>'
  storage_connection_str = '<< CONNECTION STRING OF THE STORAGE >>'
  container_name = '<< STORAGE CONTAINER NAME>>'

  async def on_event(partition_context, event):
      
      await partition_context.update_checkpoint(event)  # Or update_checkpoint every N events for better performance.

  async def main():
      checkpoint_store = BlobCheckpointStore.from_connection_string(
          storage_connection_str,
          container_name
      )
      client = EventHubConsumerClient.from_connection_string(
          connection_str,
          consumer_group,
          eventhub_name=eventhub_name,
          checkpoint_store=checkpoint_store,
      )

      async with client:
          await client.receive(on_event)

  if __name__ == '__main__':
      loop = asyncio.get_event_loop()
      loop.run_until_complete(main())
  ```


  Some environments have different versions of Azure Storage Service API.
  `BlobCheckpointStore` by default uses the Storage Service API version 2019-07-07. To use it against a different
  version, specify `api_version` when you create the `BlobCheckpointStore` object.





  Enabling logging will be helpful to do trouble shooting.



  - Enable `azure.eventhub.extensions.checkpointstoreblobaio` logger to collect traces from the library.
  - Enable `azure.eventhub` logger to collect traces from the main azure-eventhub library.
  - Enable `azure.eventhub.extensions.checkpointstoreblobaio._vendor.storage` logger to collect traces from azure storage blob library.
  - Enable `uamqp` logger to collect traces from the underlying uAMQP library.
  - Enable AMQP frame level trace by setting `logging_enable=True` when creating the client.





  Get started with our [EventHubs Checkpoint Store async samples](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/samples).

  - [receive_events_using_checkpoint_store_async.py](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/samples/receive_events_using_checkpoint_store_async.py) - EventHubConsumerClient with blob checkpoint store example
  - [receive_events_using_checkpoint_store_storage_api_version_async.py](https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/samples/receive_events_using_checkpoint_store_storage_api_version_async.py) - EventHubConsumerClient with blob checkpoint store and storage version example



  Reference documentation is available [here](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-eventhub/latest/azure.eventhub.aio.html#azure.eventhub.aio.CheckpointStore).



  If you encounter any bugs or have suggestions, please file an issue in the [Issues](https://github.com/Azure/azure-sdk-for-python/issues) section of the project.



  This project welcomes contributions and suggestions.  Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
  For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/README.png)






  This version and all future versions will require Python 2.7 or Python 3.6+, Python 3.5 is no longer supported.

  **New features**
  - Updated `list_ownership`, `claim_ownership`, `update_checkpoint`, `list_checkpoints` on `BlobCheckpointStore` to support taking `**kwargs`.



  This version will be the last version to officially support Python 3.5, future versions will require Python 2.7 or Python 3.6+.

  **Bug fixes**
  - Updated vendor azure-storage-blob dependency to v12.7.1.
    - Fixed storage blob authentication failure due to request date header too old (#16192).




  **Bug fixes**
  - Fixed a bug that `BlobCheckpointStore.list_ownership` and `BlobCheckpointStore.list_checkpoints` triggering `KeyError` due to reading empty metadata of parent node when working with Data Lake enabled Blob Storage.



  **Bug fixes**
  - Fixed a bug that may gradually slow down retrieving checkpoint data from the storage blob if the storage account "File share soft delete" is enabled. #12836



  **New features**
  - Param `api_version` of `BlobCheckpointStore` now supports older versions of Azure Storage Service API.


  Stable release. No new features or API changes.



  **Breaking changes**

  - Renamed `BlobPartitionManager` to `BlobCheckpointStore`.
  - Constructor of `BlobCheckpointStore` has been updated to take the storage container details directly rather than an instance of `ContainerClient`.
  - A `from_connection_string` constructor has been added for Blob Storage connection strings.
  - Module `blobstoragepmaio` is now internal, all imports should be directly from `azure.eventhub.extensions.checkpointstoreblobaio`.
  - `BlobCheckpointStore` now has a `close()` function for shutting down an HTTP connection pool, additionally the object can be used in a context manager to manage the connection.



  **New features**

  - Added method `list_checkpoints` which list all the checkpoints under given eventhub namespace, eventhub name and consumer group.


  This release has trivial internal changes only. No feature changes.



  **New features**

  - `BlobPartitionManager` that uses Azure Blob Storage Block Blob to store EventProcessor checkpoint data

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/HISTORY.png)

url:
  https://github.com/Azure/azure-sdk-for-python/tree/master/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio


pkgId: a27103bcee4be9358a5ea32e1b535ea4c46fc85604abd1a8c34462057fbf2526
name: python-azure-extras
arch: src
version: 0.3.1
epoch: 0
release: 1
summary: The stuff Microsoft left out..
url: https://gitlab.com/tslight/azure_extras
rpm_license: ISC License (ISCL)
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-extras-0.3.1-1.src.rpm
checksum_type: sha256
description:
  W.I.P. Azure stuff to make my life easier.



  `pip install azure-extras`



  Copy [azure.example.ini](./azure.example.ini) to `$HOME/.azure.ini`, adding
  your subscription and tenant details along the way.

  This location can be customised with the `--config` flag at runtime.

  **TODO:** Use Azure CLI credentials



  https://github.com/projectkudu/kudu

  ``` text
  usage: az-kudu [-h] [-a NAME] [-C PATH] [-r NAME]
                 (-c COMMAND | -e SLUG | -z PATH | -Z SOURCE DESTINATION)
                 [-p PATH] [-v]

  CLI Kudu API Frontend

  optional arguments:
    -h, --help            show this help message and exit
    -a NAME, --app NAME   azure app service name
    -C PATH, --config PATH
                          path to azure configuration file
    -r NAME, --rg NAME    azure resource group
    -c COMMAND, --cmd COMMAND
                          command to run (use quotes for multi-word commands)
    -e SLUG, --endpoint SLUG
                          api endpoint slug
    -z PATH, --deploy_zip PATH
                          upload a zip to the server
    -Z SOURCE DESTINATION, --download_zip SOURCE DESTINATION
                          download a zip of a remote path
    -p PATH, --cwd PATH   server current working directory
    -v                    increase verbosity
  ```



  Workaround until
  [this](https://github.com/projectkudu/kudu/wiki/Health-Check-(Preview)#overview)
  is implemented in [terraform](https://github.com/terraform-providers/terraform-provider-azurerm/issues/5147)

  ``` text
  usage: az-chkhealth [-h] [-a NAME [NAME ...]] [-r NAME] [-A ENABLE/DISABLE]
                      [-C PATH] [-v]

  Enable or disable Health Check in Azure App Services

  optional arguments:
    -h, --help            show this help message and exit
    -a NAME [NAME ...], --app_services NAME [NAME ...]
                          list of azure app services
    -r NAME, --resource_group NAME
                          azure resource group
    -A ENABLE/DISABLE, --action ENABLE/DISABLE
                          action to carry out - enable or disable.
    -C PATH, --config PATH
                          path to azure configuration file
    -v                    increase verbosity
  ```



  ``` text
  usage: az-asctl [-h] [-a NAME [NAME ...]] [-r NAME] [-A START/STOP] [-C PATH]
                  [-v]

  Start or stop Azure App Services and their slots

  optional arguments:
    -h, --help            show this help message and exit
    -a NAME [NAME ...], --app_services NAME [NAME ...]
                          list of azure app services
    -r NAME, --resource_group NAME
                          azure resource group
    -A START/STOP, --action START/STOP
                          action to carry out - enable or disable.
    -C PATH, --config PATH
                          path to azure configuration file
    -v                    increase verbosity
  ```



  ``` text
  usage: az-sajctl [-h] [-C PATH] [-r NAME] [-j JOBS [JOBS ...]] [-a START/STOP]
                   [-v]

  Start or stop Stream Analytics Jobs

  optional arguments:
    -h, --help            show this help message and exit
    -C PATH, --config PATH
                          path to azure configuration file
    -r NAME, --resource_group NAME
                          azure resource group
    -j JOBS [JOBS ...], --stream_analytics_jobs JOBS [JOBS ...]
                          list of azure stream analytics jobs
    -a START/STOP, --action START/STOP
                          action to carry out - start or stop.
    -v                    increase verbosity
  ```


pkgId: caae9bab956171e1dc32d3505e71aea9d8b35d4ae1191ff9c06d2587332878e1
name: python-azure-functions
arch: src
version: 1.20.0
epoch: 0
release: 1
summary: Azure Functions for Python
url: https://pypi.org/project/azure-functions/
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-functions-1.20.0-1.src.rpm
checksum_type: sha256
description:
  | Branch | CodeCov                                                                                                                                                            |
  |--------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | master | [![codecov](https://codecov.io/gh/Azure/azure-functions-python-library/branch/master/graph/badge.svg)](https://codecov.io/gh/Azure/azure-functions-python-library) |
  | dev    | [![codecov](https://codecov.io/gh/Azure/azure-functions-python-library/branch/dev/graph/badge.svg)](https://codecov.io/gh/Azure/azure-functions-python-library)    |



  Python support for Azure Functions is based on Python 3.7, 3.8, 3.9, 3.10, and 3.11, serverless hosting on Linux, and the Functions 2.x ([EOL](https://learn.microsoft.com/azure/azure-functions/functions-versions?#retired-versions)), 3.x ([EOL](https://learn.microsoft.com/azure/azure-functions/functions-versions?#retired-versions)) and 4.0 runtime.

  Here is the current status of Python in Azure Functions:

  _What are the supported Python versions?_

  | Azure Functions Runtime | Python 3.6 | Python 3.7 | Python 3.8 | Python 3.9 | Python 3.10  | Python 3.11 |
  |-------------------------|--------|-------|-------|--------|--------------|-------------|
  | Azure Functions 3.0     | [EOL](https://learn.microsoft.com/azure/azure-functions/migrate-version-3-version-4)|[EOL](https://learn.microsoft.com/azure/azure-functions/migrate-version-3-version-4)|[EOL](https://learn.microsoft.com/azure/azure-functions/migrate-version-3-version-4)| [EOL](https://learn.microsoft.com/azure/azure-functions/migrate-version-3-version-4)| -       |-        |
  | Azure Functions 4.0     | [EOL](https://azure.microsoft.com/en-au/updates/azure-functions-support-for-python-36-is-ending-on-30-september-2022/) | &#x2713; | &#x2713; | &#x2713; | &#x2713;    | &#x2713;  |

  _What's available?_
  - Build, test, debug and publish using Azure Functions Core Tools (CLI) or Visual Studio Code
  - Triggers / Bindings : HTTP, Blob, Queue, Timer, Cosmos DB, Event Grid, Event Hubs and Service Bus
  - Create a Python Function on Linux using a custom docker image
  - Triggers / Bindings : Custom binding support



  - [Create your first Python function](https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-first-function-python)
  - [Developer guide](https://docs.microsoft.com/en-us/azure/azure-functions/functions-reference-python)
  - [Binding API reference](https://docs.microsoft.com/en-us/python/api/azure-functions/azure.functions?view=azure-python)
  - [Develop using VS Code](https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-first-function-vs-code)
  - [Create a Python Function on Linux using a custom docker image](https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-function-linux-custom-image)



  Issues and feature requests are tracked in a variety of places. To report this feedback, please file an issue to the relevant repository below:

  | Item          | Description                                  | Link                                                                           |
  |---------------|----------------------------------------------|--------------------------------------------------------------------------------|
  | Python Worker | Programming Model, Triggers & Bindings       | [File an Issue](https://github.com/Azure/azure-functions-python-worker/issues) |
  | Linux         | Base Docker Images                           | [File an Issue](https://github.com/Azure/azure-functions-docker/issues)        |
  | Runtime       | Script Host & Language Extensibility         | [File an Issue](https://github.com/Azure/azure-functions-host/issues)          |
  | VSCode        | VSCode Extension for Azure Functions         | [File an Issue](https://github.com/microsoft/vscode-azurefunctions/issues)     |
  | Core Tools    | Command Line Interface for Local Development | [File an Issue](https://github.com/Azure/azure-functions-core-tools/issues)    |
  | Portal        | User Interface or Experience Issue           | [File an Issue](https://github.com/azure/azure-functions-ux/issues)            |
  | Templates     | Code Issues with Creation Template           | [File an Issue](https://github.com/Azure/azure-functions-templates/issues)     |



  This project welcomes contributions and suggestions.  Most contributions require you to agree to a
  Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
  the rights to use your contribution. For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
  a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
  provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
  For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.


pkgId: d5bf871f0cb8d1538044fda0931062c1a9b0fe2e9d06981487908622946efe7b
name: python-azure-functions-devops-build
arch: src
version: 0.0.22
epoch: 0
release: 1
url: https://github.com/Azure/azure-functions-devops-build
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-functions-devops-build-0.0.22-1.src.rpm
checksum_type: sha256
summary:
  Python package for integrating Azure Functions with Azure DevOps. Specifically made for the Azure CLI

description:
  > :construction: The project is currently **work in progress**. Please **do not use in production** as we expect developments over time. :construction:

  This project provides the class AzureDevopsBuildManager and supporting classes. This manager class allows
  the caller to manage Azure Devops pipelines that are maintained within an Azure Devops account. This project was created to be able to support command line tooling for the AZ Cli.


  To install the package from pip:
  ```
  pip install azure-functions-devops-build
  ```

  To use the API, you need to first establish a connection to azure by loging into your azure account using `az login`. You can then follow the example as below. Firstly we get the token from login and use this to authenticate the different python function calls.

  ```python
  from azure.cli.core import get_default_cli
  from azure.cli.core._profile import Profile
  from azure_functions_devops_build.organization.organization_manager import OrganizationManager
  import pprint


  cli_ctx = get_default_cli()
  profile = Profile(cli_ctx=cli_ctx)
  creds, _, _ = profile.get_login_credentials(subscription_id=None)


  organization_manager = OrganizationManager(creds=creds)


  organizations = organization_manager.list_organizations()


  for organization in organizations.value:
      pprint.pprint(organization.__dict__)
  ```



  This Python library extensively uses the Azure DevOps REST APIs and Azure Devops Python API. See the [Azure DevOps REST API reference](https://docs.microsoft.com/en-us/rest/api/vsts/?view=vsts-rest-5.0) for details on calling different APIs and [Azure DevOps Python SDK](https://github.com/Microsoft/azure-devops-python-api) for details on the azure-devops-python-api.



  See samples by looking at tests or viewing the [az-cli functionapp devops-build module](https://github.com/Azure/azure-cli/tree/dev/src/command_modules/azure-cli-appservice/azure/cli/command_modules/appservice).



  Several things need to be setup before you can run the tests:
  1. Signed into the az cli. You can do this by using `az login`.
  2. Since this directly deploys to azure functions, [create an azure functions functionapp using the azure portal](https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-first-azure-function). You need to make a functionapp for these tests to successfully run and make sure you record the details of the subscription name, project name, application type and storage name.
  3. Follow the tests/_config_example.py file, create a tests/_config.py with your own testing environment.
  4. Run the full test suite using `python -m tests.suite`
  5. To run specific manager tests run `python -m tests.{NAME_OF_MANAGER}` eg. `python -m tests.test_builder_manager`



  This project welcomes contributions and suggestions.  Most contributions require you to agree to a
  Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
  the rights to use your contribution. For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
  a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
  provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
  For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.


pkgId: 59d8bbc661ec1520683ec4d8b8e90120454b6810630ef9e17205d872543a1305
name: python-azure-graph-toolkit
arch: src
version: 1.1.1
epoch: 0
release: 1
url: https://github.com/Ivanodib/azure-graph-toolkit
rpm_license: None
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-graph-toolkit-1.1.1-1.src.rpm
checksum_type: sha256
summary:
  Lightweight python library for easily managing Azure AD (Entra ID) users and groups through the Graph API.

description:
  <!--<div align="center">
    <a href="https://github.com/othneildrew/Best-README-Template">
       <img src="images/logo.png" alt="Logo" width="80" height="80">
    </a>-->

    <h1 align="center">azure-graph-toolkit</h1>


  <div align="center">

  [![Unit test](https://github.com/Ivanodib/azure-graph-toolkit/actions/workflows/unittest-pipeline.yml/badge.svg)](https://github.com/Ivanodib/azure-graph-toolkit/actions/workflows/unittest-pipeline.yml) [![Coverage Status](https://coveralls.io/repos/github/Ivanodib/azure-graph-toolkit/badge.svg?&kill_cache=1)](https://coveralls.io/github/Ivanodib/azure-graph-toolkit)  [![Maintainability](https://api.codeclimate.com/v1/badges/1936009e913846781090/maintainability)](https://codeclimate.com/github/Ivanodib/azure-graph-toolkit/maintainability)  [![Deployment](https://github.com/Ivanodib/azure-graph-toolkit/actions/workflows/deployment-pipeline.yml/badge.svg)](https://github.com/Ivanodib/azure-graph-toolkit/actions/workflows/deployment-pipeline.yml) ![PyPI - Version](https://img.shields.io/pypi/v/azure-graph-toolkit)

  </div>

  <div align="center">

  [![Downloads](https://static.pepy.tech/badge/azure-graph-toolkit)](https://pepy.tech/project/azure-graph-toolkit)
  [![Downloads](https://static.pepy.tech/badge/azure-graph-toolkit/month)](https://pepy.tech/project/azure-graph-toolkit)

  </div>


    <p align="center">
      Lightweight python library for easily managing Azure AD (Entra ID) users and groups through the Graph API.
      <br />
      <a href=https://github.com/Ivanodib/azure-graph-toolkit><strong>Explore the docs (work in progress)»</strong></a>
      <br />
      <br />
      ·
      <a href="https://github.com/Ivanodib/azure-graph-toolkit/issues">Report Bug</a>
      ·
      <a href="https://github.com/Ivanodib/azure-graph-toolkit/issues">Request Feature</a>
    </p>
  </div>



  <!-- TABLE OF CONTENTS -->
  <details>
    <summary>Table of Contents</summary>
    <ol>
      <li>
        <a href="#about-the-project">About The Project</a>
        <ul>
          <li><a href="#built-with">Built With</a></li>
        </ul>
      </li>
      <li>
        <a href="#getting-started">Getting Started</a>
        <ul>
          <li><a href="#prerequisites">Prerequisites</a></li>
          <li><a href="#installation">Installation</a></li>
          <li><a href="#usage">Usage</a></li>
        </ul>
      </li>
      <li><a href="#roadmap">Roadmap</a></li>
      <li><a href="#contact">Contact</a></li>
    </ol>
  </details>



  <!-- ABOUT THE PROJECT -->

  There are many great Azure libraries available on GitHub; however, I didn't find one that really suited my needs, so I created this one to simplify and automate daily tasks.

  Features:
  * Add user to AAD group
  * Remove user from AAD group
  * Check if user is member of a group
  * List all user membership groups
  * Reset user password
  * Disable/enable user
  * Revoke user session tokens

  <!-- Here's why:
  * Automate Sysadmin daily task
  * Get user and groups informations. -->

  <br>
  <br>


  <!-- GETTING STARTED -->





  1. Python >= 3.8
  2. Azure AD App Registration with the following role assigned:


  | Least privilege role | Delegation type | Description |
  | --- | --- | --- |
  | `GroupMember.ReadWrite.All` | Application | To manage user membership groups. |
  | `GroupMember.Read.All` | Application | List all the groups available. |
  | `User.ReadWrite.All`, `User Administrator role`  | Application | To change user password. |
  | `User.ManageIdentities.All`, `User.EnableDisableAccount.All` | Application | To disable/enable user. |
  | `User.RevokeSessions.All` | Application | To revoke user session tokens. |

  <br>



  1. Install azure-graph-toolkit library from PyPi
     ```sh
     pip install azure-graph-toolkit
      ```
  2. Profit 😁

  <p align="right">(<a href="#readme-top">back to top</a>)</p>



  <!-- USAGE EXAMPLES -->


  Import library modules

  ```python
  from azure_graph_toolkit import graph_auth, graph_utils
     ```

  App authentication and authorization. Once get the access token is possible to interact with Azure AD Graph API.
  ```python

  tenant_id = '<tenant Id>'
  client_id = '<client (App) Id>'
  client_secret = '<client secret>'

  access_token = graph_auth.get_access_token(tenant_id, client_id, client_secret)
     ```

  <br>


  **Add user to AAD group:**
  ```python

  result = graph_utils.add_user_to_group('mario.rossi@domain.com', 'block-usb-group', access_token)

  print(result)

   ```

  <br>

   **Remove user from AAD group:**
  ```python

  result = graph_utils.remove_user_from_group('mario.rossi@domain.com', 'block-usb-group', access_token)

  print(result)
   ```
   <br>

   **Disable user:**
  ```python

  result = graph_utils.set_user_account_status('mario.rossi@domain.com', enable_account=False, access_token)

  print(result)
   ```
   <br>

    **Revoke user sessions:**
  ```python

  result = graph_utils.user_revoke_sessions('mario.rossi@domain.com', access_token)

  print(result)
   ```
   <br>



    Example Output
   ```python
   {'status_code': 204, 'message': 'Success. User mario.rossi@domain.com added to AAD group block-usb-group.'}

   ```
   ```python
   {'status_code': 404, 'message': 'No AAD group with a name containing \'block-usb-group\' was found. Please try another group name.'}
   ```


  <!--_For more examples, please refer to the [Documentation](https://example.com)_ -->

  <p align="right">(<a href="#readme-top">back to top</a>)</p>



  <!-- ROADMAP -->


  - [ ] List user MFA status
  - [ ] List user's owned devices
  - [ ] List devices compliance status
  - [ ] Add device to group
  - [ ] Remove device from group
  - [ ] Create and delete users
  - [ ] Create and delete groups

  <!-- See the [open issues](https://github.com/othneildrew/Best-README-Template/issues) for a full list of proposed features (and known issues). -->

  <p align="right">(<a href="#readme-top">back to top</a>)</p>


  <!-- CONTACT -->

  Ivano Dibenedetto - [@Linkedin](https://www.linkedin.com/in/ivano-dibenedetto-b526ab188/) - ivano.dibenedetto7@gmail.com

  Project Link: [https://github.com/Ivanodib/azure-graph-toolkit](https://github.com/Ivanodib/azure-graph-toolkit)

  <p align="right">(<a href="#readme-top">back to top</a>)</p>


pkgId: cada026724ab5763bef0a24dccaf1b08edc20389fc74a82ad4eacfa54a78bdab
name: python-azure-graphrbac
arch: src
version: 0.61.1
epoch: 0
release: 1
summary: Microsoft Azure Graph RBAC Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-graphrbac-0.61.1-1.src.rpm
checksum_type: sha256
description:
  This is the Microsoft Azure Graph RBAC Client Library.
  This package has been tested with Python 2.7, 3.4, 3.5, 3.6 and 3.7.
  For a more complete set of Azure libraries, see the `azure <https://pypi.python.org/pypi/azure>`__ bundle package.


pkgId: cb8c3b2c04be4ab667b492957cbeefa5f5297b8f2fcc213dc9dcc5767a37beea
name: python-azure-identity
arch: src
version: 1.17.1
epoch: 0
release: 1
summary: Microsoft Azure Identity Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-identity-1.17.1-1.src.rpm
checksum_type: sha256
description:
  The Azure Identity library provides [Microsoft Entra ID](https://learn.microsoft.com/entra/fundamentals/whatis) ([formerly Azure Active Directory](https://learn.microsoft.com/entra/fundamentals/new-name)) token authentication support across the Azure SDK. It provides a set of [`TokenCredential`](https://learn.microsoft.com/python/api/azure-core/azure.core.credentials.tokencredential?view=azure-python) implementations, which can be used to construct Azure SDK clients that support Microsoft Entra token authentication.

  [Source code](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity)
  | [Package (PyPI)](https://pypi.org/project/azure-identity/)
  | [Package (Conda)](https://anaconda.org/microsoft/azure-identity/)
  | [API reference documentation][ref_docs]
  | [Microsoft Entra ID documentation](https://learn.microsoft.com/entra/identity/)





  Install Azure Identity with pip:

  ```sh
  pip install azure-identity
  ```



  - An [Azure subscription](https://azure.microsoft.com/free/python)
  - Python 3.8 or a recent version of Python 3 (this library doesn't support end-of-life versions)



  When debugging and executing code locally, it's typical for developers to use their own accounts for authenticating calls to Azure services. The Azure Identity library supports authenticating through developer tools to simplify local development.



  Developers using Visual Studio Code can use the [Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account) to authenticate via the editor. Apps using `DefaultAzureCredential` or `VisualStudioCodeCredential` can then use this account to authenticate calls in their app when running locally.

  To authenticate in Visual Studio Code, ensure the Azure Account extension is installed. Once installed, open the **Command Palette** and run the **Azure: Sign In** command.

  It's a [known issue](https://github.com/Azure/azure-sdk-for-python/issues/23249) that `VisualStudioCodeCredential` doesn't work with [Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account) versions newer than **0.9.11**. A long-term fix to this problem is in progress. In the meantime, consider [authenticating via the Azure CLI](#authenticate-via-the-azure-cli).



  `DefaultAzureCredential` and `AzureCliCredential` can authenticate as the user signed in to the [Azure CLI][azure_cli]. To sign in to the Azure CLI, run `az login`. On a system with a default web browser, the Azure CLI will launch the browser to authenticate a user.

  When no default browser is available, `az login` will use the device code authentication flow. This flow can also be selected manually by running `az login --use-device-code`.



  Developers coding outside of an IDE can also use the [Azure Developer CLI][azure_developer_cli] to authenticate. Applications using the `DefaultAzureCredential` or the `AzureDeveloperCliCredential` can then use this account to authenticate calls in their application when running locally.

  To authenticate with the [Azure Developer CLI][azure_developer_cli], users can run the command `azd auth login`. For users running on a system with a default web browser, the Azure Developer CLI will launch the browser to authenticate the user.

  For systems without a default web browser, the `azd auth login --use-device-code` command will use the device code authentication flow.





  A credential is a class that contains or can obtain the data needed for a service client to authenticate requests. Service clients across the Azure SDK accept a credential instance when they're constructed, and use that credential to authenticate requests.

  The Azure Identity library focuses on OAuth authentication with Microsoft Entra ID. It offers various credential classes capable of acquiring a Microsoft Entra access token. See the [Credential classes](#credential-classes "Credential classes") section below for a list of this library's credential classes.



  `DefaultAzureCredential` is appropriate for most applications that will run in Azure because it combines common production credentials with development credentials. `DefaultAzureCredential` attempts to authenticate via the following mechanisms, in this order, stopping when one succeeds:

  >Note: `DefaultAzureCredential` is intended to simplify getting started with the library by handling common
  >scenarios with reasonable default behaviors. Developers who want more control or whose scenario
  >isn't served by the default settings should use other credential types.

  ![DefaultAzureCredential authentication flow](https://raw.githubusercontent.com/Azure/azure-sdk-for-python/main/sdk/identity/azure-identity/images/mermaidjs/DefaultAzureCredentialAuthFlow.svg)

  1. **Environment** - `DefaultAzureCredential` will read account information specified via [environment variables](#environment-variables "environment variables") and use it to authenticate.
  1. **Workload Identity** - If the application is deployed to Azure Kubernetes Service with Managed Identity enabled, `DefaultAzureCredential` will authenticate with it.
  1. **Managed Identity** - If the application is deployed to an Azure host with Managed Identity enabled, `DefaultAzureCredential` will authenticate with it.
  1. **Azure CLI** - If a user has signed in via the Azure CLI `az login` command, `DefaultAzureCredential` will authenticate as that user.
  1. **Azure PowerShell** - If a user has signed in via Azure PowerShell's `Connect-AzAccount` command, `DefaultAzureCredential` will authenticate as that user.
  1. **Azure Developer CLI** - If the developer has authenticated via the Azure Developer CLI `azd auth login` command, the `DefaultAzureCredential` will authenticate with that account.
  1. **Interactive browser** - If enabled, `DefaultAzureCredential` will interactively authenticate a user via the default browser. This credential type is disabled by default.



  As of version 1.14.0, `DefaultAzureCredential` will attempt to authenticate with all developer credentials until one succeeds, regardless of any errors previous developer credentials experienced. For example, a developer credential may attempt to get a token and fail, so `DefaultAzureCredential` will continue to the next credential in the flow. Deployed service credentials will stop the flow with a thrown exception if they're able to attempt token retrieval, but don't receive one. Prior to version 1.14.0, developer credentials would similarly stop the authentication flow if token retrieval failed, but this is no longer the case.

  This allows for trying all of the developer credentials on your machine while having predictable deployed behavior.



  Due to a [known issue](https://github.com/Azure/azure-sdk-for-python/issues/23249), `VisualStudioCodeCredential` has been removed from the `DefaultAzureCredential` token chain. When the issue is resolved in a future release, this change will be reverted.



  The following examples are provided below:

  - [Authenticate with DefaultAzureCredential](#authenticate-with-defaultazurecredential "Authenticate with DefaultAzureCredential")
  - [Define a custom authentication flow with ChainedTokenCredential](#define-a-custom-authentication-flow-with-chainedtokencredential "Define a custom authentication flow with ChainedTokenCredential")
  - [Async credentials](#async-credentials "Async credentials")



  More details on configuring your environment to use the `DefaultAzureCredential` can be found in the class's [reference documentation][default_cred_ref].

  This example demonstrates authenticating the `BlobServiceClient` from the [azure-storage-blob][azure_storage_blob] library using `DefaultAzureCredential`.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.storage.blob import BlobServiceClient

  default_credential = DefaultAzureCredential()

  client = BlobServiceClient(account_url, credential=default_credential)
  ```



  Interactive authentication is disabled in the `DefaultAzureCredential` by default and can be enabled with a keyword argument:

  ```python
  DefaultAzureCredential(exclude_interactive_browser_credential=False)
  ```

  When enabled, `DefaultAzureCredential` falls back to interactively authenticating via the system's default web browser when no other credential is available.



  Many Azure hosts allow the assignment of a user-assigned managed identity. To configure `DefaultAzureCredential` to authenticate a user-assigned identity, use the `managed_identity_client_id` keyword argument:

  ```python
  DefaultAzureCredential(managed_identity_client_id=client_id)
  ```

  Alternatively, set the environment variable `AZURE_CLIENT_ID` to the identity's client ID.



  `DefaultAzureCredential` is generally the quickest way to get started developing applications for Azure. For more advanced scenarios, [ChainedTokenCredential][chain_cred_ref] links multiple credential instances to be tried sequentially when authenticating. It will try each chained credential in turn until one provides a token or fails to authenticate due to an error.

  The following example demonstrates creating a credential that will first attempt to authenticate using managed identity. The credential will fall back to authenticating via the Azure CLI when a managed identity is unavailable. This example uses the `EventHubProducerClient` from the [azure-eventhub][azure_eventhub] client library.

  ```python
  from azure.eventhub import EventHubProducerClient
  from azure.identity import AzureCliCredential, ChainedTokenCredential, ManagedIdentityCredential

  managed_identity = ManagedIdentityCredential()
  azure_cli = AzureCliCredential()
  credential_chain = ChainedTokenCredential(managed_identity, azure_cli)

  client = EventHubProducerClient(namespace, eventhub_name, credential_chain)
  ```



  This library includes a set of async APIs. To use the async credentials in [azure.identity.aio][ref_docs_aio], you must first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/). For more information, see [azure-core documentation][azure_core_transport_doc].

  Async credentials should be closed when they're no longer needed. Each async credential is an async context manager and defines an async `close` method. For example:

  ```python
  from azure.identity.aio import DefaultAzureCredential


  credential = DefaultAzureCredential()
  ...
  await credential.close()


  credential = DefaultAzureCredential()
  async with credential:
    ...
  ```

  This example demonstrates authenticating the asynchronous `SecretClient` from [azure-keyvault-secrets][azure_keyvault_secrets] with an asynchronous
  credential.

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.secrets.aio import SecretClient

  default_credential = DefaultAzureCredential()
  client = SecretClient("https://my-vault.vault.azure.net", default_credential)
  ```



  [Managed identity authentication](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview) is supported via either the `DefaultAzureCredential` or the `ManagedIdentityCredential` directly for the following Azure services:

  - [Azure App Service and Azure Functions](https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=python)
  - [Azure Arc](https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)
  - [Azure Cloud Shell](https://learn.microsoft.com/azure/cloud-shell/msi-authorization)
  - [Azure Kubernetes Service](https://learn.microsoft.com/azure/aks/use-managed-identity)
  - [Azure Service Fabric](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity)
  - [Azure Virtual Machines](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/how-to-use-vm-token)
  - [Azure Virtual Machines Scale Sets](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-powershell-windows-vmss)





  ```python
  from azure.identity import ManagedIdentityCredential
  from azure.keyvault.secrets import SecretClient

  credential = ManagedIdentityCredential(client_id=managed_identity_client_id)
  client = SecretClient("https://my-vault.vault.azure.net", credential)
  ```



  ```python
  from azure.identity import ManagedIdentityCredential
  from azure.keyvault.secrets import SecretClient

  credential = ManagedIdentityCredential()
  client = SecretClient("https://my-vault.vault.azure.net", credential)
  ```



  Credentials default to authenticating to the Microsoft Entra endpoint for Azure Public Cloud. To access resources in other clouds, such as Azure Government or a private cloud, configure credentials with the `authority` argument. [AzureAuthorityHosts](https://aka.ms/azsdk/python/identity/docs#azure.identity.AzureAuthorityHosts) defines authorities for well-known clouds:

  ```python
  from azure.identity import AzureAuthorityHosts

  DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_GOVERNMENT)
  ```

  If the authority for your cloud isn't listed in `AzureAuthorityHosts`, you can explicitly specify its URL:

  ```python
  DefaultAzureCredential(authority="https://login.partner.microsoftonline.cn")
  ```

  As an alternative to specifying the `authority` argument, you can also set the `AZURE_AUTHORITY_HOST` environment variable to the URL of your cloud's authority. This approach is useful when configuring multiple credentials to authenticate to the same cloud:

  ```sh
  AZURE_AUTHORITY_HOST=https://login.partner.microsoftonline.cn
  ```

  Not all credentials require this configuration. Credentials that authenticate through a development tool, such as `AzureCliCredential`, use that tool's configuration. Similarly, `VisualStudioCodeCredential` accepts an `authority` argument but defaults to the authority matching VS Code's "Azure: Cloud" setting.





  |Credential|Usage
  |-|-
  |[`DefaultAzureCredential`][default_cred_ref]| Provides a simplified authentication experience to quickly start developing applications run in Azure.
  |[`ChainedTokenCredential`][chain_cred_ref]| Allows users to define custom authentication flows composing multiple credentials.
  |[`EnvironmentCredential`][environment_cred_ref]| Authenticates a service principal or user via credential information specified in environment variables.
  |[`ManagedIdentityCredential`][managed_id_cred_ref]| Authenticates the managed identity of an Azure resource.
  |[`WorkloadIdentityCredential`][workload_id_cred_ref]| Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/aks/workload-identity-overview) on Kubernetes.



  |Credential|Usage|Reference
  |-|-|-
  |[`AzurePipelinesCredential`][az_pipelines_cred_ref]| Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops) on Azure Pipelines. |
  |[`CertificateCredential`][cert_cred_ref]| Authenticates a service principal using a certificate. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)
  |[`ClientAssertionCredential`][client_assertion_cred_ref]| Authenticates a service principal using a signed client assertion. |
  |[`ClientSecretCredential`][client_secret_cred_ref]| Authenticates a service principal using a secret. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)



  |Credential|Usage| Reference | Notes
  |-|-|-|-
  |[`AuthorizationCodeCredential`][auth_code_cred_ref]| Authenticates a user with a previously obtained authorization code. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)|
  |[`DeviceCodeCredential`][device_code_cred_ref]| Interactively authenticates a user on devices with limited UI. | [Device code authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-device-code)|
  |[`InteractiveBrowserCredential`][interactive_cred_ref]| Interactively authenticates a user with the default system browser. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)| `InteractiveBrowserCredential` doesn't support GitHub Codespaces. As a workaround, use [`DeviceCodeCredential`][device_code_cred_ref].
  |[`OnBehalfOfCredential`][obo_cred_ref]| Propagates the delegated user identity and permissions through the request chain. | [On-behalf-of authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-on-behalf-of-flow)|
  |[`UsernamePasswordCredential`][userpass_cred_ref]| Authenticates a user with a username and password (doesn't support multi-factor authentication). | [Username + password authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth-ropc)|



  |Credential|Usage|Reference
  |-|-|-
  |[`AzureCliCredential`][cli_cred_ref]| Authenticates in a development environment with the Azure CLI. | [Azure CLI authentication](https://learn.microsoft.com/cli/azure/authenticate-azure-cli)
  |[`AzureDeveloperCliCredential`][azd_cli_cred_ref]| Authenticates in a development environment with the Azure Developer CLI. | [Azure Developer CLI Reference](https://learn.microsoft.com/azure/developer/azure-developer-cli/reference)
  |[`AzurePowerShellCredential`][powershell_cred_ref]| Authenticates in a development environment with the Azure PowerShell. | [Azure PowerShell authentication](https://learn.microsoft.com/powershell/azure/authenticate-azureps)
  |[`VisualStudioCodeCredential`][vscode_cred_ref]| Authenticates as the user signed in to the Visual Studio Code Azure Account extension. | [VS Code Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)



  [DefaultAzureCredential][default_cred_ref] and [EnvironmentCredential][environment_cred_ref] can be configured with environment variables. Each type of authentication requires values for specific
  variables:



  |Variable name|Value
  |-|-
  |`AZURE_CLIENT_ID`|ID of a Microsoft Entra application
  |`AZURE_TENANT_ID`|ID of the application's Microsoft Entra tenant
  |`AZURE_CLIENT_SECRET`|one of the application's client secrets



  |Variable name|Value|Required
  |-|-|-
  |`AZURE_CLIENT_ID`|ID of a Microsoft Entra application|X
  |`AZURE_TENANT_ID`|ID of the application's Microsoft Entra tenant|X
  |`AZURE_CLIENT_CERTIFICATE_PATH`|path to a PEM or PKCS12 certificate file including private key|X
  |`AZURE_CLIENT_CERTIFICATE_PASSWORD`|password of the certificate file, if any|
  |`AZURE_CLIENT_SEND_CERTIFICATE_CHAIN`|if True, the credential will send the public certificate chain in the x5c header of each token request's JWT. This is required for Subject Name/Issuer (SNI) authentication. Defaults to False. There is a [known limitation](https://github.com/Azure/azure-sdk-for-python/issues/13349) that async SNI authentication is not supported.|



  |Variable name|Value
  |-|-
  |`AZURE_CLIENT_ID`|ID of a Microsoft Entra application
  |`AZURE_USERNAME`|a username (usually an email address)
  |`AZURE_PASSWORD`|that user's password

  Configuration is attempted in the above order. For example, if values for a client secret and certificate are both present, the client secret will be used.



  As of version 1.14.0, accessing resources protected by [Continuous Access Evaluation (CAE)][cae] is possible on a per-request basis. This behavior can be enabled by setting the `enable_cae` keyword argument to `True` in the credential's `get_token` method. CAE isn't supported for developer and managed identity credentials.



  Token caching is a feature provided by the Azure Identity library that allows apps to:
  - Cache tokens in memory (default) or on disk (opt-in).
  - Improve resilience and performance.
  - Reduce the number of requests made to Microsoft Entra ID to obtain access tokens.

  The Azure Identity library offers both in-memory and persistent disk caching. For more details, see the [token caching documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TOKEN_CACHING.md).



  An authentication broker is an application that runs on a user’s machine and manages the authentication handshakes and token maintenance for connected accounts. Currently, only the Windows Web Account Manager (WAM) is supported. To enable support, use the [`azure-identity-broker`][azure_identity_broker] package. For details on authenticating using WAM, see the [broker plugin documentation][azure_identity_broker_readme].



  See the [troubleshooting guide][troubleshooting_guide] for details on how to diagnose various failure scenarios.



  Credentials raise `CredentialUnavailableError` when they're unable to attempt authentication because they lack required data or state. For example,
  [EnvironmentCredential][environment_cred_ref] will raise this exception when [its configuration](#environment-variables "its configuration") is incomplete.

  Credentials raise `azure.core.exceptions.ClientAuthenticationError` when they fail to authenticate. `ClientAuthenticationError` has a `message` attribute, which describes why authentication failed. When raised by `DefaultAzureCredential` or `ChainedTokenCredential`, the message collects error messages from each credential in the chain.

  For more information on handling specific Microsoft Entra ID errors, see the Microsoft Entra ID [error code documentation](https://learn.microsoft.com/entra/identity-platform/reference-error-codes).



  This library uses the standard [logging](https://docs.python.org/3/library/logging.html) library for logging. Credentials log basic information, including HTTP sessions (URLs, headers, etc.) at INFO level. These log entries don't contain authentication secrets.

  Detailed DEBUG level logging, including request/response bodies and header values, isn't enabled by default. It can be enabled with the `logging_enable` argument. For example:

  ```python
  credential = DefaultAzureCredential(logging_enable=True)
  ```

  > CAUTION: DEBUG level logs from credentials contain sensitive information.
  > These logs must be protected to avoid compromising account security.





  Client and management libraries listed on the [Azure SDK release page](https://azure.github.io/azure-sdk/releases/latest/python.html) that support Microsoft Entra authentication accept credentials from this library. You can learn more about using these libraries in their documentation, which is linked from the release page.



  This library doesn't support [Azure AD B2C][b2c].

  For other open issues, refer to the library's [GitHub repository](https://github.com/Azure/azure-sdk-for-python/issues?q=is%3Aopen+is%3Aissue+label%3AAzure.Identity).



  If you encounter bugs or have suggestions, [open an issue](https://github.com/Azure/azure-sdk-for-python/issues).



  This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit [https://cla.microsoft.com](https://cla.microsoft.com).

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You'll only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

  [auth_code_cred_ref]: https://aka.ms/azsdk/python/identity/authorizationcodecredential
  [az_pipelines_cred_ref]: https://aka.ms/azsdk/python/identity/azurepipelinescredential
  [azd_cli_cred_ref]: https://aka.ms/azsdk/python/identity/azuredeveloperclicredential
  [azure_cli]: https://learn.microsoft.com/cli/azure
  [azure_developer_cli]:https://aka.ms/azure-dev
  [azure_core_transport_doc]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport
  [azure_identity_broker]: https://pypi.org/project/azure-identity-broker
  [azure_identity_broker_readme]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity-broker
  [azure_eventhub]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/eventhub/azure-eventhub
  [azure_keyvault_secrets]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets
  [azure_storage_blob]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/storage/azure-storage-blob
  [b2c]: https://learn.microsoft.com/azure/active-directory-b2c/overview
  [cae]: https://learn.microsoft.com/entra/identity/conditional-access/concept-continuous-access-evaluation
  [cert_cred_ref]: https://aka.ms/azsdk/python/identity/certificatecredential
  [chain_cred_ref]: https://aka.ms/azsdk/python/identity/chainedtokencredential
  [cli_cred_ref]: https://aka.ms/azsdk/python/identity/azclicredential
  [client_assertion_cred_ref]: https://aka.ms/azsdk/python/identity/clientassertioncredential
  [client_secret_cred_ref]: https://aka.ms/azsdk/python/identity/clientsecretcredential
  [default_cred_ref]: https://aka.ms/azsdk/python/identity/defaultazurecredential
  [device_code_cred_ref]: https://aka.ms/azsdk/python/identity/devicecodecredential
  [environment_cred_ref]: https://aka.ms/azsdk/python/identity/environmentcredential
  [interactive_cred_ref]: https://aka.ms/azsdk/python/identity/interactivebrowsercredential
  [managed_id_cred_ref]: https://aka.ms/azsdk/python/identity/managedidentitycredential
  [obo_cred_ref]: https://aka.ms/azsdk/python/identity/onbehalfofcredential
  [powershell_cred_ref]: https://aka.ms/azsdk/python/identity/powershellcredential
  [ref_docs]: https://aka.ms/azsdk/python/identity/docs
  [ref_docs_aio]: https://aka.ms/azsdk/python/identity/aio/docs
  [troubleshooting_guide]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TROUBLESHOOTING.md
  [userpass_cred_ref]: https://aka.ms/azsdk/python/identity/usernamepasswordcredential
  [vscode_cred_ref]: https://aka.ms/azsdk/python/identity/vscodecredential
  [workload_id_cred_ref]: https://aka.ms/azsdk/python/identity/workloadidentitycredential

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fidentity%2Fazure-identity%2FREADME.png)








  - Continue to attempt requesting token if the probing request receives non-json response. ([#36184](https://github.com/Azure/azure-sdk-for-python/pull/36184))





  > These changes do not impact the API of stable versions such as 1.16.0.
  > Only code written against a beta version such as 1.17.0b1 is affected.
  - `AzurePipelinesCredential` now has a required keyword argument `system_access_token`.  ([#35858](https://github.com/Azure/azure-sdk-for-python/pull/35858))



  - Allow credential chains to continue when an IMDS probe request returns a non-JSON response in `ManagedIdentityCredential`. ([#36016](https://github.com/Azure/azure-sdk-for-python/pull/36016))





  - `OnBehalfOfCredential` now supports client assertion callbacks through the `client_assertion_func` keyword argument. This enables authenticating with client assertions such as federated credentials.  ([#35812](https://github.com/Azure/azure-sdk-for-python/pull/35812))



  - Managed identity bug fixes





  - Managed identity bug fixes





  - Added environment variable `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN` support for `EnvironmentCredential`.
  - Introduced a new credential, `AzurePipelinesCredential`, for supporting workload identity federation in Azure Pipelines with service connections ([#35397](https://github.com/Azure/azure-sdk-for-python/pull/35397)).



  - Fixed typing errors when certain credentials are used as context managers. ([#35415](https://github.com/Azure/azure-sdk-for-python/pull/35415))





  - For IMDS requests in `ManagedIdentityCredential`, the retry backoff factor was reduced from 2 to 0.8 in order to avoid excessive retry delays and improve responsiveness. Users can customize this setting with the `retry_backoff_factor` parameter: `ManagedIdentityCredential(retry_backoff_factor=2)`.  ([#35070](https://github.com/Azure/azure-sdk-for-python/pull/35070))





  - Added pickling support. ([#34134](https://github.com/Azure/azure-sdk-for-python/pull/34134))



  - Fixed an issue in `AzurePowerShellCredential` where if `pwsh` isn't available and the Command Prompt language is not English, it would not fall back to `powershell`. ([#34271](https://github.com/Azure/azure-sdk-for-python/pull/34271))





  - Fixed the bug that `ClientAssertionCredential` constructor fails if kwargs are provided. ([#33673](https://github.com/Azure/azure-sdk-for-python/issues/33673))
  - `ManagedIdentityCredential` is more lenient with the error message it matches when falling through to the next credential in the chain in the case that Docker Desktop returns a 403 response when attempting to access the IMDS endpoint. ([#33928](https://github.com/Azure/azure-sdk-for-python/pull/33928))



  - `AzureCliCredential` utilizes the new `expires_on` property returned by `az` CLI versions >= 2.54.0 to determine token expiration. ([#33947](https://github.com/Azure/azure-sdk-for-python/issues/33947))
  - Azure-identity is supported on Python 3.8 or later.





  - Added bearer token provider.  ([#32655](https://github.com/Azure/azure-sdk-for-python/pull/32655))



  - Fixed issue InteractiveBrowserCredential does not hand over to next credential in chain if no browser is supported.([#32276](https://github.com/Azure/azure-sdk-for-python/pull/32276))





  - Added `enable_support_logging` as a keyword argument to credentials using MSAL's `PublicClientApplication`. This allows additional support logging which may contain PII. ([#32135](https://github.com/Azure/azure-sdk-for-python/pull/32135))



  > These changes do not impact the API of stable versions such as 1.14.0.
  > Only code written against a beta version such as 1.15.0b1 may be affected.
  - Windows Web Account Manager (WAM) Brokered Authentication is moved into another package.



  - `ManagedIdentityCredential` will now correctly retry when the instance metadata endpoint returns a 410 response.  ([#32200](https://github.com/Azure/azure-sdk-for-python/pull/32200))





  - Bug fixes for developer credentials





  - Added Windows Web Account Manager (WAM) Brokered Authentication support.
  - Added `enable_msa_passthrough` suppport for `InteractiveBrowserCredential`. By default `InteractiveBrowserCredential` only lists Microsoft Entra accounts. If you set `enable_msa_passthrough` to `True`, it lists both Microsoft Entra accounts and MSA outlook.com accounts that are logged in to Windows.



  - Ensure `AzurePowershellCredential` calls PowerShell with the `-NoProfile` flag to avoid loading user profiles for more consistent behavior.  ([#31682](https://github.com/Azure/azure-sdk-for-python/pull/31682))
  - Fixed an issue with subprocess-based developer credentials (such as AzureCliCredential) where the process would sometimes hang waiting for user input.  ([#31534](https://github.com/Azure/azure-sdk-for-python/pull/31534))
  - Fixed an issue with `ClientAssertionCredential` not properly checking if CAE should be enabled.  ([#31544](https://github.com/Azure/azure-sdk-for-python/pull/31544))
  - `ManagedIdentityCredential` will fall through to the next credential in the chain in the case that Docker Desktop returns a 403 response when attempting to access the IMDS endpoint.  ([#31824](https://github.com/Azure/azure-sdk-for-python/pull/31824))



  - Update typing of async credentials to match the `AsyncTokenCredential` protocol.
  - If within `DefaultAzureCredential`, `EnvironmentCredential` will now use log level INFO instead of WARNING to inform users of an incomplete environment configuration.  ([#31814](https://github.com/Azure/azure-sdk-for-python/pull/31814))
  - Strengthened `AzureCliCredential` and `AzureDeveloperCliCredential` error checking when determining if a user is logged in or not. Now, if an `AADSTS` error exists in the error, the full error message is propagated instead of a canned error message. ([#30047](https://github.com/Azure/azure-sdk-for-python/pull/30047))
  - `ManagedIdentityCredential` instances using IMDS will now be allowed to continue sending requests to the IMDS endpoint even after previous attempts failed. This is to prevent credential instances from potentially being permanently disabled after a temporary network failure.
  - IMDS endpoint probes in `ManagedIdentityCredential` will now only occur when inside a credential chain such as `DefaultAzureCredential`. This probe request timeout has been increased to 1 second from 0.3 seconds to reduce the likelihood of false negatives.





  - Continuous Access Evaluation (CAE) is now configurable per-request by setting the `enable_cae` keyword argument to `True` in `get_token`. This applies to user credentials and service principal credentials.  ([#30777](https://github.com/Azure/azure-sdk-for-python/pull/30777))



  - CP1 client capabilities for CAE is no longer always-on by default for user credentials. This capability will now be configured as-needed in each `get_token` request by each SDK.  ([#30777](https://github.com/Azure/azure-sdk-for-python/pull/30777))
    - Suffixes are now appended to persistent cache names to indicate whether CAE or non-CAE tokens are stored in the cache. This is to prevent CAE and non-CAE tokens from being mixed/overwritten in the same cache. This could potentially cause issues if you are trying to share the same cache between applications that are using different versions of the Azure Identity library as each application would be reading from a different cache file.
    - Since CAE is no longer always enabled for user-credentials, the `AZURE_IDENTITY_DISABLE_CP1` environment variable is no longer supported.



  - Credential types correctly implement `azure-core`'s `TokenCredential` protocol.  ([#25175](https://github.com/Azure/azure-sdk-for-python/issues/25175))





  - Added `workload_identity_tenant_id` support in `DefaultAzureCredential`.





  - Continue attempt next credential when finding an expired token from cached token credential in DefaultAzureCredential. ([#30441](https://github.com/Azure/azure-sdk-for-python/pull/30441))



  - VisualStudioCodeCredential prints an informative error message when used (as it is currently broken) ([#30385](https://github.com/Azure/azure-sdk-for-python/pull/30385))
  - Removed dependency on `six`. ([#30613](https://github.com/Azure/azure-sdk-for-python/pull/30613))





  > These changes do not impact the API of stable versions such as 1.12.0.
  > Only code written against a beta version such as 1.13.0b4 may be affected.
  - Windows Web Account Manager (WAM) Brokered Authentication is still in preview and not available in this release. It will be available in the next beta release.
  - Additional Continuous Access Evaluation (CAE) support for service principal credentials is still in preview and not available in this release. It will be available in the next beta release.
  - Renamed keyword argument `developer_credential_timeout` to `process_timeout` in `DefaultAzureCredential` to remain consistent with the other credentials that launch a subprocess to acquire tokens.





  - Credentials that are implemented via launching a subprocess to acquire tokens now have configurable timeouts using the `process_timeout` keyword argument. This addresses scenarios where these proceses can take longer than the current default timeout values. The affected credentials are `AzureCliCredential`, `AzureDeveloperCliCredential`, and `AzurePowerShellCredential`. (Note: For `DefaultAzureCredential`, the `developer_credential_timeout` keyword argument allows users to propagate this option to `AzureCliCredential`, `AzureDeveloperCliCredential`, and `AzurePowerShellCredential` in the authentication chain.) ([#28290](https://github.com/Azure/azure-sdk-for-python/pull/28290))





  - Changed parameter from `instance_discovery` to `disable_instance_discovery` to make it more explicit.
  - Service principal credentials now enable support for [Continuous Access Evaluation (CAE)](https://learn.microsoft.com/entra/identity/conditional-access/concept-continuous-access-evaluation-workload). This indicates to Microsoft Entra ID that your application can handle CAE claims challenges.





  - Added `AzureDeveloperCredential` for Azure Developer CLI. ([#27916](https://github.com/Azure/azure-sdk-for-python/pull/27916))
  - Added `WorkloadIdentityCredential` for Workload Identity Federation on Kubernetes ([#28536](https://github.com/Azure/azure-sdk-for-python/pull/28536))
  - Added support to use "TryAutoDetect" as the value for `AZURE_REGIONAL_AUTHORITY_NAME` to enable auto detecting the appropriate authority ([#526](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/526))





  - Added Windows Web Account Manager (WAM) Brokered Authentication support. ([#23687](https://github.com/Azure/azure-sdk-for-python/issues/23687))



  > These changes do not impact the API of stable versions such as 1.12.0.
  > Only code written against a beta version such as 1.12.0b1 may be affected.
  - Replaced `validate_authority` with `instance_discovery`. Now instead of setting validate_authority=False to disable authority validation and instance discovery, you need to use instance_discovery=False.



  - Fixed an issue where `AzureCliCredential` would return the wrong error message when the Azure CLI was not installed on non-English consoles. ([#27965](https://github.com/Azure/azure-sdk-for-python/issues/27965))





  - `AzureCliCredential` now works even when `az` prints warnings to stderr. ([#26857](https://github.com/Azure/azure-sdk-for-python/issues/26857)) (thanks to @micromaomao for the contribution)
  - Fixed issue where user-supplied `TokenCachePersistenceOptions` weren't propagated when using `SharedTokenCacheCredential` ([#26982](https://github.com/Azure/azure-sdk-for-python/issues/26982))



  - Excluded `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain by default as SDK
    authentication via Visual Studio Code is broken due to
    issue [#23249](https://github.com/Azure/azure-sdk-for-python/issues/23249). The `VisualStudioCodeCredential` will be
    re-enabled in the `DefaultAzureCredential` flow once a fix is in place.
    Issue [#25713](https://github.com/Azure/azure-sdk-for-python/issues/25713) tracks this. In the meantime
    Visual Studio Code users can authenticate their development environment using the [Azure CLI](https://learn.microsoft.com/cli/azure/).



  - Added Python 3.11 support and stopped supporting Python 3.6.



  1.12.0 release candidate





  - Added ability to specify `tenant_id` for `AzureCliCredential` & `AzurePowerShellCredential` (thanks @tikicoder)    ([#25207](https://github.com/Azure/azure-sdk-for-python/pull/25207))
  - Removed `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain. ([#23249](https://github.com/Azure/azure-sdk-for-python/issues/23249))
  - `EnvironmentCredential` added `AZURE_CLIENT_CERTIFICATE_PASSWORD` support for the cert password    ([#24652](https://github.com/Azure/azure-sdk-for-python/issues/24652))
  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))





  - Added `additionally_allowed_tenants` to the following credential options to force explicit opt-in behavior for multi-tenant authentication:
    - `AuthorizationCodeCredential`
    - `AzureCliCredential`
    - `AzurePowerShellCredential`
    - `CertificateCredential`
    - `ClientAssertionCredential`
    - `ClientSecretCredential`
    - `DefaultAzureCredential`
    - `OnBehalfOfCredential`
    - `UsernamePasswordCredential`
    - `VisualStudioCodeCredential`



  - Credential types supporting multi-tenant authentication will now throw `ClientAuthenticationError` if the requested tenant ID doesn't match the credential's tenant ID, and is not included in `additionally_allowed_tenants`. Applications must now explicitly add additional tenants to the `additionally_allowed_tenants` list, or add '*' to list, to enable acquiring tokens from tenants other than the originally specified tenant ID.

  More information on this change and the consideration behind it can be found [here](https://aka.ms/azsdk/blog/multi-tenant-guidance).

  - These beta features in 1.11.0b3 have been removed from this release and will be added back in 1.12.0b1
    - `tenant_id` for `AzureCliCredential`
    - removed `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain
    - `AZURE_CLIENT_CERTIFICATE_PASSWORD` support for `EnvironmentCredential`
    - `validate_authority` support



  Azure-identity is supported on Python 3.7 or later. For more details, please read our page on [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy).



  - Added ability to specify `tenant_id` for `AzureCliCredential` (thanks @tikicoder)    ([#25207](https://github.com/Azure/azure-sdk-for-python/pull/25207))



  - Removed `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain. ([#23249](https://github.com/Azure/azure-sdk-for-python/issues/23249))





  - `EnvironmentCredential` added `AZURE_CLIENT_CERTIFICATE_PASSWORD` support for the cert password    ([#24652](https://github.com/Azure/azure-sdk-for-python/issues/24652))



  - Fixed the issue that failed to parse PEM certificate if it does not start with "-----"    ([#24643](https://github.com/Azure/azure-sdk-for-python/issues/24643))





  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))





  > These changes do not impact the API of stable versions such as 1.9.0.
  > Only code written against a beta version such as 1.10.0b1 may be affected.
  - `validate_authority` support is not available in 1.10.0.



  - Supported msal-extensions version 1.0.0    ([#23927](https://github.com/Azure/azure-sdk-for-python/issues/23927))





  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))





  - Added PII logging if logging.DEBUG is enabled.    ([#23203](https://github.com/Azure/azure-sdk-for-python/issues/23203))



  > These changes do not impact the API of stable versions such as 1.8.0.
  > Only code written against a beta version such as 1.9.0b1 may be affected.
  - `validate_authority` support is not available in 1.9.0.



  - Added check on `content` from msal response.    ([#23483](https://github.com/Azure/azure-sdk-for-python/issues/23483))
  - Fixed the issue that async OBO credential does not refresh correctly.    ([#21981](https://github.com/Azure/azure-sdk-for-python/issues/21981))



  - Removed `resource_id`, please use `identity_config` instead.
  - Renamed argument name `get_assertion` to `func` for `ClientAssertionCredential`.





  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))
  - Added `resource_id` support for user-assigned managed identity  ([#22329](https://github.com/Azure/azure-sdk-for-python/issues/22329))
  - Added `ClientAssertionCredential` support  ([#22328](https://github.com/Azure/azure-sdk-for-python/issues/22328))
  - Updated App service API version to "2019-08-01" ([#23034](https://github.com/Azure/azure-sdk-for-python/issues/23034))





  - Handle injected "tenant_id" and "claims" ([#23138](https://github.com/Azure/azure-sdk-for-python/issues/23138))

    "tenant_id" argument in get_token() method is only supported by:

    - `AuthorizationCodeCredential`
    - `AzureCliCredential`
    - `AzurePowerShellCredential`
    - `InteractiveBrowserCredential`
    - `DeviceCodeCredential`
    - `EnvironmentCredential`
    - `UsernamePasswordCredential`

     it is ignored by other types of credentials.



  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.





  - Fix multi-tenant auth using async AadClient ([#21289](https://github.com/Azure/azure-sdk-for-python/issues/21289))




  > These changes do not impact the API of stable versions such as 1.6.0.
  > Only code written against a beta version such as 1.7.0b1 may be affected.

  - The `allow_multitenant_authentication` argument has been removed and the default behavior is now as if it were true.
    The multitenant authentication feature can be totally disabled by setting the environment variable
    `AZURE_IDENTITY_DISABLE_MULTITENANTAUTH` to `True`.
  - `azure.identity.RegionalAuthority` is removed.
  - `regional_authority` argument is removed for `CertificateCredential` and `ClientSecretCredential`.
  - `AzureApplicationCredential` is removed.
  - `client_credential` in the ctor of `OnBehalfOfCredential` is removed. Please use `client_secret` or `client_certificate` instead.
  - Make `user_assertion` in the ctor of `OnBehalfOfCredential` a keyword only argument.




  - `CertificateCredential` accepts certificates in PKCS12 format
    ([#13540](https://github.com/Azure/azure-sdk-for-python/issues/13540))
  - `OnBehalfOfCredential` supports the on-behalf-of authentication flow for
    accessing resources on behalf of users
    ([#19308](https://github.com/Azure/azure-sdk-for-python/issues/19308))
  - `DefaultAzureCredential` allows specifying the client ID of interactive browser via keyword argument `interactive_browser_client_id`
    ([#20487](https://github.com/Azure/azure-sdk-for-python/issues/20487))


  - Added context manager methods and `close()` to credentials in the
    `azure.identity` namespace. At the end of a `with` block, or when `close()`
    is called, these credentials close their underlying transport sessions.
    ([#18798](https://github.com/Azure/azure-sdk-for-python/issues/18798))





  - Persistent cache implementations are now loaded on demand, enabling
    workarounds when importing transitive dependencies such as pywin32
    fails
    ([#19989](https://github.com/Azure/azure-sdk-for-python/issues/19989))





  > These changes do not impact the API of stable versions such as 1.6.0.
  > Only code written against a beta version such as 1.7.0b1 may be affected.
  - Renamed `AZURE_POD_IDENTITY_TOKEN_URL` to `AZURE_POD_IDENTITY_AUTHORITY_HOST`.
    The value should now be a host, for example "http://169.254.169.254" (the
    default).


  - Fixed import of `azure.identity.aio.AzureApplicationCredential`
    ([#19943](https://github.com/Azure/azure-sdk-for-python/issues/19943))


  - Added `CustomHookPolicy` to credential HTTP pipelines. This allows applications
    to initialize credentials with `raw_request_hook` and `raw_response_hook`
    keyword arguments. The value of these arguments should be a callback taking a
    `PipelineRequest` and `PipelineResponse`, respectively. For example:
    `ManagedIdentityCredential(raw_request_hook=lambda request: print(request.http_request.url))`
  - Reduced redundant `ChainedTokenCredential` and `DefaultAzureCredential`
    logging. On Python 3.7+, credentials invoked by these classes now log debug
    rather than info messages.
    ([#18972](https://github.com/Azure/azure-sdk-for-python/issues/18972))
  - Persistent cache implementations are now loaded on demand, enabling
    workarounds when importing transitive dependencies such as pywin32
    fails
    ([#19989](https://github.com/Azure/azure-sdk-for-python/issues/19989))




  - `InteractiveBrowserCredential` keyword argument `login_hint` enables
    pre-filling the username/email address field on the login page
    ([#19225](https://github.com/Azure/azure-sdk-for-python/issues/19225))
  - `AzureApplicationCredential`, a default credential chain for applications
    deployed to Azure
    ([#19309](https://github.com/Azure/azure-sdk-for-python/issues/19309))


  - `azure.identity.aio.ManagedIdentityCredential` is an async context manager
    that closes its underlying transport session at the end of a `with` block


  - Most credentials can use tenant ID values returned from authentication
    challenges, enabling them to request tokens from the correct tenant. This
    behavior is optional and controlled by a new keyword argument,
    `allow_multitenant_authentication`.
    ([#19300](https://github.com/Azure/azure-sdk-for-python/issues/19300))
    - When `allow_multitenant_authentication` is False, which is the default, a
      credential will raise `ClientAuthenticationError` when its configured tenant
      doesn't match the tenant specified for a token request. This may be a
      different exception than was raised by prior versions of the credential. To
      maintain the prior behavior, set environment variable
      AZURE_IDENTITY_ENABLE_LEGACY_TENANT_SELECTION to "True".
  - `CertificateCredential` and `ClientSecretCredential` support regional STS
    on Azure VMs by either keyword argument `regional_authority` or environment
    variable `AZURE_REGIONAL_AUTHORITY_NAME`. See `azure.identity.RegionalAuthority`
    for possible values.
    ([#19301](https://github.com/Azure/azure-sdk-for-python/issues/19301))
  - Upgraded minimum `azure-core` version to 1.11.0 and minimum `msal` version to
    1.12.0
  - After IMDS authentication fails, `ManagedIdentityCredential` raises consistent
    error messages and uses `raise from` to propagate inner exceptions
    ([#19423](https://github.com/Azure/azure-sdk-for-python/pull/19423))


  Beginning with this release, this library requires Python 2.7 or 3.6+.


  - `VisualStudioCodeCredential` gets its default tenant and authority
    configuration from VS Code user settings
    ([#14808](https://github.com/Azure/azure-sdk-for-python/issues/14808))


  This is the last version to support Python 3.5. The next version will require
  Python 2.7 or 3.6+.


  - `AzurePowerShellCredential` authenticates as the identity logged in to Azure
    PowerShell. This credential is part of `DefaultAzureCredential` by default
    but can be disabled by a keyword argument:
    `DefaultAzureCredential(exclude_powershell_credential=True)`
    ([#17341](https://github.com/Azure/azure-sdk-for-python/issues/17341))


  - `AzureCliCredential` raises `CredentialUnavailableError` when the CLI times out,
    and kills timed out subprocesses
  - Reduced retry delay for `ManagedIdentityCredential` on Azure VMs



  > These changes do not impact the API of stable versions such as 1.5.0.
  > Only code written against a beta version such as 1.6.0b1 may be affected.
  - Removed property `AuthenticationRequiredError.error_details`


  - Credentials consistently retry token requests after connection failures, or
    when instructed to by a Retry-After header
  - ManagedIdentityCredential caches tokens correctly


  - `InteractiveBrowserCredential` functions in more WSL environments
    ([#17615](https://github.com/Azure/azure-sdk-for-python/issues/17615))



  > These changes do not impact the API of stable versions such as 1.5.0.
  > Only code written against a beta version such as 1.6.0b1 may be affected.
  - Renamed `CertificateCredential` keyword argument `certificate_bytes` to
    `certificate_data`
  - Credentials accepting keyword arguments `allow_unencrypted_cache` and
    `enable_persistent_cache` to configure persistent caching accept a
    `cache_persistence_options` argument instead whose value should be an
    instance of `TokenCachePersistenceOptions`. For example:
    ```
    
    DeviceCodeCredential(enable_persistent_cache=True, allow_unencrypted_cache=True)

    
    cache_options = TokenCachePersistenceOptions(allow_unencrypted_storage=True)
    DeviceCodeCredential(cache_persistence_options=cache_options)
    ```

    See the documentation and samples for more details.


  - New class `TokenCachePersistenceOptions` configures persistent caching
  - The `AuthenticationRequiredError.claims` property provides any additional
    claims required by a user credential's `authenticate()` method



  - Raised minimum msal version to 1.7.0
  - Raised minimum six version to 1.12.0


  - `InteractiveBrowserCredential` uses PKCE internally to protect authorization
    codes
  - `CertificateCredential` can load a certificate from bytes instead of a file
    path. To provide a certificate as bytes, use the keyword argument
    `certificate_bytes` instead of `certificate_path`, for example:
    `CertificateCredential(tenant_id, client_id, certificate_bytes=cert_bytes)`
    ([#14055](https://github.com/Azure/azure-sdk-for-python/issues/14055))
  - User credentials support Continuous Access Evaluation (CAE)
  - Application authentication APIs from 1.5.0b2


  - `ManagedIdentityCredential` correctly parses responses from the current
    (preview) version of Azure ML managed identity
    ([#15361](https://github.com/Azure/azure-sdk-for-python/issues/15361))



  - Renamed optional `CertificateCredential` keyword argument `send_certificate`
    (added in 1.5.0b1) to `send_certificate_chain`
  - Removed user authentication APIs added in prior betas. These will be
    reintroduced in 1.6.0b1. Passing the keyword arguments below
    generally won't cause a runtime error, but the arguments have no effect.
    ([#14601](https://github.com/Azure/azure-sdk-for-python/issues/14601))
    - Removed `authenticate` method from `DeviceCodeCredential`,
      `InteractiveBrowserCredential`, and `UsernamePasswordCredential`
    - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword
      arguments from `CertificateCredential`, `ClientSecretCredential`,
      `DeviceCodeCredential`, `InteractiveBrowserCredential`, and
      `UsernamePasswordCredential`
    - Removed `disable_automatic_authentication` keyword argument from
      `DeviceCodeCredential` and `InteractiveBrowserCredential`
    - Removed `allow_unencrypted_cache` keyword argument from
      `SharedTokenCacheCredential`
    - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError`
  - Removed `identity_config` keyword argument from `ManagedIdentityCredential`
    (was added in 1.5.0b1)


  - `DeviceCodeCredential` parameter `client_id` is now optional. When not
     provided, the credential will authenticate users to an Azure development
     application.
     ([#14354](https://github.com/Azure/azure-sdk-for-python/issues/14354))
  - Credentials raise `ValueError` when constructed with tenant IDs containing
    invalid characters
    ([#14821](https://github.com/Azure/azure-sdk-for-python/issues/14821))
  - Raised minimum msal version to 1.6.0


  - `ManagedIdentityCredential` supports Service Fabric
    ([#12705](https://github.com/Azure/azure-sdk-for-python/issues/12705))
    and Azure Arc
    ([#12702](https://github.com/Azure/azure-sdk-for-python/issues/12702))


  - Prevent `VisualStudioCodeCredential` using invalid authentication data when
    no user is signed in to Visual Studio Code
    ([#14438](https://github.com/Azure/azure-sdk-for-python/issues/14438))
  - `ManagedIdentityCredential` uses the API version supported by Azure Functions
    on Linux consumption hosting plans
    ([#14670](https://github.com/Azure/azure-sdk-for-python/issues/14670))
  - `InteractiveBrowserCredential.get_token()` raises a clearer error message when
    it times out waiting for a user to authenticate on Python 2.7
    ([#14773](https://github.com/Azure/azure-sdk-for-python/pull/14773))



  - `AzureCliCredential.get_token` correctly sets token expiration time,
    preventing clients from using expired tokens
    ([#14345](https://github.com/Azure/azure-sdk-for-python/issues/14345))


  - Adopted msal-extensions 0.3.0
  ([#13107](https://github.com/Azure/azure-sdk-for-python/issues/13107))



  - `AzureCliCredential.get_token` correctly sets token expiration time,
    preventing clients from using expired tokens
    ([#14345](https://github.com/Azure/azure-sdk-for-python/issues/14345))



  - Application authentication APIs from 1.4.0b7
  - `ManagedIdentityCredential` supports the latest version of App Service
    ([#11346](https://github.com/Azure/azure-sdk-for-python/issues/11346))
  - `DefaultAzureCredential` allows specifying the client ID of a user-assigned
    managed identity via keyword argument `managed_identity_client_id`
    ([#12991](https://github.com/Azure/azure-sdk-for-python/issues/12991))
  - `CertificateCredential` supports Subject Name/Issuer authentication when
    created with `send_certificate=True`. The async `CertificateCredential`
    (`azure.identity.aio.CertificateCredential`) will support this in a
    future version.
    ([#10816](https://github.com/Azure/azure-sdk-for-python/issues/10816))
  - Credentials in `azure.identity` support ADFS authorities, excepting
    `VisualStudioCodeCredential`. To configure a credential for this, configure
    the credential with `authority` and `tenant_id="adfs"` keyword arguments, for
    example
    `ClientSecretCredential(authority="<your ADFS URI>", tenant_id="adfs")`.
    Async credentials (those in `azure.identity.aio`) will support ADFS in a
    future release.
    ([#12696](https://github.com/Azure/azure-sdk-for-python/issues/12696))
  - `InteractiveBrowserCredential` keyword argument `redirect_uri` enables
    authentication with a user-specified application having a custom redirect URI
    ([#13344](https://github.com/Azure/azure-sdk-for-python/issues/13344))


  - Removed `authentication_record` keyword argument from the async
    `SharedTokenCacheCredential`, i.e. `azure.identity.aio.SharedTokenCacheCredential`



  - `DefaultAzureCredential` uses the value of environment variable
  `AZURE_CLIENT_ID` to configure a user-assigned managed identity.
  ([#10931](https://github.com/Azure/azure-sdk-for-python/issues/10931))


  - Renamed `VSCodeCredential` to `VisualStudioCodeCredential`
  - Removed application authentication APIs added in 1.4.0 beta versions. These
    will be reintroduced in 1.5.0b1. Passing the keyword arguments below
    generally won't cause a runtime error, but the arguments have no effect.
    - Removed `authenticate` method from `DeviceCodeCredential`,
      `InteractiveBrowserCredential`, and `UsernamePasswordCredential`
    - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword
      arguments from `CertificateCredential`, `ClientSecretCredential`,
      `DeviceCodeCredential`, `InteractiveBrowserCredential`, and
      `UsernamePasswordCredential`
    - Removed `disable_automatic_authentication` keyword argument from
      `DeviceCodeCredential` and `InteractiveBrowserCredential`
    - Removed `allow_unencrypted_cache` keyword argument from
      `SharedTokenCacheCredential`
    - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError`
    - Removed `identity_config` keyword argument from `ManagedIdentityCredential`


  - `DefaultAzureCredential` has a new optional keyword argument,
  `visual_studio_code_tenant_id`, which sets the tenant the credential should
  authenticate in when authenticating as the Azure user signed in to Visual
  Studio Code.
  - Renamed `AuthenticationRecord.deserialize` positional parameter `json_string`
  to `data`.



  - `AzureCliCredential` no longer raises an exception due to unexpected output
    from the CLI when run by PyCharm (thanks @NVolcz)
    ([#11362](https://github.com/Azure/azure-sdk-for-python/pull/11362))
  - Upgraded minimum `msal` version to 1.3.0
  - The async `AzureCliCredential` correctly invokes `/bin/sh`
    ([#12048](https://github.com/Azure/azure-sdk-for-python/issues/12048))


  - Prevent an error on importing `AzureCliCredential` on Windows caused by a bug
    in old versions of Python 3.6 (this bug was fixed in Python 3.6.5).
    ([#12014](https://github.com/Azure/azure-sdk-for-python/issues/12014))
  - `SharedTokenCacheCredential.get_token` raises `ValueError` instead of
    `ClientAuthenticationError` when called with no scopes.
    ([#11553](https://github.com/Azure/azure-sdk-for-python/issues/11553))


  - `ManagedIdentityCredential` can configure a user-assigned identity using any
    identifier supported by the current hosting environment. To specify an
    identity by its client ID, continue using the `client_id` argument. To
    specify an identity by any other ID, use the `identity_config` argument,
    for example: `ManagedIdentityCredential(identity_config={"object_id": ".."})`
    ([#10989](https://github.com/Azure/azure-sdk-for-python/issues/10989))
  - `CertificateCredential` and `ClientSecretCredential` can optionally store
    access tokens they acquire in a persistent cache. To enable this, construct
    the credential with `enable_persistent_cache=True`. On Linux, the persistent
    cache requires libsecret and `pygobject`. If these are unavailable or
    unusable (e.g. in an SSH session), loading the persistent cache will raise an
    error. You may optionally configure the credential to fall back to an
    unencrypted cache by constructing it with keyword argument
    `allow_unencrypted_cache=True`.
    ([#11347](https://github.com/Azure/azure-sdk-for-python/issues/11347))
  - `AzureCliCredential` raises `CredentialUnavailableError` when no user is
    logged in to the Azure CLI.
    ([#11819](https://github.com/Azure/azure-sdk-for-python/issues/11819))
  - `AzureCliCredential` and `VSCodeCredential`, which enable authenticating as
    the identity signed in to the Azure CLI and Visual Studio Code, respectively,
    can be imported from `azure.identity` and `azure.identity.aio`.
  - `azure.identity.aio.AuthorizationCodeCredential.get_token()` no longer accepts
    optional keyword arguments `executor` or `loop`. Prior versions of the method
    didn't use these correctly, provoking exceptions, and internal changes in this
    version have made them obsolete.
  - `InteractiveBrowserCredential` raises `CredentialUnavailableError` when it
    can't start an HTTP server on `localhost`.
    ([#11665](https://github.com/Azure/azure-sdk-for-python/pull/11665))
  - When constructing `DefaultAzureCredential`, you can now configure a tenant ID
    for `InteractiveBrowserCredential`. When none is specified, the credential
    authenticates users in their home tenants. To specify a different tenant, use
    the keyword argument `interactive_browser_tenant_id`, or set the environment
    variable `AZURE_TENANT_ID`.
    ([#11548](https://github.com/Azure/azure-sdk-for-python/issues/11548))
  - `SharedTokenCacheCredential` can be initialized with an `AuthenticationRecord`
    provided by a user credential.
    ([#11448](https://github.com/Azure/azure-sdk-for-python/issues/11448))
  - The user authentication API added to `DeviceCodeCredential` and
    `InteractiveBrowserCredential` in 1.4.0b3 is available on
    `UsernamePasswordCredential` as well.
    ([#11449](https://github.com/Azure/azure-sdk-for-python/issues/11449))
  - The optional persistent cache for `DeviceCodeCredential` and
    `InteractiveBrowserCredential` added in 1.4.0b3 is now available on Linux and
    macOS as well as Windows.
    ([#11134](https://github.com/Azure/azure-sdk-for-python/issues/11134))
    - On Linux, the persistent cache requires libsecret and `pygobject`. If these
      are unavailable, or libsecret is unusable (e.g. in an SSH session), loading
      the persistent cache will raise an error. You may optionally configure the
      credential to fall back to an unencrypted cache by constructing it with
      keyword argument `allow_unencrypted_cache=True`.


  - `EnvironmentCredential` correctly initializes `UsernamePasswordCredential`
  with the value of `AZURE_TENANT_ID`
  ([#11127](https://github.com/Azure/azure-sdk-for-python/pull/11127))
  - Values for the constructor keyword argument `authority` and
  `AZURE_AUTHORITY_HOST` may optionally specify an "https" scheme. For example,
  "https://login.microsoftonline.us" and "login.microsoftonline.us" are both valid.
  ([#10819](https://github.com/Azure/azure-sdk-for-python/issues/10819))
  - First preview of new API for authenticating users with `DeviceCodeCredential`
    and `InteractiveBrowserCredential`
    ([#10612](https://github.com/Azure/azure-sdk-for-python/pull/10612))
    - new method `authenticate` interactively authenticates a user, returns a
      serializable `AuthenticationRecord`
    - new constructor keyword arguments
      - `authentication_record` enables initializing a credential with an
        `AuthenticationRecord` from a prior authentication
      - `disable_automatic_authentication=True` configures the credential to raise
      `AuthenticationRequiredError` when interactive authentication is necessary
      to acquire a token rather than immediately begin that authentication
      - `enable_persistent_cache=True` configures these credentials to use a
      persistent cache on supported platforms (in this release, Windows only).
      By default they cache in memory only.
  - Now `DefaultAzureCredential` can authenticate with the identity signed in to
  Visual Studio Code's Azure extension.
  ([#10472](https://github.com/Azure/azure-sdk-for-python/issues/10472))


  - After an instance of `DefaultAzureCredential` successfully authenticates, it
  uses the same authentication method for every subsequent token request. This
  makes subsequent requests more efficient, and prevents unexpected changes of
  authentication method.
  ([#10349](https://github.com/Azure/azure-sdk-for-python/pull/10349))
  - All `get_token` methods consistently require at least one scope argument,
  raising an error when none is passed. Although `get_token()` may sometimes
  have succeeded in prior versions, it couldn't do so consistently because its
  behavior was undefined, and dependened on the credential's type and internal
  state. ([#10243](https://github.com/Azure/azure-sdk-for-python/issues/10243))
  - `SharedTokenCacheCredential` raises `CredentialUnavailableError` when the
  cache is available but contains ambiguous or insufficient information. This
  causes `ChainedTokenCredential` to correctly try the next credential in the
  chain. ([#10631](https://github.com/Azure/azure-sdk-for-python/issues/10631))
  - The host of the Active Directory endpoint credentials should use can be set
  in the environment variable `AZURE_AUTHORITY_HOST`. See
  `azure.identity.KnownAuthorities` for a list of common values.
  ([#8094](https://github.com/Azure/azure-sdk-for-python/issues/8094))




  - `ManagedIdentityCredential` raises `CredentialUnavailableError` when no
  identity is configured for an IMDS endpoint. This causes
  `ChainedTokenCredential` to correctly try the next credential in the chain.
  ([#10488](https://github.com/Azure/azure-sdk-for-python/issues/10488))



  - `DefaultAzureCredential` can now authenticate using the identity logged in to
  the Azure CLI, unless explicitly disabled with a keyword argument:
  `DefaultAzureCredential(exclude_cli_credential=True)`
  ([#10092](https://github.com/Azure/azure-sdk-for-python/pull/10092))




  - Correctly parse token expiration time on Windows App Service
  ([#9393](https://github.com/Azure/azure-sdk-for-python/issues/9393))
  - Credentials raise `CredentialUnavailableError` when they can't attempt to
  authenticate due to missing data or state
  ([#9372](https://github.com/Azure/azure-sdk-for-python/pull/9372))
  - `CertificateCredential` supports password-protected private keys
  ([#9434](https://github.com/Azure/azure-sdk-for-python/pull/9434))




  - All credential pipelines include `ProxyPolicy`
  ([#8945](https://github.com/Azure/azure-sdk-for-python/pull/8945))
  - Async credentials are async context managers and have an async `close` method
  ([#9090](https://github.com/Azure/azure-sdk-for-python/pull/9090))




  - Constructing `DefaultAzureCredential` no longer raises `ImportError` on Python
  3.8 on Windows ([8294](https://github.com/Azure/azure-sdk-for-python/pull/8294))
  - `InteractiveBrowserCredential` raises when unable to open a web browser
  ([8465](https://github.com/Azure/azure-sdk-for-python/pull/8465))
  - `InteractiveBrowserCredential` prompts for account selection
  ([8470](https://github.com/Azure/azure-sdk-for-python/pull/8470))
  - The credentials composing `DefaultAzureCredential` are configurable by keyword
  arguments ([8514](https://github.com/Azure/azure-sdk-for-python/pull/8514))
  - `SharedTokenCacheCredential` accepts an optional `tenant_id` keyword argument
  ([8689](https://github.com/Azure/azure-sdk-for-python/pull/8689))




  - `ClientCertificateCredential` uses application and tenant IDs correctly
  ([8315](https://github.com/Azure/azure-sdk-for-python/pull/8315))
  - `InteractiveBrowserCredential` properly caches tokens
  ([8352](https://github.com/Azure/azure-sdk-for-python/pull/8352))
  - Adopted msal 1.0.0 and msal-extensions 0.1.3
  ([8359](https://github.com/Azure/azure-sdk-for-python/pull/8359))




  - Async credentials now default to [`aiohttp`](https://pypi.org/project/aiohttp/)
  for transport but the library does not require it as a dependency because the
  async API is optional. To use async credentials, please install
  [`aiohttp`](https://pypi.org/project/aiohttp/) or see
  [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md#transport)
  for information about customizing the transport.
  - Renamed `ClientSecretCredential` parameter "`secret`" to "`client_secret`"
  - All credentials with `tenant_id` and `client_id` positional parameters now accept them in that order
  - Changes to `InteractiveBrowserCredential` parameters
    - positional parameter `client_id` is now an optional keyword argument. If no value is provided,
  the Azure CLI's client ID will be used.
    - Optional keyword argument `tenant` renamed `tenant_id`
  - Changes to `DeviceCodeCredential`
    - optional positional parameter `prompt_callback` is now a keyword argument
    - `prompt_callback`'s third argument is now a `datetime` representing the
    expiration time of the device code
    - optional keyword argument `tenant` renamed `tenant_id`
  - Changes to `ManagedIdentityCredential`
    - now accepts no positional arguments, and only one keyword argument:
    `client_id`
    - transport configuration is now done through keyword arguments as
    described in
    [`azure-core` documentation](https://github.com/Azure/azure-sdk-for-python/blob/azure-identity_1.0.0/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport)


  - Authenticating with a single sign-on shared with other Microsoft applications
  only requires a username when multiple users have signed in
  ([#8095](https://github.com/Azure/azure-sdk-for-python/pull/8095))
  - `DefaultAzureCredential` accepts an `authority` keyword argument, enabling
  its use in national clouds
  ([#8154](https://github.com/Azure/azure-sdk-for-python/pull/8154))


  - Adopted [`msal_extensions`](https://pypi.org/project/msal-extensions/) 0.1.2
  - Constrained [`msal`](https://pypi.org/project/msal/) requirement to >=0.4.1,
  <1.0.0




  - `AuthorizationCodeCredential` authenticates with a previously obtained
  authorization code. See Microsoft Entra's
  [authorization code documentation](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)
  for more information about this authentication flow.
  - Multi-cloud support: client credentials accept the authority of an Azure Active
  Directory authentication endpoint as an `authority` keyword argument. Known
  authorities are defined in `azure.identity.KnownAuthorities`. The default
  authority is for Azure Public Cloud, `login.microsoftonline.com`
  (`KnownAuthorities.AZURE_PUBLIC_CLOUD`). An application running in Azure
  Government would use `KnownAuthorities.AZURE_GOVERNMENT` instead:
  >```
  >from azure.identity import DefaultAzureCredential, KnownAuthorities
  >credential = DefaultAzureCredential(authority=KnownAuthorities.AZURE_GOVERNMENT)
  >```


  - Removed `client_secret` parameter from `InteractiveBrowserCredential`


  - `UsernamePasswordCredential` correctly handles environment configuration with
  no tenant information ([#7260](https://github.com/Azure/azure-sdk-for-python/pull/7260))
  - user realm discovery requests are sent through credential pipelines
  ([#7260](https://github.com/Azure/azure-sdk-for-python/pull/7260))




  - `SharedTokenCacheCredential` authenticates with tokens stored in a local
  cache shared by Microsoft applications. This enables Azure SDK clients to
  authenticate silently after you've signed in to Visual Studio 2019, for
  example. `DefaultAzureCredential` includes `SharedTokenCacheCredential` when
  the shared cache is available, and environment variable `AZURE_USERNAME`
  is set. See the
  [README](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md#single-sign-on)
  for more information.


  - New dependency: [`msal-extensions`](https://pypi.org/project/msal-extensions/)
  0.1.1



  - Removed `azure.core.Configuration` from the public API in preparation for a
  revamped configuration API. Static `create_config` methods have been renamed
  `_create_config`, and will be removed in a future release.


  - Adopted [azure-core](https://pypi.org/project/azure-core/) 1.0.0b2
    - If you later want to revert to a version requiring azure-core 1.0.0b1,
    of this or another Azure SDK library, you must explicitly install azure-core
    1.0.0b1 as well. For example:
    `pip install azure-core==1.0.0b1 azure-identity==1.0.0b1`
  - Adopted [MSAL](https://pypi.org/project/msal/) 0.4.1
  - New dependency for Python 2.7: [mock](https://pypi.org/project/mock/)


  - Added credentials for authenticating users:
   - `DeviceCodeCredential`
   - `InteractiveBrowserCredential`
   - `UsernamePasswordCredential`
    - async versions of these credentials will be added in a future release


  Version 1.0.0b1 is the first preview of our efforts to create a user-friendly
  and Pythonic authentication API for Azure SDK client libraries. For more
  information about preview releases of other Azure SDK libraries, please visit
  https://aka.ms/azure-sdk-preview1-python.

  This release supports service principal and managed identity authentication.
  See the
  [documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md)
  for more details. User authentication will be added in an upcoming preview
  release.

  This release supports only global Microsoft Entra tenants, i.e. those
  using the https://login.microsoftonline.com authentication endpoint.


pkgId: a14a6853310bf3687e42e0288807e6b03cc06cf42f74805c3585b520a0cc190d
name: python-azure-identity
arch: src
version: 1.19.0
epoch: 0
release: 1
summary: Microsoft Azure Identity Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-identity-1.19.0-1.src.rpm
checksum_type: sha256
description:
  The Azure Identity library provides [Microsoft Entra ID](https://learn.microsoft.com/entra/fundamentals/whatis) ([formerly Azure Active Directory](https://learn.microsoft.com/entra/fundamentals/new-name)) token authentication support across the Azure SDK. It provides a set of [`TokenCredential`][token_cred_ref]/[`SupportsTokenInfo`][supports_token_info_ref] implementations, which can be used to construct Azure SDK clients that support Microsoft Entra token authentication.

  [Source code](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity)
  | [Package (PyPI)](https://pypi.org/project/azure-identity/)
  | [Package (Conda)](https://anaconda.org/microsoft/azure-identity/)
  | [API reference documentation][ref_docs]
  | [Microsoft Entra ID documentation](https://learn.microsoft.com/entra/identity/)





  Install Azure Identity with pip:

  ```sh
  pip install azure-identity
  ```



  - An [Azure subscription](https://azure.microsoft.com/free/python)
  - Python 3.8 or a recent version of Python 3 (this library doesn't support end-of-life versions)



  When debugging and executing code locally, it's typical for developers to use their own accounts for authenticating calls to Azure services. The Azure Identity library supports authenticating through developer tools to simplify local development.



  Developers using Visual Studio Code can use the [Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account) to authenticate via the editor. Apps using `DefaultAzureCredential` or `VisualStudioCodeCredential` can then use this account to authenticate calls in their app when running locally.

  To authenticate in Visual Studio Code, ensure the Azure Account extension is installed. Once installed, open the **Command Palette** and run the **Azure: Sign In** command.

  It's a [known issue](https://github.com/Azure/azure-sdk-for-python/issues/23249) that `VisualStudioCodeCredential` doesn't work with [Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account) versions newer than **0.9.11**. A long-term fix to this problem is in progress. In the meantime, consider [authenticating via the Azure CLI](#authenticate-via-the-azure-cli).



  `DefaultAzureCredential` and `AzureCliCredential` can authenticate as the user signed in to the [Azure CLI][azure_cli]. To sign in to the Azure CLI, run `az login`. On a system with a default web browser, the Azure CLI launches the browser to authenticate a user.

  When no default browser is available, `az login` uses the device code authentication flow. This flow can also be selected manually by running `az login --use-device-code`.



  Developers coding outside of an IDE can also use the [Azure Developer CLI][azure_developer_cli] to authenticate. Applications using `DefaultAzureCredential` or `AzureDeveloperCliCredential` can then use this account to authenticate calls in their application when running locally.

  To authenticate with the [Azure Developer CLI][azure_developer_cli], run the command `azd auth login`. For users running on a system with a default web browser, the Azure Developer CLI launches the browser to authenticate the user.

  For systems without a default web browser, the `azd auth login --use-device-code` command uses the device code authentication flow.





  A credential is a class that contains or can obtain the data needed for a service client to authenticate requests. Service clients across the Azure SDK accept a credential instance when they're constructed, and use that credential to authenticate requests.

  The Azure Identity library focuses on OAuth authentication with Microsoft Entra ID. It offers various credential classes capable of acquiring a Microsoft Entra access token. See the [Credential classes](#credential-classes "Credential classes") section for a list of this library's credential classes.



  `DefaultAzureCredential` simplifies authentication while developing apps that deploy to Azure by combining credentials used in Azure hosting environments with credentials used in local development. For more information, see [DefaultAzureCredential overview][dac_overview].



  As of version 1.14.0, `DefaultAzureCredential` attempts to authenticate with all developer credentials until one succeeds, regardless of any errors previous developer credentials experienced. For example, a developer credential may attempt to get a token and fail, so `DefaultAzureCredential` will continue to the next credential in the flow. Deployed service credentials stop the flow with a thrown exception if they're able to attempt token retrieval, but don't receive one. Prior to version 1.14.0, developer credentials would similarly stop the authentication flow if token retrieval failed, but this is no longer the case.

  This allows for trying all of the developer credentials on your machine while having predictable deployed behavior.



  Due to a [known issue](https://github.com/Azure/azure-sdk-for-python/issues/23249), `VisualStudioCodeCredential` has been removed from the `DefaultAzureCredential` token chain. When the issue is resolved in a future release, this change will be reverted.



  The following examples are provided:

  - [Authenticate with DefaultAzureCredential](#authenticate-with-defaultazurecredential "Authenticate with DefaultAzureCredential")
  - [Define a custom authentication flow with ChainedTokenCredential](#define-a-custom-authentication-flow-with-chainedtokencredential "Define a custom authentication flow with ChainedTokenCredential")
  - [Async credentials](#async-credentials "Async credentials")



  More details on configuring your environment to use `DefaultAzureCredential` can be found in the class's [reference documentation][default_cred_ref].

  This example demonstrates authenticating the `BlobServiceClient` from the [azure-storage-blob][azure_storage_blob] library using `DefaultAzureCredential`.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.storage.blob import BlobServiceClient

  default_credential = DefaultAzureCredential()

  client = BlobServiceClient(account_url, credential=default_credential)
  ```



  By default, interactive authentication is disabled in `DefaultAzureCredential` and can be enabled with a keyword argument:

  ```python
  DefaultAzureCredential(exclude_interactive_browser_credential=False)
  ```

  When enabled, `DefaultAzureCredential` falls back to interactively authenticating via the system's default web browser when no other credential is available.



  Many Azure hosts allow the assignment of a user-assigned managed identity. To configure `DefaultAzureCredential` to authenticate a user-assigned managed identity, use the `managed_identity_client_id` keyword argument:

  ```python
  DefaultAzureCredential(managed_identity_client_id=client_id)
  ```

  Alternatively, set the environment variable `AZURE_CLIENT_ID` to the identity's client ID.



  While `DefaultAzureCredential` is generally the quickest way to authenticate apps for Azure, you can create a customized chain of credentials to be considered. `ChainedTokenCredential` enables users to combine multiple credential instances to define a customized chain of credentials. For more information, see [ChainedTokenCredential overview][ctc_overview].



  This library includes a set of async APIs. To use the async credentials in [azure.identity.aio][ref_docs_aio], you must first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/). For more information, see [azure-core documentation][azure_core_transport_doc].

  Async credentials should be closed when they're no longer needed. Each async credential is an async context manager and defines an async `close` method. For example:

  ```python
  from azure.identity.aio import DefaultAzureCredential


  credential = DefaultAzureCredential()
  ...
  await credential.close()


  credential = DefaultAzureCredential()
  async with credential:
    ...
  ```

  This example demonstrates authenticating the asynchronous `SecretClient` from [azure-keyvault-secrets][azure_keyvault_secrets] with an asynchronous credential.

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.secrets.aio import SecretClient

  default_credential = DefaultAzureCredential()
  client = SecretClient("https://my-vault.vault.azure.net", default_credential)
  ```



  [Managed identity authentication](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview) is supported via either `DefaultAzureCredential` or `ManagedIdentityCredential` directly for the following Azure services:

  - [Azure App Service and Azure Functions](https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=python)
  - [Azure Arc](https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)
  - [Azure Cloud Shell](https://learn.microsoft.com/azure/cloud-shell/msi-authorization)
  - [Azure Kubernetes Service](https://learn.microsoft.com/azure/aks/use-managed-identity)
  - [Azure Service Fabric](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity)
  - [Azure Virtual Machines](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/how-to-use-vm-token)
  - [Azure Virtual Machines Scale Sets](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-powershell-windows-vmss)



  These examples demonstrate authenticating `SecretClient` from the [`azure-keyvault-secrets`](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets) library with `ManagedIdentityCredential`.




  To authenticate with a user-assigned managed identity, you must specify one of the following IDs for the managed identity.



  ```python
  from azure.identity import ManagedIdentityCredential
  from azure.keyvault.secrets import SecretClient

  credential = ManagedIdentityCredential(client_id="managed_identity_client_id")
  client = SecretClient("https://my-vault.vault.azure.net", credential)
  ```



  ```python
  from azure.identity import ManagedIdentityCredential
  from azure.keyvault.secrets import SecretClient

  resource_id = "/subscriptions/<id>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<mi-name>"

  credential = ManagedIdentityCredential(identity_config={"resource_id": resource_id})
  client = SecretClient("https://my-vault.vault.azure.net", credential)
  ```



  ```python
  from azure.identity import ManagedIdentityCredential
  from azure.keyvault.secrets import SecretClient

  credential = ManagedIdentityCredential(identity_config={"object_id": "managed_identity_object_id"})
  client = SecretClient("https://my-vault.vault.azure.net", credential)
  ```



  ```python
  from azure.identity import ManagedIdentityCredential
  from azure.keyvault.secrets import SecretClient

  credential = ManagedIdentityCredential()
  client = SecretClient("https://my-vault.vault.azure.net", credential)
  ```



  Credentials default to authenticating to the Microsoft Entra endpoint for Azure Public Cloud. To access resources in other clouds, such as Azure Government or a private cloud, configure credentials with the `authority` argument. [AzureAuthorityHosts](https://aka.ms/azsdk/python/identity/docs#azure.identity.AzureAuthorityHosts) defines authorities for well-known clouds:

  ```python
  from azure.identity import AzureAuthorityHosts

  DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_GOVERNMENT)
  ```

  If the authority for your cloud isn't listed in `AzureAuthorityHosts`, you can explicitly specify its URL:

  ```python
  DefaultAzureCredential(authority="https://login.partner.microsoftonline.cn")
  ```

  As an alternative to specifying the `authority` argument, you can also set the `AZURE_AUTHORITY_HOST` environment variable to the URL of your cloud's authority. This approach is useful when configuring multiple credentials to authenticate to the same cloud:

  ```sh
  AZURE_AUTHORITY_HOST=https://login.partner.microsoftonline.cn
  ```

  Not all credentials require this configuration. Credentials that authenticate through a development tool, such as `AzureCliCredential`, use that tool's configuration. Similarly, `VisualStudioCodeCredential` accepts an `authority` argument but defaults to the authority matching VS Code's "Azure: Cloud" setting.





  |Credential|Usage
  |-|-
  |[`DefaultAzureCredential`][default_cred_ref]| Provides a simplified authentication experience to quickly start developing applications run in Azure.
  |[`ChainedTokenCredential`][chain_cred_ref]| Allows users to define custom authentication flows composing multiple credentials.



  |Credential|Usage
  |-|-
  |[`EnvironmentCredential`][environment_cred_ref]| Authenticates a service principal or user via credential information specified in environment variables.
  |[`ManagedIdentityCredential`][managed_id_cred_ref]| Authenticates the managed identity of an Azure resource.
  |[`WorkloadIdentityCredential`][workload_id_cred_ref]| Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/aks/workload-identity-overview) on Kubernetes.



  |Credential|Usage|Reference
  |-|-|-
  |[`AzurePipelinesCredential`][az_pipelines_cred_ref]| Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops) on Azure Pipelines. |
  |[`CertificateCredential`][cert_cred_ref]| Authenticates a service principal using a certificate. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)
  |[`ClientAssertionCredential`][client_assertion_cred_ref]| Authenticates a service principal using a signed client assertion. |
  |[`ClientSecretCredential`][client_secret_cred_ref]| Authenticates a service principal using a secret. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)



  |Credential|Usage| Reference | Notes
  |-|-|-|-
  |[`AuthorizationCodeCredential`][auth_code_cred_ref]| Authenticates a user with a previously obtained authorization code. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)|
  |[`DeviceCodeCredential`][device_code_cred_ref]| Interactively authenticates a user on devices with limited UI. | [Device code authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-device-code)|
  |[`InteractiveBrowserCredential`][interactive_cred_ref]| Interactively authenticates a user with the default system browser. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)| `InteractiveBrowserCredential` doesn't support GitHub Codespaces. As a workaround, use [`DeviceCodeCredential`][device_code_cred_ref].
  |[`OnBehalfOfCredential`][obo_cred_ref]| Propagates the delegated user identity and permissions through the request chain. | [On-behalf-of authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-on-behalf-of-flow)|
  |[`UsernamePasswordCredential`][userpass_cred_ref]| Authenticates a user with a username and password (doesn't support multifactor authentication). | [Username + password authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth-ropc)|



  |Credential|Usage|Reference
  |-|-|-
  |[`AzureCliCredential`][cli_cred_ref]| Authenticates in a development environment with the Azure CLI. | [Azure CLI authentication](https://learn.microsoft.com/cli/azure/authenticate-azure-cli)
  |[`AzureDeveloperCliCredential`][azd_cli_cred_ref]| Authenticates in a development environment with the Azure Developer CLI. | [Azure Developer CLI Reference](https://learn.microsoft.com/azure/developer/azure-developer-cli/reference)
  |[`AzurePowerShellCredential`][powershell_cred_ref]| Authenticates in a development environment with the Azure PowerShell. | [Azure PowerShell authentication](https://learn.microsoft.com/powershell/azure/authenticate-azureps)
  |[`VisualStudioCodeCredential`][vscode_cred_ref]| Authenticates as the user signed in to the Visual Studio Code Azure Account extension. | [VS Code Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)



  [DefaultAzureCredential][default_cred_ref] and [EnvironmentCredential][environment_cred_ref] can be configured with environment variables. Each type of authentication requires values for specific
  variables:



  |Variable name|Value
  |-|-
  |`AZURE_CLIENT_ID`|ID of a Microsoft Entra application
  |`AZURE_TENANT_ID`|ID of the application's Microsoft Entra tenant
  |`AZURE_CLIENT_SECRET`|one of the application's client secrets



  |Variable name|Value|Required
  |-|-|-
  |`AZURE_CLIENT_ID`|ID of a Microsoft Entra application|X
  |`AZURE_TENANT_ID`|ID of the application's Microsoft Entra tenant|X
  |`AZURE_CLIENT_CERTIFICATE_PATH`|path to a PEM or PKCS12 certificate file including private key|X
  |`AZURE_CLIENT_CERTIFICATE_PASSWORD`|password of the certificate file, if any|
  |`AZURE_CLIENT_SEND_CERTIFICATE_CHAIN`|If `True`, the credential sends the public certificate chain in the x5c header of each token request's JWT. This is required for Subject Name/Issuer (SNI) authentication. Defaults to False. There's a [known limitation](https://github.com/Azure/azure-sdk-for-python/issues/13349) that async SNI authentication isn't supported.|



  |Variable name|Value
  |-|-
  |`AZURE_CLIENT_ID`|ID of a Microsoft Entra application
  |`AZURE_USERNAME`|a username (usually an email address)
  |`AZURE_PASSWORD`|that user's password

  Configuration is attempted in the preceding order. For example, if values for a client secret and certificate are both present, the client secret is used.



  As of version 1.14.0, accessing resources protected by [Continuous Access Evaluation (CAE)][cae] is possible on a per-request basis. This behavior can be enabled by setting the `enable_cae` keyword argument to `True` in the credential's `get_token` method. CAE isn't supported for developer and managed identity credentials.



  Token caching is a feature provided by the Azure Identity library that allows apps to:
  - Cache tokens in memory (default) or on disk (opt-in).
  - Improve resilience and performance.
  - Reduce the number of requests made to Microsoft Entra ID to obtain access tokens.

  The Azure Identity library offers both in-memory and persistent disk caching. For more information, see the [token caching documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TOKEN_CACHING.md).



  An authentication broker is an application that runs on a user’s machine and manages the authentication handshakes and token maintenance for connected accounts. Currently, only the Windows Web Account Manager (WAM) is supported. To enable support, use the [`azure-identity-broker`][azure_identity_broker] package. For details on authenticating using WAM, see the [broker plugin documentation][azure_identity_broker_readme].



  See the [troubleshooting guide][troubleshooting_guide] for details on how to diagnose various failure scenarios.



  Credentials raise `CredentialUnavailableError` when they're unable to attempt authentication because they lack required data or state. For example, [EnvironmentCredential][environment_cred_ref] raises this exception when [its configuration](#environment-variables "its configuration") is incomplete.

  Credentials raise `azure.core.exceptions.ClientAuthenticationError` when they fail to authenticate. `ClientAuthenticationError` has a `message` attribute, which describes why authentication failed. When raised by `DefaultAzureCredential` or `ChainedTokenCredential`, the message collects error messages from each credential in the chain.

  For more information on handling specific Microsoft Entra ID errors, see the Microsoft Entra ID [error code documentation](https://learn.microsoft.com/entra/identity-platform/reference-error-codes).



  This library uses the standard [logging](https://docs.python.org/3/library/logging.html) library for logging. Credentials log basic information, including HTTP sessions (URLs, headers, etc.) at INFO level. These log entries don't contain authentication secrets.

  Detailed DEBUG-level logging, including request/response bodies and header values, isn't enabled by default. It can be enabled with the `logging_enable` argument. For example:

  ```python
  credential = DefaultAzureCredential(logging_enable=True)
  ```

  > CAUTION: DEBUG-level logs from credentials contain sensitive information.
  > These logs must be protected to avoid compromising account security.





  Client and management libraries listed on the [Azure SDK release page](https://azure.github.io/azure-sdk/releases/latest/python.html) that support Microsoft Entra authentication accept credentials from this library. You can learn more about using these libraries in their documentation, which is linked from the release page.



  This library doesn't support [Azure AD B2C][b2c].

  For other open issues, refer to the library's [GitHub repository](https://github.com/Azure/azure-sdk-for-python/issues?q=is%3Aopen+is%3Aissue+label%3AAzure.Identity).



  If you encounter bugs or have suggestions, [open an issue](https://github.com/Azure/azure-sdk-for-python/issues).



  This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit [https://cla.microsoft.com](https://cla.microsoft.com).

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You'll only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

  [auth_code_cred_ref]: https://aka.ms/azsdk/python/identity/authorizationcodecredential
  [az_pipelines_cred_ref]: https://aka.ms/azsdk/python/identity/azurepipelinescredential
  [azd_cli_cred_ref]: https://aka.ms/azsdk/python/identity/azuredeveloperclicredential
  [azure_cli]: https://learn.microsoft.com/cli/azure
  [azure_developer_cli]:https://aka.ms/azure-dev
  [azure_core_transport_doc]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport
  [azure_identity_broker]: https://pypi.org/project/azure-identity-broker
  [azure_identity_broker_readme]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity-broker
  [azure_eventhub]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/eventhub/azure-eventhub
  [azure_keyvault_secrets]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets
  [azure_storage_blob]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/storage/azure-storage-blob
  [b2c]: https://learn.microsoft.com/azure/active-directory-b2c/overview
  [cae]: https://learn.microsoft.com/entra/identity/conditional-access/concept-continuous-access-evaluation
  [cert_cred_ref]: https://aka.ms/azsdk/python/identity/certificatecredential
  [chain_cred_ref]: https://aka.ms/azsdk/python/identity/chainedtokencredential
  [cli_cred_ref]: https://aka.ms/azsdk/python/identity/azclicredential
  [client_assertion_cred_ref]: https://aka.ms/azsdk/python/identity/clientassertioncredential
  [client_secret_cred_ref]: https://aka.ms/azsdk/python/identity/clientsecretcredential
  [ctc_overview]: https://aka.ms/azsdk/python/identity/credential-chains#chainedtokencredential-overview
  [dac_overview]: https://aka.ms/azsdk/python/identity/credential-chains#defaultazurecredential-overview
  [default_cred_ref]: https://aka.ms/azsdk/python/identity/defaultazurecredential
  [device_code_cred_ref]: https://aka.ms/azsdk/python/identity/devicecodecredential
  [environment_cred_ref]: https://aka.ms/azsdk/python/identity/environmentcredential
  [interactive_cred_ref]: https://aka.ms/azsdk/python/identity/interactivebrowsercredential
  [managed_id_cred_ref]: https://aka.ms/azsdk/python/identity/managedidentitycredential
  [obo_cred_ref]: https://aka.ms/azsdk/python/identity/onbehalfofcredential
  [powershell_cred_ref]: https://aka.ms/azsdk/python/identity/powershellcredential
  [ref_docs]: https://aka.ms/azsdk/python/identity/docs
  [ref_docs_aio]: https://aka.ms/azsdk/python/identity/aio/docs
  [token_cred_ref]: https://learn.microsoft.com/python/api/azure-core/azure.core.credentials.tokencredential?view=azure-python
  [supports_token_info_ref]: https://learn.microsoft.com/python/api/azure-core/azure.core.credentials.supportstokeninfo?view=azure-python
  [troubleshooting_guide]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TROUBLESHOOTING.md
  [userpass_cred_ref]: https://aka.ms/azsdk/python/identity/usernamepasswordcredential
  [vscode_cred_ref]: https://aka.ms/azsdk/python/identity/vscodecredential
  [workload_id_cred_ref]: https://aka.ms/azsdk/python/identity/workloadidentitycredential

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fidentity%2Fazure-identity%2FREADME.png)








  - Fixed the request sent in `AzurePipelinesCredential` so it doesn't result in a redirect response when an invalid system access token is provided. ([#37510](https://github.com/Azure/azure-sdk-for-python/pull/37510))



  - Deprecated `AzureAuthorityHosts.AZURE_GERMANY`





  - All credentials now implement the `SupportsTokenInfo` or `AsyncSupportsTokenInfo` protocol. Each credential now has a `get_token_info` method which returns an `AccessTokenInfo` object. The `get_token_info` method is an alternative method to `get_token` that improves support for more complex authentication scenarios. ([#36882](https://github.com/Azure/azure-sdk-for-python/pull/36882))
      - Information on when a token should be refreshed is now saved in `AccessTokenInfo` (if available).



  - Added identity config validation to `ManagedIdentityCredential` to avoid non-deterministic states (e.g. both `resource_id` and `object_id` are specified). ([#36950](https://github.com/Azure/azure-sdk-for-python/pull/36950))
  - Additional validation was added for `ManagedIdentityCredential` in Azure Cloud Shell environments. ([#36438](https://github.com/Azure/azure-sdk-for-python/issues/36438))
  - Bumped minimum dependency on `azure-core` to `>=1.31.0`.





  - Added support of `send_certificate_chain` keyword argument when using certs with the synchronous `OnBehalfOfCredential`. ([#36810](https://github.com/Azure/azure-sdk-for-python/pull/36810))
  - `AzurePowerShellCredential` now supports using secure strings when authenticating with PowerShell. ([#36653](https://github.com/Azure/azure-sdk-for-python/pull/36653))



  - Fixed the issue that `SharedTokenCacheCredential` was not picklable.



  - The synchronous `ManagedIdentityCredential` was updated to use MSAL (Microsoft Authentication Library) for handling most of the underlying managed identity implementations.





  - Continue to attempt requesting token if the probing request receives non-json response. ([#36184](https://github.com/Azure/azure-sdk-for-python/pull/36184))





  > These changes do not impact the API of stable versions such as 1.16.0.
  > Only code written against a beta version such as 1.17.0b1 is affected.
  - `AzurePipelinesCredential` now has a required keyword argument `system_access_token`.  ([#35858](https://github.com/Azure/azure-sdk-for-python/pull/35858))



  - Allow credential chains to continue when an IMDS probe request returns a non-JSON response in `ManagedIdentityCredential`. ([#36016](https://github.com/Azure/azure-sdk-for-python/pull/36016))





  - `OnBehalfOfCredential` now supports client assertion callbacks through the `client_assertion_func` keyword argument. This enables authenticating with client assertions such as federated credentials.  ([#35812](https://github.com/Azure/azure-sdk-for-python/pull/35812))



  - Managed identity bug fixes





  - Managed identity bug fixes





  - Added environment variable `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN` support for `EnvironmentCredential`.
  - Introduced a new credential, `AzurePipelinesCredential`, for supporting workload identity federation in Azure Pipelines with service connections ([#35397](https://github.com/Azure/azure-sdk-for-python/pull/35397)).



  - Fixed typing errors when certain credentials are used as context managers. ([#35415](https://github.com/Azure/azure-sdk-for-python/pull/35415))





  - For IMDS requests in `ManagedIdentityCredential`, the retry backoff factor was reduced from 2 to 0.8 in order to avoid excessive retry delays and improve responsiveness. Users can customize this setting with the `retry_backoff_factor` parameter: `ManagedIdentityCredential(retry_backoff_factor=2)`.  ([#35070](https://github.com/Azure/azure-sdk-for-python/pull/35070))





  - Added pickling support. ([#34134](https://github.com/Azure/azure-sdk-for-python/pull/34134))



  - Fixed an issue in `AzurePowerShellCredential` where if `pwsh` isn't available and the Command Prompt language is not English, it would not fall back to `powershell`. ([#34271](https://github.com/Azure/azure-sdk-for-python/pull/34271))





  - Fixed the bug that `ClientAssertionCredential` constructor fails if kwargs are provided. ([#33673](https://github.com/Azure/azure-sdk-for-python/issues/33673))
  - `ManagedIdentityCredential` is more lenient with the error message it matches when falling through to the next credential in the chain in the case that Docker Desktop returns a 403 response when attempting to access the IMDS endpoint. ([#33928](https://github.com/Azure/azure-sdk-for-python/pull/33928))



  - `AzureCliCredential` utilizes the new `expires_on` property returned by `az` CLI versions >= 2.54.0 to determine token expiration. ([#33947](https://github.com/Azure/azure-sdk-for-python/issues/33947))
  - Azure-identity is supported on Python 3.8 or later.





  - Added bearer token provider.  ([#32655](https://github.com/Azure/azure-sdk-for-python/pull/32655))



  - Fixed issue InteractiveBrowserCredential does not hand over to next credential in chain if no browser is supported.([#32276](https://github.com/Azure/azure-sdk-for-python/pull/32276))





  - Added `enable_support_logging` as a keyword argument to credentials using MSAL's `PublicClientApplication`. This allows additional support logging which may contain PII. ([#32135](https://github.com/Azure/azure-sdk-for-python/pull/32135))



  > These changes do not impact the API of stable versions such as 1.14.0.
  > Only code written against a beta version such as 1.15.0b1 may be affected.
  - Windows Web Account Manager (WAM) Brokered Authentication is moved into another package.



  - `ManagedIdentityCredential` will now correctly retry when the instance metadata endpoint returns a 410 response.  ([#32200](https://github.com/Azure/azure-sdk-for-python/pull/32200))





  - Bug fixes for developer credentials





  - Added Windows Web Account Manager (WAM) Brokered Authentication support.
  - Added `enable_msa_passthrough` suppport for `InteractiveBrowserCredential`. By default `InteractiveBrowserCredential` only lists Microsoft Entra accounts. If you set `enable_msa_passthrough` to `True`, it lists both Microsoft Entra accounts and MSA outlook.com accounts that are logged in to Windows.



  - Ensure `AzurePowershellCredential` calls PowerShell with the `-NoProfile` flag to avoid loading user profiles for more consistent behavior.  ([#31682](https://github.com/Azure/azure-sdk-for-python/pull/31682))
  - Fixed an issue with subprocess-based developer credentials (such as AzureCliCredential) where the process would sometimes hang waiting for user input.  ([#31534](https://github.com/Azure/azure-sdk-for-python/pull/31534))
  - Fixed an issue with `ClientAssertionCredential` not properly checking if CAE should be enabled.  ([#31544](https://github.com/Azure/azure-sdk-for-python/pull/31544))
  - `ManagedIdentityCredential` will fall through to the next credential in the chain in the case that Docker Desktop returns a 403 response when attempting to access the IMDS endpoint.  ([#31824](https://github.com/Azure/azure-sdk-for-python/pull/31824))



  - Update typing of async credentials to match the `AsyncTokenCredential` protocol.
  - If within `DefaultAzureCredential`, `EnvironmentCredential` will now use log level INFO instead of WARNING to inform users of an incomplete environment configuration.  ([#31814](https://github.com/Azure/azure-sdk-for-python/pull/31814))
  - Strengthened `AzureCliCredential` and `AzureDeveloperCliCredential` error checking when determining if a user is logged in or not. Now, if an `AADSTS` error exists in the error, the full error message is propagated instead of a canned error message. ([#30047](https://github.com/Azure/azure-sdk-for-python/pull/30047))
  - `ManagedIdentityCredential` instances using IMDS will now be allowed to continue sending requests to the IMDS endpoint even after previous attempts failed. This is to prevent credential instances from potentially being permanently disabled after a temporary network failure.
  - IMDS endpoint probes in `ManagedIdentityCredential` will now only occur when inside a credential chain such as `DefaultAzureCredential`. This probe request timeout has been increased to 1 second from 0.3 seconds to reduce the likelihood of false negatives.





  - Continuous Access Evaluation (CAE) is now configurable per-request by setting the `enable_cae` keyword argument to `True` in `get_token`. This applies to user credentials and service principal credentials.  ([#30777](https://github.com/Azure/azure-sdk-for-python/pull/30777))



  - CP1 client capabilities for CAE is no longer always-on by default for user credentials. This capability will now be configured as-needed in each `get_token` request by each SDK.  ([#30777](https://github.com/Azure/azure-sdk-for-python/pull/30777))
    - Suffixes are now appended to persistent cache names to indicate whether CAE or non-CAE tokens are stored in the cache. This is to prevent CAE and non-CAE tokens from being mixed/overwritten in the same cache. This could potentially cause issues if you are trying to share the same cache between applications that are using different versions of the Azure Identity library as each application would be reading from a different cache file.
    - Since CAE is no longer always enabled for user-credentials, the `AZURE_IDENTITY_DISABLE_CP1` environment variable is no longer supported.



  - Credential types correctly implement `azure-core`'s `TokenCredential` protocol.  ([#25175](https://github.com/Azure/azure-sdk-for-python/issues/25175))





  - Added `workload_identity_tenant_id` support in `DefaultAzureCredential`.





  - Continue attempt next credential when finding an expired token from cached token credential in DefaultAzureCredential. ([#30441](https://github.com/Azure/azure-sdk-for-python/pull/30441))



  - VisualStudioCodeCredential prints an informative error message when used (as it is currently broken) ([#30385](https://github.com/Azure/azure-sdk-for-python/pull/30385))
  - Removed dependency on `six`. ([#30613](https://github.com/Azure/azure-sdk-for-python/pull/30613))





  > These changes do not impact the API of stable versions such as 1.12.0.
  > Only code written against a beta version such as 1.13.0b4 may be affected.
  - Windows Web Account Manager (WAM) Brokered Authentication is still in preview and not available in this release. It will be available in the next beta release.
  - Additional Continuous Access Evaluation (CAE) support for service principal credentials is still in preview and not available in this release. It will be available in the next beta release.
  - Renamed keyword argument `developer_credential_timeout` to `process_timeout` in `DefaultAzureCredential` to remain consistent with the other credentials that launch a subprocess to acquire tokens.





  - Credentials that are implemented via launching a subprocess to acquire tokens now have configurable timeouts using the `process_timeout` keyword argument. This addresses scenarios where these proceses can take longer than the current default timeout values. The affected credentials are `AzureCliCredential`, `AzureDeveloperCliCredential`, and `AzurePowerShellCredential`. (Note: For `DefaultAzureCredential`, the `developer_credential_timeout` keyword argument allows users to propagate this option to `AzureCliCredential`, `AzureDeveloperCliCredential`, and `AzurePowerShellCredential` in the authentication chain.) ([#28290](https://github.com/Azure/azure-sdk-for-python/pull/28290))





  - Changed parameter from `instance_discovery` to `disable_instance_discovery` to make it more explicit.
  - Service principal credentials now enable support for [Continuous Access Evaluation (CAE)](https://learn.microsoft.com/entra/identity/conditional-access/concept-continuous-access-evaluation-workload). This indicates to Microsoft Entra ID that your application can handle CAE claims challenges.





  - Added `AzureDeveloperCredential` for Azure Developer CLI. ([#27916](https://github.com/Azure/azure-sdk-for-python/pull/27916))
  - Added `WorkloadIdentityCredential` for Workload Identity Federation on Kubernetes ([#28536](https://github.com/Azure/azure-sdk-for-python/pull/28536))
  - Added support to use "TryAutoDetect" as the value for `AZURE_REGIONAL_AUTHORITY_NAME` to enable auto detecting the appropriate authority ([#526](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/526))





  - Added Windows Web Account Manager (WAM) Brokered Authentication support. ([#23687](https://github.com/Azure/azure-sdk-for-python/issues/23687))



  > These changes do not impact the API of stable versions such as 1.12.0.
  > Only code written against a beta version such as 1.12.0b1 may be affected.
  - Replaced `validate_authority` with `instance_discovery`. Now instead of setting validate_authority=False to disable authority validation and instance discovery, you need to use instance_discovery=False.



  - Fixed an issue where `AzureCliCredential` would return the wrong error message when the Azure CLI was not installed on non-English consoles. ([#27965](https://github.com/Azure/azure-sdk-for-python/issues/27965))





  - `AzureCliCredential` now works even when `az` prints warnings to stderr. ([#26857](https://github.com/Azure/azure-sdk-for-python/issues/26857)) (thanks to @micromaomao for the contribution)
  - Fixed issue where user-supplied `TokenCachePersistenceOptions` weren't propagated when using `SharedTokenCacheCredential` ([#26982](https://github.com/Azure/azure-sdk-for-python/issues/26982))



  - Excluded `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain by default as SDK
    authentication via Visual Studio Code is broken due to
    issue [#23249](https://github.com/Azure/azure-sdk-for-python/issues/23249). The `VisualStudioCodeCredential` will be
    re-enabled in the `DefaultAzureCredential` flow once a fix is in place.
    Issue [#25713](https://github.com/Azure/azure-sdk-for-python/issues/25713) tracks this. In the meantime
    Visual Studio Code users can authenticate their development environment using the [Azure CLI](https://learn.microsoft.com/cli/azure/).



  - Added Python 3.11 support and stopped supporting Python 3.6.



  1.12.0 release candidate





  - Added ability to specify `tenant_id` for `AzureCliCredential` & `AzurePowerShellCredential` (thanks @tikicoder)    ([#25207](https://github.com/Azure/azure-sdk-for-python/pull/25207))
  - Removed `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain. ([#23249](https://github.com/Azure/azure-sdk-for-python/issues/23249))
  - `EnvironmentCredential` added `AZURE_CLIENT_CERTIFICATE_PASSWORD` support for the cert password    ([#24652](https://github.com/Azure/azure-sdk-for-python/issues/24652))
  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))





  - Added `additionally_allowed_tenants` to the following credential options to force explicit opt-in behavior for multi-tenant authentication:
    - `AuthorizationCodeCredential`
    - `AzureCliCredential`
    - `AzurePowerShellCredential`
    - `CertificateCredential`
    - `ClientAssertionCredential`
    - `ClientSecretCredential`
    - `DefaultAzureCredential`
    - `OnBehalfOfCredential`
    - `UsernamePasswordCredential`
    - `VisualStudioCodeCredential`



  - Credential types supporting multi-tenant authentication will now throw `ClientAuthenticationError` if the requested tenant ID doesn't match the credential's tenant ID, and is not included in `additionally_allowed_tenants`. Applications must now explicitly add additional tenants to the `additionally_allowed_tenants` list, or add '*' to list, to enable acquiring tokens from tenants other than the originally specified tenant ID.

  More information on this change and the consideration behind it can be found [here](https://aka.ms/azsdk/blog/multi-tenant-guidance).

  - These beta features in 1.11.0b3 have been removed from this release and will be added back in 1.12.0b1
    - `tenant_id` for `AzureCliCredential`
    - removed `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain
    - `AZURE_CLIENT_CERTIFICATE_PASSWORD` support for `EnvironmentCredential`
    - `validate_authority` support



  Azure-identity is supported on Python 3.7 or later. For more details, please read our page on [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy).



  - Added ability to specify `tenant_id` for `AzureCliCredential` (thanks @tikicoder)    ([#25207](https://github.com/Azure/azure-sdk-for-python/pull/25207))



  - Removed `VisualStudioCodeCredential` from `DefaultAzureCredential` token chain. ([#23249](https://github.com/Azure/azure-sdk-for-python/issues/23249))





  - `EnvironmentCredential` added `AZURE_CLIENT_CERTIFICATE_PASSWORD` support for the cert password    ([#24652](https://github.com/Azure/azure-sdk-for-python/issues/24652))



  - Fixed the issue that failed to parse PEM certificate if it does not start with "-----"    ([#24643](https://github.com/Azure/azure-sdk-for-python/issues/24643))





  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))





  > These changes do not impact the API of stable versions such as 1.9.0.
  > Only code written against a beta version such as 1.10.0b1 may be affected.
  - `validate_authority` support is not available in 1.10.0.



  - Supported msal-extensions version 1.0.0    ([#23927](https://github.com/Azure/azure-sdk-for-python/issues/23927))





  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))





  - Added PII logging if logging.DEBUG is enabled.    ([#23203](https://github.com/Azure/azure-sdk-for-python/issues/23203))



  > These changes do not impact the API of stable versions such as 1.8.0.
  > Only code written against a beta version such as 1.9.0b1 may be affected.
  - `validate_authority` support is not available in 1.9.0.



  - Added check on `content` from msal response.    ([#23483](https://github.com/Azure/azure-sdk-for-python/issues/23483))
  - Fixed the issue that async OBO credential does not refresh correctly.    ([#21981](https://github.com/Azure/azure-sdk-for-python/issues/21981))



  - Removed `resource_id`, please use `identity_config` instead.
  - Renamed argument name `get_assertion` to `func` for `ClientAssertionCredential`.





  - Added `validate_authority` support for msal client  ([#22625](https://github.com/Azure/azure-sdk-for-python/issues/22625))
  - Added `resource_id` support for user-assigned managed identity  ([#22329](https://github.com/Azure/azure-sdk-for-python/issues/22329))
  - Added `ClientAssertionCredential` support  ([#22328](https://github.com/Azure/azure-sdk-for-python/issues/22328))
  - Updated App service API version to "2019-08-01" ([#23034](https://github.com/Azure/azure-sdk-for-python/issues/23034))





  - Handle injected "tenant_id" and "claims" ([#23138](https://github.com/Azure/azure-sdk-for-python/issues/23138))

    "tenant_id" argument in get_token() method is only supported by:

    - `AuthorizationCodeCredential`
    - `AzureCliCredential`
    - `AzurePowerShellCredential`
    - `InteractiveBrowserCredential`
    - `DeviceCodeCredential`
    - `EnvironmentCredential`
    - `UsernamePasswordCredential`

     it is ignored by other types of credentials.



  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.





  - Fix multi-tenant auth using async AadClient ([#21289](https://github.com/Azure/azure-sdk-for-python/issues/21289))




  > These changes do not impact the API of stable versions such as 1.6.0.
  > Only code written against a beta version such as 1.7.0b1 may be affected.

  - The `allow_multitenant_authentication` argument has been removed and the default behavior is now as if it were true.
    The multitenant authentication feature can be totally disabled by setting the environment variable
    `AZURE_IDENTITY_DISABLE_MULTITENANTAUTH` to `True`.
  - `azure.identity.RegionalAuthority` is removed.
  - `regional_authority` argument is removed for `CertificateCredential` and `ClientSecretCredential`.
  - `AzureApplicationCredential` is removed.
  - `client_credential` in the ctor of `OnBehalfOfCredential` is removed. Please use `client_secret` or `client_certificate` instead.
  - Make `user_assertion` in the ctor of `OnBehalfOfCredential` a keyword only argument.




  - `CertificateCredential` accepts certificates in PKCS12 format
    ([#13540](https://github.com/Azure/azure-sdk-for-python/issues/13540))
  - `OnBehalfOfCredential` supports the on-behalf-of authentication flow for
    accessing resources on behalf of users
    ([#19308](https://github.com/Azure/azure-sdk-for-python/issues/19308))
  - `DefaultAzureCredential` allows specifying the client ID of interactive browser via keyword argument `interactive_browser_client_id`
    ([#20487](https://github.com/Azure/azure-sdk-for-python/issues/20487))


  - Added context manager methods and `close()` to credentials in the
    `azure.identity` namespace. At the end of a `with` block, or when `close()`
    is called, these credentials close their underlying transport sessions.
    ([#18798](https://github.com/Azure/azure-sdk-for-python/issues/18798))





  - Persistent cache implementations are now loaded on demand, enabling
    workarounds when importing transitive dependencies such as pywin32
    fails
    ([#19989](https://github.com/Azure/azure-sdk-for-python/issues/19989))





  > These changes do not impact the API of stable versions such as 1.6.0.
  > Only code written against a beta version such as 1.7.0b1 may be affected.
  - Renamed `AZURE_POD_IDENTITY_TOKEN_URL` to `AZURE_POD_IDENTITY_AUTHORITY_HOST`.
    The value should now be a host, for example "http://169.254.169.254" (the
    default).


  - Fixed import of `azure.identity.aio.AzureApplicationCredential`
    ([#19943](https://github.com/Azure/azure-sdk-for-python/issues/19943))


  - Added `CustomHookPolicy` to credential HTTP pipelines. This allows applications
    to initialize credentials with `raw_request_hook` and `raw_response_hook`
    keyword arguments. The value of these arguments should be a callback taking a
    `PipelineRequest` and `PipelineResponse`, respectively. For example:
    `ManagedIdentityCredential(raw_request_hook=lambda request: print(request.http_request.url))`
  - Reduced redundant `ChainedTokenCredential` and `DefaultAzureCredential`
    logging. On Python 3.7+, credentials invoked by these classes now log debug
    rather than info messages.
    ([#18972](https://github.com/Azure/azure-sdk-for-python/issues/18972))
  - Persistent cache implementations are now loaded on demand, enabling
    workarounds when importing transitive dependencies such as pywin32
    fails
    ([#19989](https://github.com/Azure/azure-sdk-for-python/issues/19989))




  - `InteractiveBrowserCredential` keyword argument `login_hint` enables
    pre-filling the username/email address field on the login page
    ([#19225](https://github.com/Azure/azure-sdk-for-python/issues/19225))
  - `AzureApplicationCredential`, a default credential chain for applications
    deployed to Azure
    ([#19309](https://github.com/Azure/azure-sdk-for-python/issues/19309))


  - `azure.identity.aio.ManagedIdentityCredential` is an async context manager
    that closes its underlying transport session at the end of a `with` block


  - Most credentials can use tenant ID values returned from authentication
    challenges, enabling them to request tokens from the correct tenant. This
    behavior is optional and controlled by a new keyword argument,
    `allow_multitenant_authentication`.
    ([#19300](https://github.com/Azure/azure-sdk-for-python/issues/19300))
    - When `allow_multitenant_authentication` is False, which is the default, a
      credential will raise `ClientAuthenticationError` when its configured tenant
      doesn't match the tenant specified for a token request. This may be a
      different exception than was raised by prior versions of the credential. To
      maintain the prior behavior, set environment variable
      AZURE_IDENTITY_ENABLE_LEGACY_TENANT_SELECTION to "True".
  - `CertificateCredential` and `ClientSecretCredential` support regional STS
    on Azure VMs by either keyword argument `regional_authority` or environment
    variable `AZURE_REGIONAL_AUTHORITY_NAME`. See `azure.identity.RegionalAuthority`
    for possible values.
    ([#19301](https://github.com/Azure/azure-sdk-for-python/issues/19301))
  - Upgraded minimum `azure-core` version to 1.11.0 and minimum `msal` version to
    1.12.0
  - After IMDS authentication fails, `ManagedIdentityCredential` raises consistent
    error messages and uses `raise from` to propagate inner exceptions
    ([#19423](https://github.com/Azure/azure-sdk-for-python/pull/19423))


  Beginning with this release, this library requires Python 2.7 or 3.6+.


  - `VisualStudioCodeCredential` gets its default tenant and authority
    configuration from VS Code user settings
    ([#14808](https://github.com/Azure/azure-sdk-for-python/issues/14808))


  This is the last version to support Python 3.5. The next version will require
  Python 2.7 or 3.6+.


  - `AzurePowerShellCredential` authenticates as the identity logged in to Azure
    PowerShell. This credential is part of `DefaultAzureCredential` by default
    but can be disabled by a keyword argument:
    `DefaultAzureCredential(exclude_powershell_credential=True)`
    ([#17341](https://github.com/Azure/azure-sdk-for-python/issues/17341))


  - `AzureCliCredential` raises `CredentialUnavailableError` when the CLI times out,
    and kills timed out subprocesses
  - Reduced retry delay for `ManagedIdentityCredential` on Azure VMs



  > These changes do not impact the API of stable versions such as 1.5.0.
  > Only code written against a beta version such as 1.6.0b1 may be affected.
  - Removed property `AuthenticationRequiredError.error_details`


  - Credentials consistently retry token requests after connection failures, or
    when instructed to by a Retry-After header
  - ManagedIdentityCredential caches tokens correctly


  - `InteractiveBrowserCredential` functions in more WSL environments
    ([#17615](https://github.com/Azure/azure-sdk-for-python/issues/17615))



  > These changes do not impact the API of stable versions such as 1.5.0.
  > Only code written against a beta version such as 1.6.0b1 may be affected.
  - Renamed `CertificateCredential` keyword argument `certificate_bytes` to
    `certificate_data`
  - Credentials accepting keyword arguments `allow_unencrypted_cache` and
    `enable_persistent_cache` to configure persistent caching accept a
    `cache_persistence_options` argument instead whose value should be an
    instance of `TokenCachePersistenceOptions`. For example:
    ```
    
    DeviceCodeCredential(enable_persistent_cache=True, allow_unencrypted_cache=True)

    
    cache_options = TokenCachePersistenceOptions(allow_unencrypted_storage=True)
    DeviceCodeCredential(cache_persistence_options=cache_options)
    ```

    See the documentation and samples for more details.


  - New class `TokenCachePersistenceOptions` configures persistent caching
  - The `AuthenticationRequiredError.claims` property provides any additional
    claims required by a user credential's `authenticate()` method



  - Raised minimum msal version to 1.7.0
  - Raised minimum six version to 1.12.0


  - `InteractiveBrowserCredential` uses PKCE internally to protect authorization
    codes
  - `CertificateCredential` can load a certificate from bytes instead of a file
    path. To provide a certificate as bytes, use the keyword argument
    `certificate_bytes` instead of `certificate_path`, for example:
    `CertificateCredential(tenant_id, client_id, certificate_bytes=cert_bytes)`
    ([#14055](https://github.com/Azure/azure-sdk-for-python/issues/14055))
  - User credentials support Continuous Access Evaluation (CAE)
  - Application authentication APIs from 1.5.0b2


  - `ManagedIdentityCredential` correctly parses responses from the current
    (preview) version of Azure ML managed identity
    ([#15361](https://github.com/Azure/azure-sdk-for-python/issues/15361))



  - Renamed optional `CertificateCredential` keyword argument `send_certificate`
    (added in 1.5.0b1) to `send_certificate_chain`
  - Removed user authentication APIs added in prior betas. These will be
    reintroduced in 1.6.0b1. Passing the keyword arguments below
    generally won't cause a runtime error, but the arguments have no effect.
    ([#14601](https://github.com/Azure/azure-sdk-for-python/issues/14601))
    - Removed `authenticate` method from `DeviceCodeCredential`,
      `InteractiveBrowserCredential`, and `UsernamePasswordCredential`
    - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword
      arguments from `CertificateCredential`, `ClientSecretCredential`,
      `DeviceCodeCredential`, `InteractiveBrowserCredential`, and
      `UsernamePasswordCredential`
    - Removed `disable_automatic_authentication` keyword argument from
      `DeviceCodeCredential` and `InteractiveBrowserCredential`
    - Removed `allow_unencrypted_cache` keyword argument from
      `SharedTokenCacheCredential`
    - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError`
  - Removed `identity_config` keyword argument from `ManagedIdentityCredential`
    (was added in 1.5.0b1)


  - `DeviceCodeCredential` parameter `client_id` is now optional. When not
     provided, the credential will authenticate users to an Azure development
     application.
     ([#14354](https://github.com/Azure/azure-sdk-for-python/issues/14354))
  - Credentials raise `ValueError` when constructed with tenant IDs containing
    invalid characters
    ([#14821](https://github.com/Azure/azure-sdk-for-python/issues/14821))
  - Raised minimum msal version to 1.6.0


  - `ManagedIdentityCredential` supports Service Fabric
    ([#12705](https://github.com/Azure/azure-sdk-for-python/issues/12705))
    and Azure Arc
    ([#12702](https://github.com/Azure/azure-sdk-for-python/issues/12702))


  - Prevent `VisualStudioCodeCredential` using invalid authentication data when
    no user is signed in to Visual Studio Code
    ([#14438](https://github.com/Azure/azure-sdk-for-python/issues/14438))
  - `ManagedIdentityCredential` uses the API version supported by Azure Functions
    on Linux consumption hosting plans
    ([#14670](https://github.com/Azure/azure-sdk-for-python/issues/14670))
  - `InteractiveBrowserCredential.get_token()` raises a clearer error message when
    it times out waiting for a user to authenticate on Python 2.7
    ([#14773](https://github.com/Azure/azure-sdk-for-python/pull/14773))



  - `AzureCliCredential.get_token` correctly sets token expiration time,
    preventing clients from using expired tokens
    ([#14345](https://github.com/Azure/azure-sdk-for-python/issues/14345))


  - Adopted msal-extensions 0.3.0
  ([#13107](https://github.com/Azure/azure-sdk-for-python/issues/13107))



  - `AzureCliCredential.get_token` correctly sets token expiration time,
    preventing clients from using expired tokens
    ([#14345](https://github.com/Azure/azure-sdk-for-python/issues/14345))



  - Application authentication APIs from 1.4.0b7
  - `ManagedIdentityCredential` supports the latest version of App Service
    ([#11346](https://github.com/Azure/azure-sdk-for-python/issues/11346))
  - `DefaultAzureCredential` allows specifying the client ID of a user-assigned
    managed identity via keyword argument `managed_identity_client_id`
    ([#12991](https://github.com/Azure/azure-sdk-for-python/issues/12991))
  - `CertificateCredential` supports Subject Name/Issuer authentication when
    created with `send_certificate=True`. The async `CertificateCredential`
    (`azure.identity.aio.CertificateCredential`) will support this in a
    future version.
    ([#10816](https://github.com/Azure/azure-sdk-for-python/issues/10816))
  - Credentials in `azure.identity` support ADFS authorities, excepting
    `VisualStudioCodeCredential`. To configure a credential for this, configure
    the credential with `authority` and `tenant_id="adfs"` keyword arguments, for
    example
    `ClientSecretCredential(authority="<your ADFS URI>", tenant_id="adfs")`.
    Async credentials (those in `azure.identity.aio`) will support ADFS in a
    future release.
    ([#12696](https://github.com/Azure/azure-sdk-for-python/issues/12696))
  - `InteractiveBrowserCredential` keyword argument `redirect_uri` enables
    authentication with a user-specified application having a custom redirect URI
    ([#13344](https://github.com/Azure/azure-sdk-for-python/issues/13344))


  - Removed `authentication_record` keyword argument from the async
    `SharedTokenCacheCredential`, i.e. `azure.identity.aio.SharedTokenCacheCredential`



  - `DefaultAzureCredential` uses the value of environment variable
  `AZURE_CLIENT_ID` to configure a user-assigned managed identity.
  ([#10931](https://github.com/Azure/azure-sdk-for-python/issues/10931))


  - Renamed `VSCodeCredential` to `VisualStudioCodeCredential`
  - Removed application authentication APIs added in 1.4.0 beta versions. These
    will be reintroduced in 1.5.0b1. Passing the keyword arguments below
    generally won't cause a runtime error, but the arguments have no effect.
    - Removed `authenticate` method from `DeviceCodeCredential`,
      `InteractiveBrowserCredential`, and `UsernamePasswordCredential`
    - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword
      arguments from `CertificateCredential`, `ClientSecretCredential`,
      `DeviceCodeCredential`, `InteractiveBrowserCredential`, and
      `UsernamePasswordCredential`
    - Removed `disable_automatic_authentication` keyword argument from
      `DeviceCodeCredential` and `InteractiveBrowserCredential`
    - Removed `allow_unencrypted_cache` keyword argument from
      `SharedTokenCacheCredential`
    - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError`
    - Removed `identity_config` keyword argument from `ManagedIdentityCredential`


  - `DefaultAzureCredential` has a new optional keyword argument,
  `visual_studio_code_tenant_id`, which sets the tenant the credential should
  authenticate in when authenticating as the Azure user signed in to Visual
  Studio Code.
  - Renamed `AuthenticationRecord.deserialize` positional parameter `json_string`
  to `data`.



  - `AzureCliCredential` no longer raises an exception due to unexpected output
    from the CLI when run by PyCharm (thanks @NVolcz)
    ([#11362](https://github.com/Azure/azure-sdk-for-python/pull/11362))
  - Upgraded minimum `msal` version to 1.3.0
  - The async `AzureCliCredential` correctly invokes `/bin/sh`
    ([#12048](https://github.com/Azure/azure-sdk-for-python/issues/12048))


  - Prevent an error on importing `AzureCliCredential` on Windows caused by a bug
    in old versions of Python 3.6 (this bug was fixed in Python 3.6.5).
    ([#12014](https://github.com/Azure/azure-sdk-for-python/issues/12014))
  - `SharedTokenCacheCredential.get_token` raises `ValueError` instead of
    `ClientAuthenticationError` when called with no scopes.
    ([#11553](https://github.com/Azure/azure-sdk-for-python/issues/11553))


  - `ManagedIdentityCredential` can configure a user-assigned identity using any
    identifier supported by the current hosting environment. To specify an
    identity by its client ID, continue using the `client_id` argument. To
    specify an identity by any other ID, use the `identity_config` argument,
    for example: `ManagedIdentityCredential(identity_config={"object_id": ".."})`
    ([#10989](https://github.com/Azure/azure-sdk-for-python/issues/10989))
  - `CertificateCredential` and `ClientSecretCredential` can optionally store
    access tokens they acquire in a persistent cache. To enable this, construct
    the credential with `enable_persistent_cache=True`. On Linux, the persistent
    cache requires libsecret and `pygobject`. If these are unavailable or
    unusable (e.g. in an SSH session), loading the persistent cache will raise an
    error. You may optionally configure the credential to fall back to an
    unencrypted cache by constructing it with keyword argument
    `allow_unencrypted_cache=True`.
    ([#11347](https://github.com/Azure/azure-sdk-for-python/issues/11347))
  - `AzureCliCredential` raises `CredentialUnavailableError` when no user is
    logged in to the Azure CLI.
    ([#11819](https://github.com/Azure/azure-sdk-for-python/issues/11819))
  - `AzureCliCredential` and `VSCodeCredential`, which enable authenticating as
    the identity signed in to the Azure CLI and Visual Studio Code, respectively,
    can be imported from `azure.identity` and `azure.identity.aio`.
  - `azure.identity.aio.AuthorizationCodeCredential.get_token()` no longer accepts
    optional keyword arguments `executor` or `loop`. Prior versions of the method
    didn't use these correctly, provoking exceptions, and internal changes in this
    version have made them obsolete.
  - `InteractiveBrowserCredential` raises `CredentialUnavailableError` when it
    can't start an HTTP server on `localhost`.
    ([#11665](https://github.com/Azure/azure-sdk-for-python/pull/11665))
  - When constructing `DefaultAzureCredential`, you can now configure a tenant ID
    for `InteractiveBrowserCredential`. When none is specified, the credential
    authenticates users in their home tenants. To specify a different tenant, use
    the keyword argument `interactive_browser_tenant_id`, or set the environment
    variable `AZURE_TENANT_ID`.
    ([#11548](https://github.com/Azure/azure-sdk-for-python/issues/11548))
  - `SharedTokenCacheCredential` can be initialized with an `AuthenticationRecord`
    provided by a user credential.
    ([#11448](https://github.com/Azure/azure-sdk-for-python/issues/11448))
  - The user authentication API added to `DeviceCodeCredential` and
    `InteractiveBrowserCredential` in 1.4.0b3 is available on
    `UsernamePasswordCredential` as well.
    ([#11449](https://github.com/Azure/azure-sdk-for-python/issues/11449))
  - The optional persistent cache for `DeviceCodeCredential` and
    `InteractiveBrowserCredential` added in 1.4.0b3 is now available on Linux and
    macOS as well as Windows.
    ([#11134](https://github.com/Azure/azure-sdk-for-python/issues/11134))
    - On Linux, the persistent cache requires libsecret and `pygobject`. If these
      are unavailable, or libsecret is unusable (e.g. in an SSH session), loading
      the persistent cache will raise an error. You may optionally configure the
      credential to fall back to an unencrypted cache by constructing it with
      keyword argument `allow_unencrypted_cache=True`.


  - `EnvironmentCredential` correctly initializes `UsernamePasswordCredential`
  with the value of `AZURE_TENANT_ID`
  ([#11127](https://github.com/Azure/azure-sdk-for-python/pull/11127))
  - Values for the constructor keyword argument `authority` and
  `AZURE_AUTHORITY_HOST` may optionally specify an "https" scheme. For example,
  "https://login.microsoftonline.us" and "login.microsoftonline.us" are both valid.
  ([#10819](https://github.com/Azure/azure-sdk-for-python/issues/10819))
  - First preview of new API for authenticating users with `DeviceCodeCredential`
    and `InteractiveBrowserCredential`
    ([#10612](https://github.com/Azure/azure-sdk-for-python/pull/10612))
    - new method `authenticate` interactively authenticates a user, returns a
      serializable `AuthenticationRecord`
    - new constructor keyword arguments
      - `authentication_record` enables initializing a credential with an
        `AuthenticationRecord` from a prior authentication
      - `disable_automatic_authentication=True` configures the credential to raise
      `AuthenticationRequiredError` when interactive authentication is necessary
      to acquire a token rather than immediately begin that authentication
      - `enable_persistent_cache=True` configures these credentials to use a
      persistent cache on supported platforms (in this release, Windows only).
      By default they cache in memory only.
  - Now `DefaultAzureCredential` can authenticate with the identity signed in to
  Visual Studio Code's Azure extension.
  ([#10472](https://github.com/Azure/azure-sdk-for-python/issues/10472))


  - After an instance of `DefaultAzureCredential` successfully authenticates, it
  uses the same authentication method for every subsequent token request. This
  makes subsequent requests more efficient, and prevents unexpected changes of
  authentication method.
  ([#10349](https://github.com/Azure/azure-sdk-for-python/pull/10349))
  - All `get_token` methods consistently require at least one scope argument,
  raising an error when none is passed. Although `get_token()` may sometimes
  have succeeded in prior versions, it couldn't do so consistently because its
  behavior was undefined, and dependened on the credential's type and internal
  state. ([#10243](https://github.com/Azure/azure-sdk-for-python/issues/10243))
  - `SharedTokenCacheCredential` raises `CredentialUnavailableError` when the
  cache is available but contains ambiguous or insufficient information. This
  causes `ChainedTokenCredential` to correctly try the next credential in the
  chain. ([#10631](https://github.com/Azure/azure-sdk-for-python/issues/10631))
  - The host of the Active Directory endpoint credentials should use can be set
  in the environment variable `AZURE_AUTHORITY_HOST`. See
  `azure.identity.KnownAuthorities` for a list of common values.
  ([#8094](https://github.com/Azure/azure-sdk-for-python/issues/8094))




  - `ManagedIdentityCredential` raises `CredentialUnavailableError` when no
  identity is configured for an IMDS endpoint. This causes
  `ChainedTokenCredential` to correctly try the next credential in the chain.
  ([#10488](https://github.com/Azure/azure-sdk-for-python/issues/10488))



  - `DefaultAzureCredential` can now authenticate using the identity logged in to
  the Azure CLI, unless explicitly disabled with a keyword argument:
  `DefaultAzureCredential(exclude_cli_credential=True)`
  ([#10092](https://github.com/Azure/azure-sdk-for-python/pull/10092))




  - Correctly parse token expiration time on Windows App Service
  ([#9393](https://github.com/Azure/azure-sdk-for-python/issues/9393))
  - Credentials raise `CredentialUnavailableError` when they can't attempt to
  authenticate due to missing data or state
  ([#9372](https://github.com/Azure/azure-sdk-for-python/pull/9372))
  - `CertificateCredential` supports password-protected private keys
  ([#9434](https://github.com/Azure/azure-sdk-for-python/pull/9434))




  - All credential pipelines include `ProxyPolicy`
  ([#8945](https://github.com/Azure/azure-sdk-for-python/pull/8945))
  - Async credentials are async context managers and have an async `close` method
  ([#9090](https://github.com/Azure/azure-sdk-for-python/pull/9090))




  - Constructing `DefaultAzureCredential` no longer raises `ImportError` on Python
  3.8 on Windows ([8294](https://github.com/Azure/azure-sdk-for-python/pull/8294))
  - `InteractiveBrowserCredential` raises when unable to open a web browser
  ([8465](https://github.com/Azure/azure-sdk-for-python/pull/8465))
  - `InteractiveBrowserCredential` prompts for account selection
  ([8470](https://github.com/Azure/azure-sdk-for-python/pull/8470))
  - The credentials composing `DefaultAzureCredential` are configurable by keyword
  arguments ([8514](https://github.com/Azure/azure-sdk-for-python/pull/8514))
  - `SharedTokenCacheCredential` accepts an optional `tenant_id` keyword argument
  ([8689](https://github.com/Azure/azure-sdk-for-python/pull/8689))




  - `ClientCertificateCredential` uses application and tenant IDs correctly
  ([8315](https://github.com/Azure/azure-sdk-for-python/pull/8315))
  - `InteractiveBrowserCredential` properly caches tokens
  ([8352](https://github.com/Azure/azure-sdk-for-python/pull/8352))
  - Adopted msal 1.0.0 and msal-extensions 0.1.3
  ([8359](https://github.com/Azure/azure-sdk-for-python/pull/8359))




  - Async credentials now default to [`aiohttp`](https://pypi.org/project/aiohttp/)
  for transport but the library does not require it as a dependency because the
  async API is optional. To use async credentials, please install
  [`aiohttp`](https://pypi.org/project/aiohttp/) or see
  [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md#transport)
  for information about customizing the transport.
  - Renamed `ClientSecretCredential` parameter "`secret`" to "`client_secret`"
  - All credentials with `tenant_id` and `client_id` positional parameters now accept them in that order
  - Changes to `InteractiveBrowserCredential` parameters
    - positional parameter `client_id` is now an optional keyword argument. If no value is provided,
  the Azure CLI's client ID will be used.
    - Optional keyword argument `tenant` renamed `tenant_id`
  - Changes to `DeviceCodeCredential`
    - optional positional parameter `prompt_callback` is now a keyword argument
    - `prompt_callback`'s third argument is now a `datetime` representing the
    expiration time of the device code
    - optional keyword argument `tenant` renamed `tenant_id`
  - Changes to `ManagedIdentityCredential`
    - now accepts no positional arguments, and only one keyword argument:
    `client_id`
    - transport configuration is now done through keyword arguments as
    described in
    [`azure-core` documentation](https://github.com/Azure/azure-sdk-for-python/blob/azure-identity_1.0.0/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport)


  - Authenticating with a single sign-on shared with other Microsoft applications
  only requires a username when multiple users have signed in
  ([#8095](https://github.com/Azure/azure-sdk-for-python/pull/8095))
  - `DefaultAzureCredential` accepts an `authority` keyword argument, enabling
  its use in national clouds
  ([#8154](https://github.com/Azure/azure-sdk-for-python/pull/8154))


  - Adopted [`msal_extensions`](https://pypi.org/project/msal-extensions/) 0.1.2
  - Constrained [`msal`](https://pypi.org/project/msal/) requirement to >=0.4.1,
  <1.0.0




  - `AuthorizationCodeCredential` authenticates with a previously obtained
  authorization code. See Microsoft Entra's
  [authorization code documentation](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)
  for more information about this authentication flow.
  - Multi-cloud support: client credentials accept the authority of an Azure Active
  Directory authentication endpoint as an `authority` keyword argument. Known
  authorities are defined in `azure.identity.KnownAuthorities`. The default
  authority is for Azure Public Cloud, `login.microsoftonline.com`
  (`KnownAuthorities.AZURE_PUBLIC_CLOUD`). An application running in Azure
  Government would use `KnownAuthorities.AZURE_GOVERNMENT` instead:
  >```
  >from azure.identity import DefaultAzureCredential, KnownAuthorities
  >credential = DefaultAzureCredential(authority=KnownAuthorities.AZURE_GOVERNMENT)
  >```


  - Removed `client_secret` parameter from `InteractiveBrowserCredential`


  - `UsernamePasswordCredential` correctly handles environment configuration with
  no tenant information ([#7260](https://github.com/Azure/azure-sdk-for-python/pull/7260))
  - user realm discovery requests are sent through credential pipelines
  ([#7260](https://github.com/Azure/azure-sdk-for-python/pull/7260))




  - `SharedTokenCacheCredential` authenticates with tokens stored in a local
  cache shared by Microsoft applications. This enables Azure SDK clients to
  authenticate silently after you've signed in to Visual Studio 2019, for
  example. `DefaultAzureCredential` includes `SharedTokenCacheCredential` when
  the shared cache is available, and environment variable `AZURE_USERNAME`
  is set. See the
  [README](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md#single-sign-on)
  for more information.


  - New dependency: [`msal-extensions`](https://pypi.org/project/msal-extensions/)
  0.1.1



  - Removed `azure.core.Configuration` from the public API in preparation for a
  revamped configuration API. Static `create_config` methods have been renamed
  `_create_config`, and will be removed in a future release.


  - Adopted [azure-core](https://pypi.org/project/azure-core/) 1.0.0b2
    - If you later want to revert to a version requiring azure-core 1.0.0b1,
    of this or another Azure SDK library, you must explicitly install azure-core
    1.0.0b1 as well. For example:
    `pip install azure-core==1.0.0b1 azure-identity==1.0.0b1`
  - Adopted [MSAL](https://pypi.org/project/msal/) 0.4.1
  - New dependency for Python 2.7: [mock](https://pypi.org/project/mock/)


  - Added credentials for authenticating users:
   - `DeviceCodeCredential`
   - `InteractiveBrowserCredential`
   - `UsernamePasswordCredential`
    - async versions of these credentials will be added in a future release


  Version 1.0.0b1 is the first preview of our efforts to create a user-friendly
  and Pythonic authentication API for Azure SDK client libraries. For more
  information about preview releases of other Azure SDK libraries, please visit
  https://aka.ms/azure-sdk-preview1-python.

  This release supports service principal and managed identity authentication.
  See the
  [documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md)
  for more details. User authentication will be added in an upcoming preview
  release.

  This release supports only global Microsoft Entra tenants, i.e. those
  using the https://login.microsoftonline.com authentication endpoint.


pkgId: c6c35f786b9d899f311a45251aebe1d6868d90c27702dfeb5785b985e4958580
name: python-azure-identity-broker
arch: src
version: 1.2.0
epoch: 0
release: 1
summary: Microsoft Azure Identity Broker plugin for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity-broker
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-identity-broker-1.2.0-1.src.rpm
checksum_type: sha256
description:
  This package extends the [Azure Identity][azure_identity] library by providing supplemental credentials for authenticating via an authentication broker.

  An authentication broker is an application that runs on a user’s machine that manages the authentication handshakes and token maintenance for connected accounts. Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported.

  [Source code][source_code] | [Package (PyPI)][azure_identity_broker] | [API reference documentation][ref_docs] | [Microsoft Entra ID documentation][entra_id]





  Install the Azure Identity Broker plugin for Python with [pip][pip]:

  ```bash
  pip install azure-identity-broker
  ```



  This package enables broker support via `InteractiveBrowserBrokerCredential` which is a subclass of the `InteractiveBrowserCredential` of the Azure Identity library.



  When authenticating interactively via `InteractiveBrowserBrokerCredential`, a parent window handle is required to ensure that the authentication dialog is shown correctly over the requesting window. In the context of graphical user interfaces on devices, a window handle is a unique identifier that the operating system assigns to each window. For the Windows operating system, this handle is an integer value that serves as a reference to a specific window.



  Microsoft accounts (MSA) are personal accounts created by users to access Microsoft services. MSA passthrough is a legacy configuration which enables users to get tokens to resources which normally don't accept MSA logins. This feature is only available to first-party applications. Users authenticating with an application that is configured to use MSA passthrough can set `enable_msa_passthrough` to `True` inside `InteractiveBrowserBrokerCredential` to allow these personal accounts to be listed by WAM.



  Microsoft Entra applications rely on redirect URIs to determine where to send the authentication response after a user has logged in. To enable brokered authentication through WAM, a redirect URI matching the following pattern should be registered to the application:

  ```
  ms-appx-web://Microsoft.AAD.BrokerPlugin/{client_id}
  ```





  This example demonstrates using `InteractiveBrowserBrokerCredential` as a broker-enabled credential for authenticating with the `BlobServiceClient` from the [azure-storage-blob][azure_storage_blob] library. Here, the `win32gui` module from the `pywin32` package is used to get the current window.

  ```python
  import win32gui
  from azure.identity.broker import InteractiveBrowserBrokerCredential
  from azure.storage.blob import BlobServiceClient


  current_window_handle = win32gui.GetForegroundWindow()

  credential = InteractiveBrowserBrokerCredential(parent_window_handle=current_window_handle)
  client = BlobServiceClient(account_url, credential=credential)
  ```

  To bypass the account selection dialog and use the default broker account, set the `use_default_broker_account` argument to `True`. The credential will attempt to silently use the default broker account. If using the default account fails, the credential will fall back to interactive authentication.

  ```python
  credential = InteractiveBrowserBrokerCredential(
      parent_window_handle=current_window_handle,
      use_default_broker_account=True
  )
  ```



  See the Azure Identity [troubleshooting guide][troubleshooting_guide] for details on how to diagnose various failure scenarios.





  Client and management libraries listed on the [Azure SDK release page](https://azure.github.io/azure-sdk/releases/latest/python.html) that support Microsoft Entra authentication accept credentials from this library. You can learn more about using these libraries in their documentation, which is linked from the release page.



  This library doesn't support [Azure AD B2C][b2c].

  For other open issues, refer to the library's [GitHub repository](https://github.com/Azure/azure-sdk-for-python/issues?q=is%3Aopen+is%3Aissue+label%3AAzure.Identity).



  If you encounter bugs or have suggestions, [open an issue](https://github.com/Azure/azure-sdk-for-python/issues).



  This project welcomes contributions and suggestions.  Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

  <!-- LINKS -->
  [azure_identity]: https://pypi.org/project/azure-identity
  [azure_identity_broker]: https://pypi.org/project/azure-identity-broker
  [azure_storage_blob]: https://pypi.org/project/azure-storage-blob
  [b2c]: https://learn.microsoft.com/azure/active-directory-b2c/overview
  [entra_id]: https://learn.microsoft.com/entra/identity/
  [pip]: https://pypi.org/project/pip
  [ref_docs]: https://azuresdkdocs.blob.core.windows.net/$web/python/azure-identity-broker/latest/index.html
  [source_code]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity-broker
  [troubleshooting_guide]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TROUBLESHOOTING.md








  - Stable release for the Proof-of-Possession (PoP) token support to `InteractiveBrowserBrokerCredential`.





  - `InteractiveBrowserBrokerCredential` now implements the `SupportsTokenInfo` protocol. It now has a `get_token_info` method which returns an `AccessTokenInfo` object. The `get_token_info` method is an alternative method to `get_token` that improves support for more complex authentication scenarios.
  - Added Proof-of-Possession (PoP) token support to `InteractiveBrowserBrokerCredential`.





  - `InteractiveBrowserBrokerCredential` now supports a `use_default_broker_account` property to enable the use of the currently logged in operating system account for authentication rather than prompting for a credential.
  - Added `enable_support_logging` as a keyword argument to `InteractiveBrowserBrokerCredential`. This allows additional support logging which may contain PII.



  - Python 3.7 is no longer supported. Please use Python version 3.8 or later.
  - Bumped minimum dependency on `azure-identity` to `1.15.0`.





  - `enable_broker` is always on if running on Windows. Automatically fall back into non-broker mode if running on MacOS or Linux.



  - Removed `UsernamePasswordBrokerCredential`





  - Added `azure.identity.broker.InteractiveBrowserBrokerCredential`
    and `azure.identity.broker.UsernamePasswordBrokerCredential` which have broker support.


pkgId: 698ab9d48b6adca067ab797793a2692afdab4b529f81ecdc2d43fcb3f48932bd
name: python-azure-img-utils
arch: src
version: 2.3.0
epoch: 0
release: 1
summary: Package that provides utilities for handling images in Azure Cloud.
url: https://github.com/SUSE-Enceladus/azure-img-utils
rpm_license: GPLv3+
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-img-utils-2.3.0-1.src.rpm
checksum_type: sha256
description:
  **azure-img-utils** provides a command line utility and API for publishing
  images in the Azure Cloud. This includes helper functions for uploading
  image blobs, creating compute images and publish/share images across
  all available regions.

  See the [Azure docs](https://docs.microsoft.com/en-us/azure/) to get
  more info on the Azure cloud.



  The requirements for the project can be found in the following repo files:
  - [requirements](requirement.txt)
  - [requirements for testing](requirement-test.txt)
  - [requirements for development](requirement-dev.txt)



  To install the package on openSUSE and SLES use the following commands as root:

  ```shell



  ```

  To install from PyPI:

  ```shell
  $ pip install azure-img-utils
  ```



  **azure-img-utils** can be configured with yaml based profiles. The configuration
  directory is `~/.config/azure_img_utils` and the default profile is default.yaml
  (~/.config/azure_img_utils/default.yaml).

  The following configration options are available in a configuration profile:

  - no_color
  - log_level
  - credentials_file
  - resource_group
  - region
  - container
  - storage_account


  An example configuration profile may look like:

  ```yaml
  region: westus
  no_color: True
  credentials_file: mycredentials.json
  container: my_container
  ```

  When running any command the profile can be chosen via the *--profile* option.
  For example, *azure-img-utils image blobexists --profile production* would pull
  configuration from ~/.config/azure_img_utils/production.yaml.




  The CLI is broken into multiple distinct subcommands that handle different
  steps of creating and publishing images in the Azure cloud framework.



  This cli tool expects the user to provide a json file containing the
  credentials of a service principal to access his/her Azure services.

  Per Azure documentation:
  > An Azure service principal is an identity created for use with applications,
  > hosted services, and automated tools to access Azure resources.

  [Here](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli)
  you can find how to create a service principal with the azure cli.

  With your subscriptionId, the resourceGroupId and the required permissions, you can
  create the service principal with the following command:

  ```sh
  az ad sp create-for-rbac \
          --sdk-auth \
          --role Contributor \
          --scopes /subscriptions/{YOUR_SUSCRI_ID}/resourceGroups/{YOUR_RES_GROUP_ID} \
          --name "YOUR_SP_NAME" > mycredentials.json
  ```

  The expected format for the json file is the output for that *create-for-rbac* az
  command. Note that the API this repo provides allows additional methods of
  authentication, but these are not supported in this CLI tool.




  Group of commands for blob management.



  This subcommand allows the user to check if a blob exists in the storage
  container specified. The subcommand is *azure-img-utils blob exists*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --storage-account
  - --blob-name
  - --container

  Example:

  ```shell
  $ azure-img-utils blob exists --storage-account myStorageAccount \
                                --blob-name myBlobName \
                                --container myContainerName
  ```

  This command will output *true* or *false* depending on the existence of the
  blob.

  For more information about the blob exists command see the help message:

  ```shell
  $ azure-img-utils blob exists --help
  ```



  This subcommand allows the user to upload a file as a blob to the storage
  container specified. The subcommand is *azure-img-utils blob upload*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --storage-account
  - --blob-name
  - --container
  - --image-file

  Some *optional* parameters for the execution of the command include:
  - --force-replace-image  (defaults to False)
  - --page-blob            (defaults to False)
  - --expand-image         (defaults to False)
  - --max-workers          (defaults to 5(no limit))
  - --max-attempts   (defaults to 5(no limit))


  Example:

  ```shell
  $ azure-img-utils blob upload --storage-account myStorageAccount \
                                --blob-name myBlobName \
                                --container myContainerName \
                                --image-file myImageFile.qcow2
  ```

  This command will output if the upload has been successful or not.

  For more information about the blob upload command see the help message:

  ```shell
  $ azure-img-utils blob upload --help
  ```



  This subcommand allows the user to delete a blob file from the storage
  container specified. The subcommand is *azure-img-utils blob delete*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --storage-account
  - --blob-name
  - --container

  Some *optional* parameters for the execution of the command:
  - --yes  (avoids interactive confirmation for the deletion)

  Example:

  ```shell
  $ azure-img-utils blob delete --storage-account myStorageAccount \
                                --blob-name myBlobName \
                                --container myContainerName \
                                --yes
  ```

  This command will output if the deletion has been successful or not.

  For more information about the blob delete command see the help message:

  ```shell
  $ azure-img-utils blob delete --help
  ```



  Group of commands for image management.



  This subcommand allows the user to check if an image exists.
  The subcommand is *azure-img-utils image exists*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --image-name

  Example:

  ```shell
  $ azure-img-utils image exists --image-name myImageName
  ```

  This command will output *true* or *false* depending on the existence of the
  image.

  For more information about the image exists command see the help message:

  ```shell
  $ azure-img-utils image exists --help
  ```



  This subcommand allows the user to create an image based in one blob.
  The subcommand is *azure-img-utils image create*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --blob-name
  - --image-name
  - --container
  - --resource-group
  - --storage-account

  Some *optional* parameters for the execution of the command include:
  - --force-replace-image  (defaults to False)
  - --hyper-v-generation   (defaults to 'V1'(legacy bios).)
                           (Use 'V2' for uefi boot.)

  Example:

  ```shell
  $ azure-img-utils image create --blob-name myBlobName \
                                 --image-name myImageName
  ```

  For more information about the image create command see the help message:

  ```shell
  $ azure-img-utils image create --help
  ```



  This subcommand allows the user to delete an existing image.
  The subcommand is *azure-img-utils image delete*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --image-name

  Example:

  ```shell
  $ azure-img-utils image delete --image-name myImageName
  ```

  For more information about the image delete command see the help message:

  ```shell
  $ azure-img-utils image delete --help
  ```



  Group of commands for gallery image version management.



  This subcommand allows the user to check if a gallery image version exists in a
   gallery.
  The subcommand is *azure-img-utils gallery-image-version exists*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --gallery-image-name
  - --gallery-name
  - --gallery-image-version

  Example:

  ```shell
  $ azure-img-utils gallery-image-version exists \
                                          --gallery-image-name myImageName \
                                          --gallery-name myGalleryName \
                                          --gallery-image-version 0.0.1
  ```

  This command will output *true* or *false* depending on the existence of the
  gallery image version in the gallery.

  For more information about the gallery image version exists command see the
   help message:

  ```shell
  $ azure-img-utils gallery-image-version exists --help
  ```



  This subcommand allows the user to create a gallery image version in a gallery based
   on a blob.
  The subcommand is *azure-img-utils gallery-image-version create*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --blob-name
  - --gallery-name
  - --gallery-image-name
  - --gallery-image-version
  - --resource-group

  Some *optional* parameters for the execution of the command include:
  - --force-replace-image  (defaults to False)

  Example:

  ```shell
  $ azure-img-utils gallery-image-version create \
                                          --blob-name myBlobName \
                                          --gallery-image-name myImageName \
                                          --gallery-name myGalleryName \
                                          --image-version 0.0.1 \
                                          --resource-group myResourceGroup
  ```

  For more information about the gallery image version create command see the help
   message:

  ```shell
  $ azure-img-utils gallery-image-version create --help
  ```



  This subcommand allows the user to delete an existing gallery image version of
  a gallery image.

  The subcommand is *azure-img-utils gallery-image-version delete*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --gallery-name
  - --gallery-image-name
  - --gallery-image-version

  Example:

  ```shell
  $ azure-img-utils gallery-image-version delete \
                                              --gallery-image-name myImageName \
                                              --gallery-name myGalleryName \
                                              --gallery-image-version 0.0.1
  ```

  For more information about the gallery image version delete command see the
  help message:

  ```shell
  $ azure-img-utils gallery-image-version delete --help
  ```



  Group of commands for cloud partner offer management.



  This subcommand allows the user to publish a cloud partner offer.

  The subcommand is *azure-img-utils cloud-partner-offer publish*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --offer-id

  Example:

  ```shell
  $ azure-img-utils cloud-partner-offer publish \
          --offer-id myOfferId
  ```

  This command will output the job id for the published cloud partner offer
   operation if successful.

  For more information about the cloud partner offer publish command see the
   help message:

  ```shell
  $ azure-img-utils cloud-partner-offer publish --help



  This subcommand allows the user to set a cloud partner offer as go-live.

  The subcommand is *azure-img-utils cloud-partner-offer go-live*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --offer-id

  The result of the subcommand is that all new changes made to the offer are
   publicly visible.

  Example:

  ```shell
  $ azure-img-utils cloud-partner-offer go-live \
          --offer-id myOfferId
  ```

  This command will output the URI for the cloud partner offer go-live operation
  if successful.

  For more information about the cloud partner offer go-live command see the
   help message:

  ```shell
  $ azure-img-utils cloud-partner-offer go-live --help
  ```



  This subcommand allows the user to upload an offer document to a cloud
   partner offer.

  The subcommand is *azure-img-utils cloud-partner-offer upload-offer-document*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --offer-id
  - --offer-document-file

  The '--offer-document-file' parameter has to contain the path for a text file
  containing the json document for the offer.

  Example:

  ```shell
  $ azure-img-utils cloud-partner-offer upload-offer-document \
          --offer-id myOfferId \
          --offer-document-file /path/to/my/documentfile.json
  ```

  This command will output only if there's any problem uploading the document for
  the offer.

  For more information about the cloud partner offer upload-offer-document
  command see the help message:

  ```shell
  $ azure-img-utils cloud-partner-offer upload-offer-document --help
  ```



  This subcommand allows the user to add an image to a cloud partner offer.

  The subcommand is *azure-img-utils cloud-partner-offer add-image-to-offer*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --blob-name
  - --image-name
  - --offer-id
  - --sku

  Some *optional* parameters for the execution of the command include:
  - --blob-url  (A blob-url is generated if not provided)
  - --generation-id

  Example:

  ```shell
  $ azure-img-utils cloud-partner-offer add-image-to-offer \
          --blob-name myBlobName \
          --image-name myImageName \
          --offer-id myOfferId \
          --sku mySKU
  ```

  This command will output only if there's any problem adding the image
   to the offer.

  For more information about the cloud partner offer add-image-to-offer
  command see the help message:

  ```shell
  $ azure-img-utils cloud-partner-offer add-image-to-offer --help
  ```



  This subcommand allows the user to remove an image from a cloud partner offer.

  The subcommand is *azure-img-utils cloud-partner-offer remove-image-from-offer*.

  The *required* parameters for the execution of the command (authentication
   aside):
  - --image-urn

  Example:

  ```shell
  $ azure-img-utils cloud-partner-offer remove-image-to-offer \
          --image-urn myImageUrn
  ```

  This command will output only if there's any problem removing the image
   from the offer.

  For more information about the cloud partner offer remove-image-from-offer
  command see the help message:

  ```shell
  $ azure-img-utils cloud-partner-offer remove-image-from-offer --help
  ```



  The AzureImage class can be instantiated and used as an API from code.
  This provides all the same functions as the CLI with a few additional
  helpers. For example there are waiter functions which will wait for
  a compute image to be created and/or deleted.

  To create an instance of AzureImage you need a *storage_account*,
  *credentials dictionary object* or *credentials file* or *sas token*
  *container* and *resource group*. Optionally you can pass
  in a Python log object and/or a *log_level* and/or a *timeout* value.

  Note that you can provide authentication credentials in 3 different ways:
  - with a sas_token
  - with a dictionary of credentials containing the required key values
  - with the credentials file name
  Providing just one of these options is enough to perform the authentication
  in the Azure API.

  ```python
  azure_image = AzureImage(
      container="my_container_name",
      storage_account="my_storage_account",
      credentials=my_credentials_dict,
      credentials_file="my_credentials_file.json",
      resource_group="my_resource_group",
      sas_token="my_sas_token",
      log_level=my_log_level,
      log_callback=logger
      timeout=myTimeout
  )
  ```



  With an instance of AzureImage you can perform any of the image functions
  which are available through the CLI.

  ```python
  azure_image = AzureImage(
      container="my_container",
      storage_account="my_storage_account",
      credentials_file="my_credentials.json",
      resource_gropu="my_resource_group",
      sas_token="my_sas_token"
  )
  ```


  ```python
  blob_exists = azure_image.image_blob_exists("my_blob_name")
  ```


  ```python
  blob_deleted = azure_image.delete_storage_blob("my_blob_name")
  ```


  ```python
  blob_name = azure_image.upload_image_blob(
      "my_image_file.qcow2",
      blob_name="my_blob_name"
  )
  ```


  ```python
  image_exists = azure_image.image_exists("my_image_name")
  ```


  ```python
  gallery_image_version_exists = azure_image.gallery_image_version_exists(
      "my_gallery_name",
      "my_gallery_image_name",
      "my_image_version",
      gallery_resource_group="my_gallery_resource_group"
  )
  ```


  ```python
  azure_image.delete_compute_image("my_image_name")
  ```


  ```python
  azure_image.delete_gallery_image_version(
      "my_gallery_name",
      "my_gallery_image_name",
      "my_image_version",
      gallery_resource_group="my_gallery_resource_group"
  )
  ```


  ```python
  image_dict = azure_image.get_compute_image("my_image_name")
  ```


  ```python
  image_dict = azure_image.get_gallery_image_version(
      "my_gallery_name",
      "my_gallery_image_name",
      "my_image_version",
      gallery_resource_group="my_gallery_resource_group"
  )
  ```


  ```python
  image_name = azure_image.create_compute_image(
      "my_blob_name",
      "my_image_name",
      "my_region",
      force_replace_image=True,
      hyper_v_generation='V1'
  )
  ```


  ```python
  image_name = azure_image.create_gallery_image_version(
      "my_blob_name",
      "my_gallery_name",
      "my_gallery_image_name",
      "my_image_version",
      "my_region",
      force_replace_image=True,
      gallery_resource_group="my_gallery_resource_group"
  )
  ```


  ```python
  offer_doc = azure_image.get_offer_doc(
      "my_offer_id"
  )
  ```


  ```python
  azure_image.upload_offer_doc(
      "my_offer_id",
      my_offer_doc_dict
  )
  ```


  ```python
  azure_image.add_image_to_offer(
      "my_blob_name",
      "my_image_name",
      "my_offer_id",
      "my_sku",
      blob_url="https://my.blob.url",
      generation_id="my_generation_id"
  )
  ```


  ```python
  azure_image.remove_image_from_offer("my_image_urn")
  ```


  ```python
  operation_uri = azure_image.publish_offer(
      "my_offer_id"
  )
  ```


  ```python
  operation_uri = azure_image.go_live_with_offer(
      "my_offer_id"
  )
  ```


  ```python
  offer_status = azure_image.get_offer_status(
      "my_offer_id"
  )
  ```


  ```python
  operation_status = azure_image.get_operation("my_operation")
  ```



  Please submit issues and requests to
  [Github](https://github.com/SUSE-Enceladus/azure-img-utils/issues).



  Contributions to **azure-img-utils** are welcome and encouraged. See
  [CONTRIBUTING](https://github.com/SUSE-Enceladus/azure-img-utils/blob/master/CONTRIBUTING.md)
  for info on getting started.



  Copyright (c) 2022 SUSE LLC.

  Distributed under the terms of GPL-3.0+ license, see
  [LICENSE](https://github.com/SUSE-Enceladus/azure-img-utils/blob/master/LICENSE)
  for details.


pkgId: bded3074426b2293cf73a7cb42910be3f1928f8084d2bfb87b4205865322f814
name: python-azure-iot-device
arch: src
version: 2.14.0
epoch: 0
release: 1
summary: Microsoft Azure IoT Device Library
url: https://github.com/Azure/azure-iot-sdk-python/
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-iot-device-2.14.0-1.src.rpm
checksum_type: sha256
description:
  <div align=center>
      <img src="./doc/images/azure_iot_sdk_python_banner.png"></img>
      <h1> azure-iot-device </h1>
  </div>

  ![Build Status](https://azure-iot-sdks.visualstudio.com/azure-iot-sdks/_apis/build/status/Azure.azure-iot-sdk-python)

  The Azure IoT Device SDK for Python enables Python developers to easily create IoT device solutions that seamlessly connect to the Azure IoT Hub ecosystem.

  * *If you're looking for the azure-iot-hub library, it is now located in the [azure-iot-hub-python](https://github.com/Azure/azure-iot-hub-python) repository*

  * *If you're looking for the v1.x.x client library, it is now preserved in the [v1-deprecated](https://github.com/Azure/azure-iot-sdk-python/tree/v1-deprecated) branch.*




  The Azure IoT Device library is available on PyPI:

  ```Shell
  pip install azure-iot-device
  ```

  Python 3.8 or higher is required in order to use the library


  API documentation for this package is available via [**Microsoft Docs**](https://docs.microsoft.com/python/api/azure-iot-device/azure.iot.device?view=azure-python).

  See our [**quickstart guide**](https://github.com/Azure/azure-iot-sdk-python/tree/main/samples/README.md) for step by step instructions for setting up and using an IoTHub with devices.

  You can also view the [**samples repository**](https://github.com/Azure/azure-iot-sdk-python/tree/main/samples) to see additional examples of basic client usage.

  Want to start off on the right foot? Be sure to learn about [**common pitfalls**](https://github.com/Azure/azure-iot-sdk-python/wiki/pitfalls) of using this Python SDK before starting a project.




  :heavy_check_mark: feature available  :heavy_multiplication_x: feature planned but not yet supported  :heavy_minus_sign: no support planned*

  *Features that are not planned may be prioritized in a future release, but are not currently planned

  These clients only support the **MQTT protocol**.



  | Features                                                                                                         | Status                     | Description                                                                                                                                                                                                          |
  |------------------------------------------------------------------------------------------------------------------|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | [Authentication](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-security-deployment)                     | :heavy_check_mark:         | Connect your device to IoT Hub securely with supported authentication, including symmetric key, X-509 Self Signed, Certificate Authority (CA) Signed, and SASToken                                     |
  | [Send device-to-cloud message](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-messages-d2c)     | :heavy_check_mark:         | Send device-to-cloud messages (max 256KB) to IoT Hub with the option to add custom properties.                                                                                                                       |
  | [Receive cloud-to-device messages](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-messages-c2d) | :heavy_check_mark:         | Receive cloud-to-device messages and read associated custom and system properties from IoT Hub.                                                        |
  | [Device Twins](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-device-twins)                     | :heavy_check_mark:         | IoT Hub persists a device twin for each device that you connect to IoT Hub.  The device can perform operations like get twin tags, subscribe to desired properties.                                                |
  | [Direct Methods](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-direct-methods)                 | :heavy_check_mark:         | IoT Hub gives you the ability to invoke direct methods on devices from the cloud.  The SDK supports handler for method specific and generic operation.                                                            |
  | [Connection Status and Error reporting](https://docs.microsoft.com/en-us/rest/api/iothub/common-error-codes)     | :heavy_check_mark:   | Error reporting for IoT Hub supported error code.                                                                                         |
  | Connection Retry                                                                                                   | :heavy_check_mark:         | Dropped connections will be retried with a fixed 10 second interval by default. This functionality can be disabled if desired, and the interval can be configured   |
  | [Upload file to Blob](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-file-upload)               | :heavy_check_mark:         | A device can initiate a file upload and notifies IoT Hub when the upload is complete.  |



  **Note:** IoT Edge for Python is scoped to Linux containers & devices only. [Learn more](https://techcommunity.microsoft.com/t5/internet-of-things/linux-modules-with-azure-iot-edge-on-windows-10-iot-enterprise/ba-p/1407066) about using Linux containers for IoT edge on Windows devices.

  | Features                                                                                                         | Status                     | Description                                                                                                                                                                                                          |
  |------------------------------------------------------------------------------------------------------------------|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | [Authentication](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-security-deployment)                     | :heavy_check_mark:         | Connect your device to IoT Hub securely with supported authentication, including symmetric key, X-509 Self Signed, and Certificate Authority (CA) Signed. SASToken authentication is not currently supported.                                                   |
  | [Send device-to-cloud message](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-messages-d2c)     | :heavy_check_mark:         | Send device-to-cloud messages (max 256KB) to IoT Hub with the option to add custom properties.                                                                                                                       |
  | [Receive cloud-to-device messages](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-messages-c2d) | :heavy_check_mark:         | Receive cloud-to-device messages and read associated custom and system properties from IoT Hub, with the option to complete/reject/abandon C2D messages.                                                        |
  | [Device Twins](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-device-twins)                     | :heavy_check_mark:         | IoT Hub persists a device twin for each device that you connect to IoT Hub.  The device can perform operations like get twin tags, subscribe to desired properties.                                                |
  | [Direct Methods](https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-direct-methods)                 | :heavy_check_mark:         | IoT Hub gives you the ability to invoke direct methods on devices from the cloud.  The SDK supports handler for method specific and generic operation.                                                            |
  | [Connection Status and Error reporting](https://docs.microsoft.com/en-us/rest/api/iothub/common-error-codes)     | :heavy_check_mark:   | Error reporting for IoT Hub supported error code.                                                                                         |
  | Connection Retry                                                                                                   | :heavy_check_mark:         | Dropped connections will be retried with a fixed 10 second interval.  TThis functionality can be disabled if desired, and the interval can be configured            |
  | Direct Invocation of Method on Modules                                                                           | :heavy_check_mark:         | Invoke method calls to another module using using the Edge Gateway.                                                                                                                                        |



  | Features                    | Status             | Description                                                                                                                                                                                                                                                                                                                                        |
  |-----------------------------|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | TPM Individual Enrollment   | :heavy_minus_sign: | Provisioning via [Trusted Platform Module](https://docs.microsoft.com/en-us/azure/iot-dps/concepts-security#trusted-platform-module-tpm).                                                                                                                                                                                                          |
  | X.509 Individual Enrollment | :heavy_check_mark: | Provisioning via [X.509 root certificate](https://docs.microsoft.com/en-us/azure/iot-dps/concepts-security#root-certificate).  Please review the [samples](azure-iot-device/samples/async-hub-scenarios/provision_x509.py) folder and this [quickstart](https://docs.microsoft.com/en-us/azure/iot-dps/quick-create-simulated-device-x509-python) on how to create a device client.   |
  | X.509 Enrollment Group      | :heavy_check_mark: | Provisioning via [X.509 leaf certificate](https://docs.microsoft.com/en-us/azure/iot-dps/concepts-security#leaf-certificate)).  Please review the [samples](azure-iot-device/samples/async-hub-scenarios/provision_x509.py) folder on how to create a device client.                                                                                                                  |
  | Symmetric Key Enrollment    | :heavy_check_mark: | Provisioning via [Symmetric key attestation](https://docs.microsoft.com/en-us/azure/iot-dps/concepts-symmetric-key-attestation)).  Please review the [samples](azure-iot-device/samples/async-hub-scenarios/provision_symmetric_key.py) folder on how to create a device client.                                                                                                               |




  All Azure IoT SDK users are advised to be aware of upcoming TLS certificate changes for Azure IoT Hub and Device Provisioning Service
  that will impact the SDK's ability to connect to these services. In October 2022, both services will migrate from the current
  [Baltimore CyberTrust CA Root](https://baltimore-cybertrust-root.chain-demos.digicert.com/info/index.html) to the
  [DigiCert Global G2 CA root](https://global-root-g2.chain-demos.digicert.com/info/index.html). There will be a
  transition period beforehand where your IoT devices must have both the Baltimore and Digicert public certificates
  installed in their certificate store in order to prevent connectivity issues.

  **Devices with only the Baltimore public certificate installed will lose the ability to connect to Azure IoT hub and Device Provisioning Service in October 2022.**

  To prepare for this change, make sure your device's certificate store has both of these public certificates installed.

  For a more in depth explanation as to why the IoT services are doing this, please see
  [this article](https://techcommunity.microsoft.com/t5/internet-of-things/azure-iot-tls-critical-changes-are-almost-here-and-why-you/ba-p/2393169).




  This project welcomes contributions and suggestions.  Most contributions require you to agree to a
  Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
  the rights to use your contribution. For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
  a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
  provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
  For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.


pkgId: 9246ed9bca00f94d1eaf406cccaea6eb3733e9668f1654e9e5ac9de47765fdb0
name: python-azure-iot-deviceupdate
arch: src
version: 1.0.0
epoch: 0
release: 1
summary: Microsoft Azure Device Update Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/deviceupdate/azure-iot-deviceupdate
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-iot-deviceupdate-1.0.0-1.src.rpm
checksum_type: sha256
description:
  The library provides access to the Device Update for IoT Hub service that enables customers to publish updates for their IoT devices to the cloud, and then deploy these updates to their devices (approve updates to groups of devices managed and provisioned in IoT Hub).

  [Source code](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/deviceupdate/azure-iot-deviceupdate) | [Package (PyPI)](https://aka.ms/azsdk/python/deviceupdate-pypi) | [Product documentation](https://docs.microsoft.com/azure/iot-hub-device-update/understand-device-update)



  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_





  - Microsoft Azure Subscription: To call Microsoft Azure services, you need to create an [Azure subscription](https://azure.microsoft.com/free/)
  - Device Update for IoT Hub instance
  - Azure IoT Hub instance
  - Python 3.6 or later is required to use this package.



  Install the Device Update for IoT Hub client library for Python with [pip](https://pypi.org/project/pip/):

  ```bash
  pip install azure-iot-deviceupdate
  ```



  Device Update for IoT Hub is a managed service that enables you to deploy over-the-air updates for your IoT devices. The client library has one main component named **DeviceUpdateClient**. The component allows you to access all three main client services:

  - **UpdatesOperations**: update management (import, enumerate, delete, etc.)
  - **ManagementOperations**: deployment management (manage devices and deployments)

  You can learn more about Device Update for IoT Hub by visiting [Device Update for IoT Hub](https://github.com/azure/iot-hub-device-update).



  You can familiarize yourself with different APIs using [Samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/deviceupdate/azure-iot-deviceupdate/samples).



  The Device Update for IoT Hub client will raise exceptions defined in [Azure Core](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md).



  Get started with our [Samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/deviceupdate/azure-iot-deviceupdate/samples).



  If you encounter any bugs or have suggestions, please file an issue in the [Issues](https://github.com/Azure/azure-sdk-for-python/issues) section of the project.

  <!-- LINKS -->
  [azure_core]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md







  - Added filter to DeviceManagementOperations.list_device_classes method
  - Updated description for some methods to be more descriptive and less ambiguous


  - Removed filter from DeviceManagementOperations.list_best_updates_for_group method





  - Added `relatedFiles` and `downloadHandler` to `Update`
  - Updated various model that reference update to include not only `updateId` but also update `description` and `friendlyName`
  - Removed device tag concept
  - Allow to filter by deployment status in the `list_devices` method
  - Added ability to update device class friendly name
  - Added ability to delete device class
  - Added device class subgroups to groups
  - Added new method to retrieve devices health information





    - Added DeviceManagementOperations
    - Added DeviceUpdateOperations
    - Added operation `send_request` to send customized http request conveniently
    - Added `client.device_management`



    - Removed all models
    - Removed DeploymentsOperations
    - Removed UpdateOperations
    - Dropped support for Python2.7(https://github.com/Azure/azure-sdk-for-python#disclaimer)
    - Parameter `account_endpoint` of DeviceUpdateClient is renamed to `endpoint`
    - Renamed `client.updates` to `client.device_update`
    - Removed `client.devices`
    - Removed `client.deployments`
    - Renamed UpdatesOperations.get_update to DeviceUpdateOperations.get_update
    - Renamed UpdatesOperations.delete_update to DeviceUpdateOperations.begin_delete_update
    - Renamed UpdatesOperations.get_providers to DeviceUpdateOperations.list_providers
    - Renamed UpdatesOperations.get_names to DeviceUpdateOperations.list_names
    - Renamed UpdatesOperations.get_versions to DeviceUpdateOperations.list_versions
    - Renamed UpdatesOperations.get_file to DeviceUpdateOperations.get_file
    - Renamed UpdatesOperations.get_files to DeviceUpdateOperations.list_files
    - Renamed UpdatesOperations.get_operation to DeviceUpdateOperations.get_operation
    - Renamed UpdatesOperations.get_operations to DeviceUpdateOperations.list_operations
    - Renamed DevicesOperations.get_all_device_classes to DeviceManagementOperations.list_device_classes
    - Renamed DevicesOperations.get_device_class to DeviceManagementOperations.get_device_class
    - Renamed DevicesOperations.get_device_class_device_ids to DeviceManagementOperations.
    - Renamed DevicesOperations.list_devices to DeviceManagementOperations.list_devices
    - Renamed DevicesOperations.list_devices to DeviceManagementOperations.
    - Renamed DevicesOperations.get_all_device_tags to DeviceManagementOperations.list_device_tags
    - Renamed DevicesOperations.get_all_groups to DeviceManagementOperations.list_groups
    - Renamed DevicesOperations.get_group to DeviceManagementOperations.get_group
    - Renamed DevicesOperations.create_or_update_group to DeviceManagementOperations.create_or_update_group
    - Renamed DevicesOperations.delete_group to DeviceManagementOperations.delete_group
    - Renamed DevicesOperations.get_group_update_compliance to DeviceManagementOperations.get_group_update_compliance
    - Renamed DevicesOperations.get_group_best_updates to DeviceManagementOperations.list_best_updates_for_group
    - Renamed DeploymentsOperations.get_deployment_status to DeviceManagementOperations.get_deployment_status
    - Renamed DeploymentsOperations.create_or_update_deployment to DeviceManagementOperations.create_or_update_deployment
    - Renamed DeploymentsOperations.delete_deployment to DeviceManagementOperations.delete_deployment
    - Renamed DeploymentsOperations.get_deployment_devices to DeviceManagementOperations.list_deployment_devices



  * This is the initial release of Azure Device Update for IoT Hub library.


pkgId: 99c16e24da36c0589309e579b3f5530b8d6a19f4f086ac67a0192b8635075db5
name: python-azure-iot-hub
arch: src
version: 2.6.1
epoch: 0
release: 1
summary: Microsoft Azure IoTHub Service Library
url: https://github.com/Azure/azure-iot-hub-python/
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-iot-hub-2.6.1-1.src.rpm
checksum_type: sha256
description:
  The Azure IoTHub Service SDK for Python provides functionality for communicating with the Azure IoT Hub.



  The SDK provides the following clients:

  * ### IoT Hub Registry Manager

    * Provides CRUD operations for device on IoTHub
    * Get statistics about the IoTHub service and devices



  ```python
  pip install azure-iot-hub
  ```



  Check out the [samples repository](https://github.com/Azure/azure-iot-hub-python/tree/main/samples) for more detailed samples




  API documentation for this package is available via [Microsoft Docs](https://docs.microsoft.com/python/api/azure-iot-hub/azure.iot.hub?view=azure-python)

  Additionally, the SDK makes use of docstrings which means you can find API documentation directly through Python with use of the [help](https://docs.python.org/3/library/functions.html#help) command:

  ```python
  >>> from azure.iot.hub import IoTHubRegistryManager
  >>> help(IoTHubRegistryManager)
  ```


pkgId: e666a1f856a67ec60ff48c5d6299ab7eb618e71ceb4de867b819daf94409b925
name: python-azure-keyvault
arch: src
version: 4.2.0
epoch: 0
release: 1
summary: Microsoft Azure Key Vault Client Libraries for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-keyvault-4.2.0-1.src.rpm
checksum_type: sha256
description:
  This is the Microsoft Azure Key Vault libraries bundle.

  This package does not contain any code in itself. It installs a set
  of packages that provide APIs for Key Vault operations:

  - [azure-keyvault-keys v4.x](https://pypi.python.org/pypi/azure-keyvault-keys)
  - [azure-keyvault-secrets v4.x](https://pypi.python.org/pypi/azure-keyvault-secrets)
  - [azure-keyvault-certificates v4.x](https://pypi.python.org/pypi/azure-keyvault-certificates)




  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_



  Install the Azure Key Vault client libraries for Python with [pip][pip]:

  ```Bash
  pip install azure-keyvault
  ```



  Please refer to the individual packages for documentation.


  This project welcomes contributions and suggestions. Most contributions require
  you to agree to a Contributor License Agreement (CLA) declaring that you have
  the right to, and actually do, grant us the rights to use your contribution.
  For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether
  you need to provide a CLA and decorate the PR appropriately (e.g., label,
  comment). Simply follow the instructions provided by the bot. You will only
  need to do this once across all repos using our CLA.

  This project has adopted the
  [Microsoft Open Source Code of Conduct][code_of_conduct]. For more information,
  see the Code of Conduct FAQ or contact opencode@microsoft.com with any
  additional questions or comments.

  [code_of_conduct]: https://opensource.microsoft.com/codeofconduct/

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fkeyvault%2Fazure-keyvault%2FFREADME.png)





  **Disclaimer**

  This package and the `azure.keyvault` namespace does not contain code anymore. This package now installs three sub-packages instead:

  * [azure-keyvault-certificates](https://pypi.org/project/azure-keyvault-certificates/)
  * [azure-keyvault-keys](https://pypi.org/project/azure-keyvault-keys/)
  * [azure-keyvault-secrets](https://pypi.org/project/azure-keyvault-secrets/)

  All code needs to be adapted to use the new namespaces. See individual package readmes for details.


  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.


  **Disclaimer**

  This package and the `azure.keyvault` namespace does not contain code anymore. This package now installs three sub-packages instead:

  * [azure-keyvault-certificates](https://pypi.org/project/azure-keyvault-certificates/)
  * [azure-keyvault-keys](https://pypi.org/project/azure-keyvault-keys/)
  * [azure-keyvault-secrets](https://pypi.org/project/azure-keyvault-secrets/)

  All code needs to be adapted to use the new namespaces. See individual package readmes for details.




  **Disclaimer**

  This package and the `azure.keyvault` namespace does not contain code anymore. This package now installs three sub-packages instead:

  * azure-keyvault-keys
  * azure-keyvault-secrets

  Certificates scenarios are in preview with the additional package `azure-keyvault-certificates`.

  All code needs to be adapted to use the new namespaces. See individual package readme for details.



  * Adding support for multi-api and API profiles



  * Moving azure-keyvault to stable API version 7.0
  * Adding support for EC certificate create and import
  * Renaming curve SECP256K1 and algorithm ECDSA256 to P-256K and ES256K respectively



  * Upgraded to autorest 3.0 generated code

  **General Breaking changes**

  This version uses a next-generation code generator that *might* introduce breaking changes.

  - Model signatures now use only keyword-argument syntax. All positional arguments must be re-written as keyword-arguments.
    To keep auto-completion in most cases, models are now generated for Python 2 and Python 3. Python 3 uses the "*" syntax for keyword-only arguments.
  - Enum types now use the "str" mixin (class AzureEnum(str, Enum)) to improve the behavior when unrecognized enum values are encountered.
    While this is not a breaking change, the distinctions are important, and are documented here:
    https://docs.python.org/3/library/enum.html#others
    At a glance:

    - "is" should not be used at all.
    - "format" will return the string value, where "%s" string formatting will return `NameOfEnum.stringvalue`. Format syntax should be preferred.

  - New Long Running Operation:

    - Return type changes from `msrestazure.azure_operation.AzureOperationPoller` to `msrest.polling.LROPoller`. External API is the same.
    - Return type is now **always** a `msrest.polling.LROPoller`, regardless of the optional parameters used.
    - The behavior has changed when using `raw=True`. Instead of returning the initial call result as `ClientRawResponse`,
      without polling, now this returns an LROPoller. After polling, the final resource will be returned as a `ClientRawResponse`.
    - New `polling` parameter. The default behavior is `Polling=True` which will poll using ARM algorithm. When `Polling=False`,
      the response of the initial call will be returned without polling.
    - `polling` parameter accepts instances of subclasses of `msrest.polling.PollingMethod`.
    - `add_done_callback` will no longer raise if called after polling is finished, but will instead execute the callback right away.




  * Upgrading to API version 7.0-preview
  * Adding elliptic curve key support
  * Adding managed storage account key backup, restore and soft delete support
  * Breaking update to managed storage account SasDefinition creation
  * Adding certificate backup and restore support
  * Adding certificate transparency



  * Added message encryption support for message encryption enabled vaults



  * Workaround for Azure Stack ADFS authentication issue https://github.com/Azure/azure-cli/issues/4448



  * Updated KeyVaultClient to accept both KeyVaultAuthentication and azure.common.credentials instances for authentication



  * Fix: https://github.com/Azure/azure-sdk-for-python/issues/1159
  * KeyVaultId refactoring
    - adding object specific id classes to make usage more uniform with other key vault SDKs
    - added storage account id and storage sas definition id parsing and formatting



  * Adding Preview Features
    - Managed Storage Account keys for managing storage credentials and provisioning SAS tokens
    - Key Vault "Soft Delete" allowing for recovery of deleted keys, secrets and certificates
    - Secret Backup and Restore for secret recovery and migration



  * Reverting to 0.3.0, since behavior of 0.3.2 is not satisfying either.



  * Fix critical regression on 0.3.1 (#1157)
  * Now the client respects 'REQUESTS_CA_BUNDLE' and 'CURL_CA_BUNDLE'



  * Support for REQUESTS_CA_BUNDLE (#1154)



  * Moving KeyVaultClient class to the azure.keyvault namespace
  * Moving model classes to the azure.keyvault.models namespace
  * Deprecating 'generated' namespaces azure.keyvault.generated and azure.keyvault.generated.models
  * Exposed KeyVaultId class through azure.keyvault namespace
  * Moving identifier parsing methods to static methods on KeyVaultId class
  * Removing convenience overridden methods from KeyVaultClient
    - update_key(self, key_identifier, ...
    - get_key(self, key_identifier, ...
    - encrypt(self, key_identifier, ...
    - decrypt(self, key_identifier, ...
    - sign(self, key_identifier, ...
    - verify(self, key_identifier, ...
    - wrap_key(self, key_identifier, ...
    - unwrap_key(self, key_identifier, ...
    - update_secret(self, secret_identifier, ...
    - get_secret(self, secret_identifier, ...
    - get_certificate(self, certificate_identifier, ...



  **Bugfixes**

  - Fix possible deserialization error, but updating from list<enumtype> to list<str> when applicable

  **Notes**

  - This wheel package is now built with the azure wheel extension



  * Initial Release


pkgId: 4e05868b32b0da0cad0093a105d5e8ac9dff7268ba58684a92f3e799466aebef
name: python-azure-keyvault-administration
arch: src
version: 4.4.0
epoch: 0
release: 1
summary: Microsoft Azure Key Vault Administration Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-keyvault-administration-4.4.0-1.src.rpm
checksum_type: sha256
description:
  >**Note:** The Administration library only works with [Managed HSM][managed_hsm] – functions targeting a Key Vault will fail.

  Azure Key Vault helps solve the following problems:
  - Vault administration (this library) - role-based access control (RBAC), and vault-level backup and restore options
  - Cryptographic key management ([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) - create, store, and control
  access to the keys used to encrypt your data
  - Secrets management
  ([azure-keyvault-secrets](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets)) -
  securely store and control access to tokens, passwords, certificates, API keys,
  and other secrets
  - Certificate management
  ([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) -
  create, manage, and deploy public and private SSL/TLS certificates

  [Source code][library_src]
  | [Package (PyPI)][pypi_package_administration]
  | [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/)
  | [API reference documentation][reference_docs]
  | [Product documentation][keyvault_docs]
  | [Samples][administration_samples]



  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691._
  _Python 3.8 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._



  Install [azure-keyvault-administration][pypi_package_administration] and
  [azure-identity][azure_identity_pypi] with [pip][pip]:
  ```Bash
  pip install azure-keyvault-administration azure-identity
  ```
  [azure-identity][azure_identity] is used for Azure Active Directory
  authentication as demonstrated below.


  * An [Azure subscription][azure_sub]
  * Python 3.8 or later
  * An existing [Key Vault Managed HSM][managed_hsm]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][managed_hsm_cli].


  In order to interact with the Azure Key Vault service, you will need an instance of either a [KeyVaultAccessControlClient](#create-a-keyvaultaccesscontrolclient) or [KeyVaultBackupClient](#create-a-keyvaultbackupclient), as well as a **vault url** (which you may see as "DNS Name" in the Azure Portal) and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments.

  See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types.


  After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create an access control client (replacing the value of `vault_url` with your Managed HSM's URL):

  <!-- SNIPPET:access_control_operations.create_an_access_control_client -->

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.administration import KeyVaultAccessControlClient

  MANAGED_HSM_URL = os.environ["MANAGED_HSM_URL"]
  credential = DefaultAzureCredential()
  client = KeyVaultAccessControlClient(vault_url=MANAGED_HSM_URL, credential=credential)
  ```

  <!-- END SNIPPET -->

  > **NOTE:** For an asynchronous client, import `azure.keyvault.administration.aio`'s `KeyVaultAccessControlClient` instead.


  After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a backup client (replacing the value of `vault_url` with your Managed HSM's URL):

  <!-- SNIPPET:backup_restore_operations.create_a_backup_restore_client -->

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.administration import KeyVaultBackupClient

  MANAGED_HSM_URL = os.environ["MANAGED_HSM_URL"]
  credential = DefaultAzureCredential()
  client = KeyVaultBackupClient(vault_url=MANAGED_HSM_URL, credential=credential)
  ```

  <!-- END SNIPPET -->

  > **NOTE:** For an asynchronous client, import `azure.keyvault.administration.aio`'s `KeyVaultBackupClient` instead.


  After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a settings client (replacing the value of `vault_url` with your Managed HSM's URL):

  <!-- SNIPPET:settings_operations.create_a_settings_client -->

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.administration import KeyVaultSettingsClient

  MANAGED_HSM_URL = os.environ["MANAGED_HSM_URL"]
  credential = DefaultAzureCredential()
  client = KeyVaultSettingsClient(vault_url=MANAGED_HSM_URL, credential=credential)
  ```

  <!-- END SNIPPET -->

  > **NOTE:** For an asynchronous client, import `azure.keyvault.administration.aio`'s `KeyVaultSettingsClient` instead.




  A role definition defines the operations that can be performed, such as read, write, and delete. It can also define the operations that are excluded from allowed operations.

  A role definition is specified as part of a role assignment.


  A role assignment is the association of a role definition to a service principal. They can be created, listed, fetched individually, and deleted.


  A `KeyVaultAccessControlClient` manages role definitions and role assignments.


  A `KeyVaultBackupClient` performs full key backups, full key restores, and selective key restores.



  A `KeyVaultSettingsClient` manages Managed HSM account settings.


  This section contains code snippets covering common tasks:
  * Access control
      * [List all role definitions](#list-all-role-definitions)
      * [Set, get, and delete a role definition](#set-get-and-delete-a-role-definition)
      * [List all role assignments](#list-all-role-assignments)
      * [Create, get, and delete a role assignment](#create-get-and-delete-a-role-assignment)
  * Backup and restore
      * [Perform a full key backup](#perform-a-full-key-backup)
      * [Perform a full key restore](#perform-a-full-key-restore)
      * [Perform a selective key restore](#perform-a-selective-key-restore)


  `list_role_definitions` can be used by a `KeyVaultAccessControlClient` to list the role definitions available for
  assignment.

  <!-- SNIPPET:access_control_operations.list_role_definitions -->

  ```python
  from azure.keyvault.administration import KeyVaultRoleScope

  role_definitions = client.list_role_definitions(scope=KeyVaultRoleScope.GLOBAL)
  for definition in role_definitions:
      print(f"Role name: {definition.role_name}; Role definition name: {definition.name}")
  ```

  <!-- END SNIPPET -->


  `set_role_definition` can be used by a `KeyVaultAccessControlClient` to either create a custom role definition or update
  an existing definition with the specified unique `name` (a UUID).

  <!-- SNIPPET:access_control_operations.create_a_role_definition -->

  ```python
  from azure.keyvault.administration import KeyVaultDataAction, KeyVaultPermission, KeyVaultRoleScope

  role_name = "customRole"
  scope = KeyVaultRoleScope.GLOBAL
  permissions = [KeyVaultPermission(data_actions=[KeyVaultDataAction.CREATE_HSM_KEY])]
  role_definition = client.set_role_definition(scope=scope, role_name=role_name, permissions=permissions)
  ```

  <!-- END SNIPPET -->

  <!-- SNIPPET:access_control_operations.update_a_role_definition -->

  ```python
  new_permissions = [
      KeyVaultPermission(
          data_actions=[KeyVaultDataAction.READ_HSM_KEY],
          not_data_actions=[KeyVaultDataAction.CREATE_HSM_KEY]
      )
  ]
  unique_definition_name = role_definition.name
  updated_definition = client.set_role_definition(
      scope=scope, name=unique_definition_name, role_name=role_name, permissions=new_permissions
  )
  ```

  <!-- END SNIPPET -->

  `get_role_definition` can be used by a `KeyVaultAccessControlClient` to fetch a role definition with the specified scope
  and unique name.

  <!-- SNIPPET:access_control_operations.get_a_role_definition -->

  ```python
  fetched_definition = client.get_role_definition(scope=scope, name=unique_definition_name)
  ```

  <!-- END SNIPPET -->

  `delete_role_definition` can be used by a `KeyVaultAccessControlClient` to delete a role definition with the specified
  scope and unique name.

  <!-- SNIPPET:access_control_operations.delete_a_role_definition -->

  ```python
  client.delete_role_definition(scope=scope, name=unique_definition_name)
  ```

  <!-- END SNIPPET -->


  `list_role_assignments` can be used by a `KeyVaultAccessControlClient` to list all of the current role assignments.

  <!-- SNIPPET:access_control_operations.list_role_assignments -->

  ```python
  from azure.keyvault.administration import KeyVaultRoleScope

  role_assignments = client.list_role_assignments(KeyVaultRoleScope.GLOBAL)
  for assignment in role_assignments:
      assert assignment.properties
      print(f"Role assignment name: {assignment.name}")
      print(f"Principal ID associated with this assignment: {assignment.properties.principal_id}")
  ```

  <!-- END SNIPPET -->


  Role assignments assign a role to a service principal. This will require a role definition ID and service principal
  object ID. You can use an ID from the retrieved [list of role definitions](#list-all-role-definitions) for the former,
  and an assignment's `principal_id` from the list retrieved in the [above snippet](#list-all-role-assignments) for the
  latter. Provide these values, and a scope, to a `KeyVaultAccessControlClient`'s `create_role_assignment` method.

  <!-- SNIPPET:access_control_operations.create_a_role_assignment -->

  ```python
  from azure.keyvault.administration import KeyVaultRoleScope

  scope = KeyVaultRoleScope.GLOBAL
  role_assignment = client.create_role_assignment(scope=scope, definition_id=definition_id, principal_id=principal_id)
  print(f"Role assignment {role_assignment.name} created successfully.")
  ```

  <!-- END SNIPPET -->

  `get_role_assignment` can be used by a `KeyVaultAccessControlClient` to fetch an existing role assignment with the
  specified scope and unique name.

  <!-- SNIPPET:access_control_operations.get_a_role_assignment -->

  ```python
  fetched_assignment = client.get_role_assignment(scope=scope, name=role_assignment.name)
  assert fetched_assignment.properties
  print(f"Role assignment for principal {fetched_assignment.properties.principal_id} fetched successfully.")
  ```

  <!-- END SNIPPET -->

  `delete_role_assignment` can be used by a `KeyVaultAccessControlClient` to delete a role assignment with the specified
  scope and unique name.

  <!-- SNIPPET:access_control_operations.delete_a_role_assignment -->

  ```python
  client.delete_role_assignment(scope=scope, name=role_assignment.name)
  ```

  <!-- END SNIPPET -->


  The `KeyVaultBackupClient` can be used to back up your entire collection of keys. The backing store for full key
  backups is a blob storage container using Shared Access Signature (SAS) authentication.

  For more details on creating a SAS token using a `BlobServiceClient` from [`azure-storage-blob`][storage_blob], refer
  to the library's [credential documentation][sas_docs]. Alternatively, it is possible to
  [generate a SAS token in Storage Explorer][storage_explorer].

  <!-- SNIPPET:backup_restore_operations.begin_backup -->

  ```python
  CONTAINER_URL = os.environ["CONTAINER_URL"]
  SAS_TOKEN = os.environ["SAS_TOKEN"]

  backup_result: KeyVaultBackupResult = client.begin_backup(CONTAINER_URL, sas_token=SAS_TOKEN).result()
  print(f"Azure Storage Blob URL of the backup: {backup_result.folder_url}")
  ```

  <!-- END SNIPPET -->

  Note that the `begin_backup` method returns a poller. Calling `result()` on this poller returns a
  `KeyVaultBackupResult` containing information about the backup. Calling `wait()` on the poller will instead block until
  the operation is complete without returning an object.


  The `KeyVaultBackupClient` can be used to restore your entire collection of keys from a backup. The data source for a
  full key restore is a storage blob accessed using Shared Access Signature authentication. You will also need the URL of
  the backup (`KeyVaultBackupResult.folder_url`) from the [above snippet](#perform-a-full-key-backup).

  For more details on creating a SAS token using a `BlobServiceClient` from [`azure-storage-blob`][storage_blob], refer
  to the library's [credential documentation][sas_docs]. Alternatively, it is possible to
  [generate a SAS token in Storage Explorer][storage_explorer].

  <!-- SNIPPET:backup_restore_operations.begin_restore -->

  ```python
  SAS_TOKEN = os.environ["SAS_TOKEN"]


  client.begin_restore(backup_result.folder_url, sas_token=SAS_TOKEN).wait()
  print("Vault restored successfully.")
  ```

  <!-- END SNIPPET -->

  Note that the `begin_restore` method returns a poller. Unlike the poller returned by `begin_backup`, this poller's
  `result` method returns `None`; therefore, calling `wait()` is functionally the same.



  To restore a single key from a backed up vault instead of all keys, provide the key name as a `key_name` argument to the
  `begin_restore` method [shown above](#perform-a-full-key-restore).



  See the `azure-keyvault-administration`
  [troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/TROUBLESHOOTING.md)
  for details on how to diagnose various failure scenarios.


  Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions].
  For example, if you try to get a role assignment that doesn't exist, KeyVaultAccessControlClient
  raises [ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error):

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.administration import KeyVaultAccessControlClient
  from azure.core.exceptions import ResourceNotFoundError

  credential = DefaultAzureCredential()
  client = KeyVaultAccessControlClient(vault_url="https://my-managed-hsm-name.managedhsm.azure.net/", credential=credential)

  try:
      client.get_role_assignment("/", "which-does-not-exist")
  except ResourceNotFoundError as e:
      print(e.message)
  ```

  Clients from the Administration library can only be used to perform operations on a managed HSM, so attempting to do so on a Key Vault will raise an error.


  Several samples are available in the Azure SDK for Python GitHub repository. These samples provide example code for additional Key Vault scenarios:

  - [Create/update/delete role definitions and role assignments][access_control_operations_sample] ([async version][access_control_operations_async_sample])
  - [Full backup and restore][backup_operations_sample] ([async version][backup_operations_async_sample])
  - [List and update Key Vault settings][settings_operations_sample] ([async version][settings_operations_async_sample])


  For more extensive documentation on Azure Key Vault, see the [API reference documentation][reference_docs].

  For more extensive documentation on Managed HSM, see the [service documentation][managed_hsm].


  This project welcomes contributions and suggestions. Most contributions require
  you to agree to a Contributor License Agreement (CLA) declaring that you have
  the right to, and actually do, grant us the rights to use your contribution.
  For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether
  you need to provide a CLA and decorate the PR appropriately (e.g., label,
  comment). Simply follow the instructions provided by the bot. You will only
  need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct].
  For more information, see the
  [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact opencode@microsoft.com with any additional questions or comments.


  <!-- LINKS -->
  [access_control]: https://docs.microsoft.com/azure/key-vault/managed-hsm/access-control
  [access_control_operations_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/access_control_operations.py
  [access_control_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/access_control_operations_async.py
  [administration_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples
  [azure_cloud_shell]: https://shell.azure.com/bash
  [azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions
  [azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
  [azure_identity_pypi]: https://pypi.org/project/azure-identity/
  [azure_sub]: https://azure.microsoft.com/free/

  [backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/backup_restore_operations.py
  [backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/backup_restore_operations_async.py
  [best_practices]: https://docs.microsoft.com/azure/key-vault/managed-hsm/best-practices
  [built_in_roles]: https://docs.microsoft.com/azure/key-vault/managed-hsm/built-in-roles

  [code_of_conduct]: https://opensource.microsoft.com/codeofconduct/

  [default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential

  [keyvault_docs]: https://docs.microsoft.com/azure/key-vault/

  [library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration

  [managed_hsm]: https://docs.microsoft.com/azure/key-vault/managed-hsm/overview
  [managed_hsm_cli]: https://docs.microsoft.com/azure/key-vault/managed-hsm/quick-create-cli
  [managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview

  [pip]: https://pypi.org/project/pip/
  [pypi_package_administration]: https://pypi.org/project/azure-keyvault-administration

  [reference_docs]: https://aka.ms/azsdk/python/keyvault-administration/docs

  [sas_docs]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/storage/azure-storage-blob/README.md#types-of-credentials
  [settings_operations_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/settings_operations.py
  [settings_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/settings_operations_async.py
  [storage_blob]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/storage/azure-storage-blob/README.md
  [storage_explorer]: https://learn.microsoft.com/azure/vs-azure-tools-storage-manage-with-storage-explorer


  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fkeyvault%2Fazure-keyvault-administration%2FREADME.png)







  - Added support for service API version `7.5`
  - (From 4.4.0b2) `KeyVaultBackupClient.begin_backup` and `KeyVaultBackupClient.begin_restore` now accept a
    `use_managed_identity` keyword-only argument to enable authentication via Managed Identity


  - (From 4.4.0b1) Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))


  - Python 3.7 is no longer supported. Please use Python version 3.8 or later.
  - Key Vault API version `7.5` is now the default
  - Updated minimum `azure-core` version to 1.29.5
  - Dropped `azure-common` requirement




  - Added support for service API version `7.5-preview.1`
  - `KeyVaultBackupClient.begin_backup` and `KeyVaultBackupClient.begin_restore` now accept a `use_managed_identity`
    keyword-only argument to enable authentication via Managed Identity


  - Key Vault API version `7.5-preview.1` is now the default




  - Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))




  - Added support for service API version `7.4`
  - Clients each have a `send_request` method that can be used to send custom requests using the
    client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172))
  - (From 4.3.0b1) Added sync and async `KeyVaultSettingsClient`s for getting and updating Managed HSM settings
  - The `KeyVaultSetting` class has a `getboolean` method that will return the setting's `value` as a `bool`, if possible,
    and raise a `ValueError` otherwise


  > These changes do not impact the API of stable versions such as 4.2.0. Only code written against a beta version such as 4.3.0b1 may be affected.
  - `KeyVaultSettingsClient.update_setting` now accepts a single `setting` argument (a `KeyVaultSetting` instance)
    instead of a `name` and `value`
  - The `KeyVaultSetting` model's `type` parameter and attribute have been renamed to `setting_type`
  - The `SettingType` enum has been renamed to `KeyVaultSettingType`


  - Key Vault API version `7.4` is now the default
  - (From 4.3.0b1) Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - (From 4.3.0b1) Updated minimum `azure-core` version to 1.24.0
  - (From 4.3.0b1) Dropped `msrest` requirement
  - (From 4.3.0b1) Dropped `six` requirement
  - (From 4.3.0b1) Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`)
  - (From 4.3.0b1) Added requirement for `typing-extensions>=4.0.1`




  - Added sync and async `KeyVaultSettingsClient`s for getting and updating Managed HSM settings.
  - Added support for service API version `7.4-preview.1`


  - Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - Key Vault API version `7.4-preview.1` is now the default
  - Updated minimum `azure-core` version to 1.24.0
  - Dropped `msrest` requirement
  - Dropped `six` requirement
  - Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`)
  - Added requirement for `typing-extensions>=4.0.1`




  - Clients verify the challenge resource matches the vault domain. This should affect few customers,
    who can provide `verify_challenge_resource=False` to client constructors to disable.
    See https://aka.ms/azsdk/blog/vault-uri for more information.




  - Documentation improvements
    ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039))




  - Key Vault API version 7.3 is now the default
  - Added support for multi-tenant authentication when using `azure-identity`
    1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))


  - (From 4.1.0b3) Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - (From 4.1.0b3) Updated minimum `azure-core` version to 1.20.0
  - (From 4.1.0b2) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See
    https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate
    this parameter if `get_token` is implemented by a custom credential.




  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - Updated minimum `azure-core` version to 1.20.0
  - (From 4.1.0b2) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))




  - Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))


  - Updated minimum `azure-core` version to 1.15.0




  - Key Vault API version 7.3-preview is now the default



  - Key Vault API version 7.2 is now the default
  - `KeyVaultAccessControlClient.delete_role_assignment` and
    `.delete_role_definition` no longer raise an error  when the resource to be
    deleted is not found
  - Raised minimum azure-core version to 1.11.0


  - `KeyVaultAccessControlClient.set_role_definition` accepts an optional
    `assignable_scopes` keyword-only argument


  - `KeyVaultAccessControlClient.delete_role_assignment` and
    `.delete_role_definition` return None
  - Changed parameter order in `KeyVaultAccessControlClient.set_role_definition`.
    `permissions` is now an optional keyword-only argument
  - Renamed `BackupOperation` to `KeyVaultBackupResult`, and removed all but
    its `folder_url` property
  - Removed `RestoreOperation` and `SelectiveKeyRestoreOperation` classes
  - Removed `KeyVaultBackupClient.begin_selective_restore`. To restore a
    single key, pass the key's name to `KeyVaultBackupClient.begin_restore`:
    ```
    
    client.begin_selective_restore(folder_url, sas_token, key_name)

    
    client.begin_restore(folder_url, sas_token, key_name=key_name)
    ```
  - Removed `KeyVaultBackupClient.get_backup_status` and `.get_restore_status`. Use
    the pollers returned by `KeyVaultBackupClient.begin_backup` and `.begin_restore`
    to check whether an operation has completed
  - `KeyVaultRoleAssignment`'s `principal_id`, `role_definition_id`, and `scope`
    are now properties of a `properties` property
    ```
    
    print(KeyVaultRoleAssignment.scope)

    
    print(KeyVaultRoleAssignment.properties.scope)
    ```
  - Renamed `KeyVaultPermission` properties:
    - `allowed_actions` -> `actions`
    - `denied_actions` -> `not_actions`
    - `allowed_data_actions` -> `data_actions`
    - `denied_data_actions` -> `denied_data_actions`
  - Renamed argument `role_assignment_name` to `name` in
    `KeyVaultAccessControlClient.create_role_assignment`, `.delete_role_assignment`,
    and `.get_role_assignment`
  - Renamed argument `role_definition_name` to `name` in
    `KeyVaultAccessControlClient.delete_role_definition` and `.get_role_definition`
  - Renamed argument `role_scope` to `scope` in `KeyVaultAccessControlClient` methods



  - `KeyVaultAccessControlClient` supports managing custom role definitions


  - Renamed `KeyVaultBackupClient.begin_full_backup()` to `.begin_backup()`
  - Renamed `KeyVaultBackupClient.begin_full_restore()` to `.begin_restore()`
  - Renamed `BackupOperation.azure_storage_blob_container_uri` to `.folder_url`
  - Renamed `id` property of `BackupOperation`, `RestoreOperation`, and
   `SelectiveKeyRestoreOperation` to `job_id`
  - Renamed `blob_storage_uri` parameters of `KeyVaultBackupClient.begin_restore()`
    and `.begin_selective_restore()` to `folder_url`
  - Removed redundant `folder_name` parameter from
    `KeyVaultBackupClient.begin_restore()` and `.begin_selective_restore()` (the
    `folder_url` parameter contains the folder name)
  - Renamed `KeyVaultPermission` attributes:
    - `actions` -> `allowed_actions`
    - `data_actions` -> `allowed_data_actions`
    - `not_actions` -> `denied_actions`
    - `not_data_actions` -> `denied_data_actions`
  - Renamed `KeyVaultRoleAssignment.assignment_id` to `.role_assignment_id`
  - Renamed `KeyVaultRoleScope` enum values:
    - `global_value` -> `GLOBAL`
    - `keys_value` -> `KEYS`



  - `KeyVaultBackupClient.get_backup_status` and `.get_restore_status` enable
    checking the status of a pending operation by its job ID
    ([#13718](https://github.com/Azure/azure-sdk-for-python/issues/13718))


  - The `role_assignment_name` parameter of
    `KeyVaultAccessControlClient.create_role_assignment` is now an optional
    keyword-only argument. When this argument isn't passed, the client will
    generate a name for the role assignment.
    ([#13512](https://github.com/Azure/azure-sdk-for-python/issues/13512))



  - `KeyVaultAccessControlClient` performs role-based access control operations
  - `KeyVaultBackupClient` performs full vault backup and full and selective
    restore operations


pkgId: c33b96d7a63b96325ffbbaf9f1dc2889902862fa58fe32b09e2c97a73214e8b2
name: python-azure-keyvault-certificates
arch: src
version: 4.8.0
epoch: 0
release: 1
summary: Microsoft Azure Key Vault Certificates Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-keyvault-certificates-4.8.0-1.src.rpm
checksum_type: sha256
description:
  Azure Key Vault helps solve the following problems:
  - Certificate management (this library) - create, manage, and deploy public and private SSL/TLS certificates
  - Cryptographic key management
  ([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) - create, store, and control access to the keys used to encrypt your data
  - Secrets management
  ([azure-keyvault-secrets](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets)) -
  securely store and control access to tokens, passwords, certificates, API keys,
  and other secrets
  - Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options

  [Source code][library_src]
  | [Package (PyPI)][pypi_package_certificates]
  | [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/)
  | [API reference documentation][reference_docs]
  | [Product documentation][azure_keyvault]
  | [Samples][certificates_samples]



  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_.
  _Python 3.8 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._



  Install [azure-keyvault-certificates][pypi_package_certificates] and
  [azure-identity][azure_identity_pypi] with [pip][pip]:
  ```Bash
  pip install azure-keyvault-certificates azure-identity
  ```
  [azure-identity][azure_identity] is used for Azure Active Directory
  authentication as demonstrated below.


  * An [Azure subscription][azure_sub]
  * Python 3.8 or later
  * An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli].


  In order to interact with the Azure Key Vault service, you will need an instance of a [CertificateClient][certificate_client_docs], as well as a **vault url** and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments.

  See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types.


  After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a certificate client (replacing the value of `VAULT_URL` with your vault's URL):

  <!-- SNIPPET:hello_world.create_a_certificate_client -->

  ```python
  VAULT_URL = os.environ["VAULT_URL"]
  credential = DefaultAzureCredential()
  client = CertificateClient(vault_url=VAULT_URL, credential=credential)
  ```

  <!-- END SNIPPET -->

  > **NOTE:** For an asynchronous client, import `azure.keyvault.certificates.aio`'s `CertificateClient` instead.



  With a [CertificateClient][certificate_client_docs] you can get certificates from the vault, create new certificates and new versions of existing certificates, update certificate metadata, and delete certificates. You can also manage certificate issuers, contacts, and management policies of certificates. This is illustrated in the [examples](#examples) below.


  This section contains code snippets covering common tasks:
  * [Create a certificate](#create-a-certificate)
  * [Retrieve a certificate](#retrieve-a-certificate)
  * [Update properties of an existing certificate](#update-properties-of-an-existing-certificate)
  * [Delete a certificate](#delete-a-certificate)
  * [List properties of certificates](#list-properties-of-certificates)
  * [Async operations](#async-operations)
  * [Asynchronously create a certificate](#asynchronously-create-a-certificate)
  * [Asynchronously list properties of certificates](#asynchronously-list-properties-of-certificates)


  [begin_create_certificate](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.begin_create_certificate)
  creates a certificate to be stored in the Azure Key Vault. If a certificate with the same name already exists, a new
  version of the certificate is created. Before creating a certificate, a management policy for the certificate can be
  created or our default policy will be used. This method returns a long running operation poller.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient, CertificatePolicy

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  create_certificate_poller = certificate_client.begin_create_certificate(
      certificate_name="cert-name", policy=CertificatePolicy.get_default()
  )
  print(create_certificate_poller.result())
  ```
  If you would like to check the status of your certificate creation, you can call `status()` on the poller or
  [get_certificate_operation](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.get_certificate_operation)
  with the name of the certificate.


  [get_certificate](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.get_certificate)
  retrieves the latest version of a certificate previously stored in the Key Vault.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  certificate = certificate_client.get_certificate("cert-name")

  print(certificate.name)
  print(certificate.properties.version)
  print(certificate.policy.issuer_name)
  ```

  [get_certificate_version](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.get_certificate_version)
  retrieves a specific version of a certificate.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  certificate = certificate_client.get_certificate_version(certificate_name="cert-name", version="cert-version")

  print(certificate.name)
  print(certificate.properties.version)
  ```


  [update_certificate_properties](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.update_certificate_properties)
  updates a certificate previously stored in the Key Vault.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)


  updated_certificate= certificate_client.update_certificate_properties(
      certificate_name="cert-name", enabled=False
  )

  print(updated_certificate.name)
  print(updated_certificate.properties.enabled)
  ```


  [begin_delete_certificate](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.begin_delete_certificate)
  requests Key Vault delete a certificate, returning a poller which allows you to wait for the deletion to finish.
  Waiting is helpful when the vault has [soft-delete][soft_delete] enabled, and you want to purge
  (permanently delete) the certificate as soon as possible. When [soft-delete][soft_delete] is disabled,
  `begin_delete_certificate` itself is permanent.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  deleted_certificate_poller = certificate_client.begin_delete_certificate("cert-name")

  deleted_certificate = deleted_certificate_poller.result()
  print(deleted_certificate.name)
  print(deleted_certificate.deleted_on)
  ```

  [list_properties_of_certificates](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient.list_properties_of_certificates)
  lists the properties of all certificates in the specified Key Vault.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  certificates = certificate_client.list_properties_of_certificates()

  for certificate in certificates:
      
      print(certificate.name)
  ```


  This library includes a complete set of async APIs. To use them, you must
  first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/).
  See
  [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport)
  for more information.

  Async clients and credentials should be closed when they're no longer needed. These
  objects are async context managers and define async `close` methods. For
  example:

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.certificates.aio import CertificateClient

  credential = DefaultAzureCredential()


  client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  ...
  await client.close()
  await credential.close()


  client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  async with client:
    async with credential:
      ...
  ```


  [create_certificate](https://aka.ms/azsdk/python/keyvault-certificates/aio/docs#azure.keyvault.certificates.aio.CertificateClient.create_certificate)
  creates a certificate to be stored in the Azure Key Vault. If a certificate with the same name already exists, a new
  version of the certificate is created. Before creating a certificate, a management policy for the certificate can be
  created or our default policy will be used. Awaiting `create_certificate` returns your created certificate if creation
  is successful, and a
  [CertificateOperation](https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateOperation)
  if it is not.
  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.certificates.aio import CertificateClient
  from azure.keyvault.certificates import CertificatePolicy

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  create_certificate_result = await certificate_client.create_certificate(
      certificate_name="cert-name", policy=CertificatePolicy.get_default()
  )
  print(create_certificate_result)
  ```


  [list_properties_of_certificates](https://aka.ms/azsdk/python/keyvault-certificates/aio/docs#azure.keyvault.certificates.aio.CertificateClient.list_properties_of_certificates)
  lists all the properties of the certificates in the client's vault:
  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.certificates.aio import CertificateClient

  credential = DefaultAzureCredential()

  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  certificates = certificate_client.list_properties_of_certificates()
  async for certificate in certificates:
      print(certificate.name)
  ```



  See the `azure-keyvault-certificates`
  [troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/TROUBLESHOOTING.md)
  for details on how to diagnose various failure scenarios.


  Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions].
  For example, if you try to get a key that doesn't exist in the vault, [CertificateClient][certificate_client_docs]
  raises [ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error):
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient
  from azure.core.exceptions import ResourceNotFoundError

  credential = DefaultAzureCredential()
  certificate_client = CertificateClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  try:
      certificate_client.get_certificate("which-does-not-exist")
  except ResourceNotFoundError as e:
      print(e.message)
  ```

  This library uses the standard
  [logging](https://docs.python.org/3.5/library/logging.html) library for logging.
  Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO
  level.

  Detailed DEBUG level logging, including request/response bodies and unredacted
  headers, can be enabled on a client with the `logging_enable` argument:
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.certificates import CertificateClient
  import sys
  import logging


  logger = logging.getLogger('azure')
  logger.setLevel(logging.DEBUG)


  handler = logging.StreamHandler(stream=sys.stdout)
  logger.addHandler(handler)

  credential = DefaultAzureCredential()


  client = CertificateClient(
      vault_url="https://my-key-vault.vault.azure.net/",
      credential=credential,
      logging_enable=True
  )
  ```

  Network trace logging can also be enabled for any single operation:
  ```python
  certificate = certificate_client.get_certificate(certificate_name="cert-name", logging_enable=True)
  ```


  Several samples are available in the Azure SDK for Python GitHub repository. These samples provide example code for additional Key Vault scenarios:

  - [Create/get/update/delete certificates][hello_world_sample] ([async version][hello_world_async_sample])
  - [Back up and recover certificates][backup_operations_sample] ([async version][backup_operations_async_sample])
  - [Import PKCS#12 (PFX) and PEM-formatted certificates into Key Vault][import_certificate_sample] ([async version][import_certificate_async_sample])
  - [List certificates][list_operations_sample] ([async version][list_operations_async_sample])
  - [Recover and purge certificates][recover_purge_operations_sample] ([async version][recover_purge_operations_async_sample])
  - [Manage certificate issuers][issuers_sample] ([async version][issuers_async_sample])
  - [Manage certificate contacts][contacts_sample] ([async version][contacts_async_sample])
  - [Extract a certificate's private key][parse_sample] ([async version][parse_async_sample])


  For more extensive documentation on Azure Key Vault, see the [API reference documentation][reference_docs].


  This project welcomes contributions and suggestions. Most contributions require
  you to agree to a Contributor License Agreement (CLA) declaring that you have
  the right to, and actually do, grant us the rights to use your contribution.
  For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether
  you need to provide a CLA and decorate the PR appropriately (e.g., label,
  comment). Simply follow the instructions provided by the bot. You will only
  need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct].
  For more information, see the
  [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact opencode@microsoft.com with any additional questions or comments.


  <!-- LINKS -->
  [azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions
  [azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
  [azure_identity_pypi]: https://pypi.org/project/azure-identity/
  [azure_keyvault]: https://docs.microsoft.com/azure/key-vault/general/overview
  [azure_keyvault_cli]: https://docs.microsoft.com/azure/key-vault/general/quick-create-cli
  [azure_sub]: https://azure.microsoft.com/free/

  [backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/backup_restore_operations.py
  [backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/backup_restore_operations_async.py

  [certificate_client_docs]: https://aka.ms/azsdk/python/keyvault-certificates/docs#azure.keyvault.certificates.CertificateClient
  [certificates_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/samples
  [code_of_conduct]: https://opensource.microsoft.com/codeofconduct/
  [contacts_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/contacts.py
  [contacts_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/contacts_async.py

  [default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential

  [hello_world_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/hello_world.py
  [hello_world_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/hello_world_async.py

  [import_certificate_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/samples/import_certificate.py
  [import_certificate_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/samples/import_certificate_async.py
  [issuers_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/issuers.py
  [issuers_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/issuers_async.py

  [library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/azure/keyvault/certificates
  [list_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/list_operations.py
  [list_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/list_operations_async.py

  [managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview

  [parse_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/parse_certificate.py
  [parse_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/parse_certificate_async.py
  [pip]: https://pypi.org/project/pip/
  [pypi_package_certificates]: https://pypi.org/project/azure-keyvault-certificates/

  [recover_purge_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/recover_purge_operations.py
  [recover_purge_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-certificates/samples/recover_purge_operations_async.py
  [reference_docs]: https://aka.ms/azsdk/python/keyvault-certificates/docs

  [soft_delete]: https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fkeyvault%2Fazure-keyvault-certificates%2FREADME.png)







  - Added support for service API version `7.5`


  > These changes do not impact the API of stable versions such as 4.7.0. Only code written against a beta version such as 4.8.0b2 may be affected.
  - Removed `CertificateProperties.x509_thumbprint_string`. To get the certificate's thumbprint in hex, use
    `CertificateProperties.x509_thumbprint.hex()` or print the `CertificateProperties` instance.


  - (From 4.8.0b1) Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))


  - Python 3.7 is no longer supported. Please use Python version 3.8 or later.
  - `asyncio` is no longer directly referenced by the library
    ([#33819](https://github.com/Azure/azure-sdk-for-python/pull/33819))
  - Key Vault API version `7.5` is now the default
  - Updated minimum `azure-core` version to 1.29.5
  - Dropped `azure-common` requirement




  - Added support for service API version `7.5-preview.1`


  - Key Vault API version `7.5-preview.1` is now the default




  - Added `CertificateProperties.x509_thumbprint_string` to return the hexadecimal string representation of the SHA-1 hash
    of the certificate ([#30166](https://github.com/Azure/azure-sdk-for-python/issues/30166))




  - Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))




  - Added support for service API version `7.4`
  - Clients each have a `send_request` method that can be used to send custom requests using the
    client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172))


  - The type hints for `KeyVaultCertificate.cer` and `DeletedCertificate.cer` are now
    `Optional[bytearray]` instead of `Optional[bytes]`
    ([#28959](https://github.com/Azure/azure-sdk-for-python/issues/28959))


  - Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - Key Vault API version `7.4` is now the default
  - Updated minimum `azure-core` version to 1.24.0
  - Dropped `msrest` requirement
  - Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`)
  - Added requirement for `typing-extensions>=4.0.1`




  - Clients verify the challenge resource matches the vault domain. This should affect few customers,
    who can provide `verify_challenge_resource=False` to client constructors to disable.
    See https://aka.ms/azsdk/blog/vault-uri for more information.




  - Documentation improvements
    ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039))




  - Port numbers are now preserved in the `vault_url` property of a `KeyVaultCertificateIdentifier`
    ([#24446](https://github.com/Azure/azure-sdk-for-python/issues/24446))




  - Key Vault API version 7.3 is now the default
  - Added support for multi-tenant authentication when using `azure-identity`
    1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))


  - `KeyType` now ignores casing during declaration, which resolves a scenario where Key Vault
    keys created with non-standard casing could not be fetched with the SDK
    ([#22797](https://github.com/Azure/azure-sdk-for-python/issues/22797))


  - (From 4.4.0b3) Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - Updated minimum `azure-core` version to 1.20.0
  - (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See
    https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate
    this parameter if `get_token` is implemented by a custom credential.




  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))




  - Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))


  - Updated minimum `azure-core` version to 1.15.0




  - Key Vault API version 7.3-preview is now the default


  - Updated type hints to fix mypy errors
    ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158))


  This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+.

  - Key Vault API version 7.2 is now the default
  - Updated minimum `msrest` version to 0.6.21
  - The `issuer_name` parameter for `CertificatePolicy` is now optional


  - Added class `KeyVaultCertificateIdentifier` that parses out a full ID returned by Key Vault,
    so users can easily access the certificate's `name`, `vault_url`, and `version`.




  - Correct typing for paging methods
  - Fixed incompatibility issues with API version 2016-10-01




  - Fixed an `AttributeError` during `get_certificate_version`
  - `import_certificate` no longer raises `AttributeError` when the `policy`
    keyword argument isn't passed
  - Values of `x-ms-keyvault-region` and `x-ms-keyvault-service-version` headers
    are no longer redacted in logging output


  - Key Vault API version 7.1 is now the default
  - Updated minimum `azure-core` version to 1.7.0


  - At construction, clients accept a `CustomHookPolicy` through the optional
    keyword argument `custom_hook_policy`
  - All client requests include a unique ID in the header `x-ms-client-request-id`
  - Dependency on `azure-common` for multiapi support


  - Support for Key Vault API version 7.1-preview
  ([#10124](https://github.com/Azure/azure-sdk-for-python/pull/10124))
    - Added `recoverable_days` to `CertificateProperties`
    - Added `ApiVersion` enum identifying Key Vault versions supported by this package


  - `CertificateClient` instances have a `close` method which closes opened
  sockets. Used as a context manager, a `CertificateClient` closes opened sockets
  on exit. ([#9906](https://github.com/Azure/azure-sdk-for-python/pull/9906))
  - Pollers no longer sleep after operation completion
  ([#9991](https://github.com/Azure/azure-sdk-for-python/pull/9991))


  - `azure.keyvault.certificates` defines `__version__`
  - Updated `msrest` requirement to >=0.6.0
  - Challenge authentication policy requires TLS
  ([#9457](https://github.com/Azure/azure-sdk-for-python/pull/9457))
  - Methods no longer raise the internal error `KeyVaultErrorException`
  ([#9690](https://github.com/Azure/azure-sdk-for-python/issues/9690))


  - First GA release


  - Challenge authentication policy preserves request options
  ([#8999](https://github.com/Azure/azure-sdk-for-python/pull/8999))
  - Added `vault_url` property to `CertificateOperation`
  - Removed `id`, `expires_on`, `not_before`, and `recover_level` properties from `CertificatePolicy`
  - Removed `vault_url` property from `CertificateIssuer`
  - Removed `vault_url` property from `IssuerProperties`



  - Updated `msrest` requirement to >=0.6.0
  - Renamed `get_policy` to `get_certificate_policy`
  - Renamed `update_policy` to `update_certificate_policy`
  - Renamed `create_contacts` to `set_contacts`
  - Renamed parameter `admin_details` of `create_issuer` and `update_issuer` to `admin_contacts`
  - Renamed all `name` parameters to include the name of the object whose name we are referring to.
  For example, the `name` parameter of `get_certificate` is now `certificate_name`
  - Renamed `AdministratorDetails` to `AdministratorContact`
  - Renamed the `ekus` property of `CertificatePolicy` to `enhanced_key_usage`
  - Renamed the `curve` property of `CertificatePolicy` to `key_curve_name`
  - Renamed the `san_upns` property of `CertificatePolicy` to `san_user_principal_names`
  - Made the `subject_name` property of `CertificatePolicy` a kwarg and renamed it to `subject`
  - Renamed the `deleted_date` property of `DeletedCertificate` to `deleted_on`
  - Removed the `issuer_properties` property from `CertificateIssuer` and added the `provider` property
  directly onto `CertificateIssuer`
  - Renamed property `admin_details` of `CertificateIssuer` to `admin_contacts`
  - Renamed the `thumbprint` property of `CertificateProperties` to `x509_thumbprint`
  - Added `WellKnownIssuerNames` enum class that holds popular issuer names
  - Renamed `SecretContentType` enum class to `CertificateContentType`



  - Removed redundant method `get_pending_certificate_signing_request()`. A pending CSR can be retrieved via `get_certificate_operation()`.
  - Renamed the sync method `create_certificate` to `begin_create_certificate`
  - Renamed `restore_certificate` to `restore_certificate_backup`
  - Renamed `get_certificate` to `get_certificate_version`
  - Renamed `get_certificate_with_policy` to `get_certificate`
  - Renamed `list_certificates` to `list_properties_of_certificates`
  - Renamed `list_properties_of_issuers` to `list_properties_of_issuers`
  - Renamed `list_certificate_versions` to `list_properties_of_certificate_versions`
  - `create_certificate` now has policy as a required parameter
  - All optional positional parameters besides `version` have been moved to kwargs
  - Renamed sync method `delete_certificate` to `begin_delete_certificate`
  - Renamed sync method `recover_certificate` to `begin_recover_deleted_certificate`
  - Renamed async method `recover_certificate` to `recover_deleted_certificate`
  - The sync method `begin_delete_certificate` and async `delete_certificate` now return pollers that return a `DeletedCertificate`
  - The sync method `begin_recover_deleted_certificate` and async `recover_deleted_certificate` now return pollers that return a `KeyVaultCertificate`

  - Renamed enum `ActionType` to `CertificatePolicyAction`
  - Renamed `Certificate` to `KeyVaultCertificate`
  - Renamed `Contact` to `CertificateContact`
  - Renamed `Issuer` to `CertificateIssuer`
  - Renamed `CertificateError` to `CertificateOperationError`
  - Renamed `expires` property of `CertificateProperties` and `CertificatePolicy` to `expires_on`
  - Renamed `created` property of `CertificateProperties`, `CertificatePolicy`, and `CertificateIssuer` to `created_on`
  - Renamed `updated` property of `CertificateProperties`, `CertificatePolicy`, and `CertificateIssuer` to `updated_on`
  - The `vault_endpoint` parameter of `CertificateClient` has been renamed to `vault_url`
  - The property `vault_endpoint` has been renamed to `vault_url` in all models
  - `CertificatePolicy` now has a public class method `get_default` allowing users to get the default `CertificatePolicy`
  - Logging can now be enabled properly on the client level


  - Enums `JsonWebKeyCurveName` and `JsonWebKeyType` have been renamed to `KeyCurveName` and `KeyType`, respectively.
  - Both async and sync versions of `create_certificate` now return pollers that return the created `Certificate` if creation is successful,
  and a `CertificateOperation` if not.
  - `Certificate` now has attribute `properties`, which holds certain properties of the
  certificate, such as `version`. This changes the shape of the `Certificate` type,
  as certain properties of `Certificate` (such as `version`) have to be accessed
  through the `properties` property.

  - `update_certificate` has been renamed to `update_certificate_properties`
  - The `vault_url` parameter of `CertificateClient` has been renamed to `vault_endpoint`
  - The property `vault_url` has been renamed to `vault_endpoint` in all models


  Version 4.0.0b3 is the first preview of our efforts to create a user-friendly and Pythonic client library for Azure Key Vault's certificates.

   This library is not a direct replacement for `azure-keyvault`. Applications
  using that library would require code changes to use `azure-keyvault-certificates`.
  This package's
  [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/README.md)
  and
  [samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates/samples)
  demonstrate the new API.


  - Packages scoped by functionality
      - `azure-keyvault-certificates` contains a client for certificate operations
  - Client instances are scoped to vaults (an instance interacts with one vault
  only)
  - Authentication using `azure-identity` credentials
    - see this package's
    [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/README.md)
    , and the
    [Azure Identity documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md)
    for more information


  - Distributed tracing framework OpenCensus is now supported
  - Asynchronous API supported on Python 3.5.3+
      - the `azure.keyvault.certificates.aio` namespace contains an async equivalent of
      the synchronous client in `azure.keyvault.certificates`
      - Async clients use [aiohttp](https://pypi.org/project/aiohttp/) for transport
      by default. See [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md/#transport)
      for more information about using other transports.


pkgId: 3e3591b3c823757c17bb0c128c1c0bc59255749e12cc10c512b09912a1b284c1
name: python-azure-keyvault-keys
arch: src
version: 4.9.0
epoch: 0
release: 1
summary: Microsoft Azure Key Vault Keys Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-keyvault-keys-4.9.0-1.src.rpm
checksum_type: sha256
description:
  Azure Key Vault helps solve the following problems:
  - Cryptographic key management (this library) - create, store, and control
  access to the keys used to encrypt your data
  - Secrets management
  ([azure-keyvault-secrets](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets)) -
  securely store and control access to tokens, passwords, certificates, API keys,
  and other secrets
  - Certificate management
  ([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) -
  create, manage, and deploy public and private SSL/TLS certificates
  - Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options

  [Source code][library_src]
  | [Package (PyPI)][pypi_package_keys]
  | [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/)
  | [API reference documentation][reference_docs]
  | [Product documentation][azure_keyvault]
  | [Samples][key_samples]



  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_.

  _Python 3.8 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._



  Install [azure-keyvault-keys][pypi_package_keys] and
  [azure-identity][azure_identity_pypi] with [pip][pip]:
  ```Bash
  pip install azure-keyvault-keys azure-identity
  ```
  [azure-identity][azure_identity] is used for Azure Active Directory authentication as demonstrated below.


  * An [Azure subscription][azure_sub]
  * Python 3.8 or later
  * An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli].
  * If using Managed HSM, an existing [Key Vault Managed HSM][managed_hsm]. If you need to create a Managed HSM, you can do so using the Azure CLI by following the steps in [this document][managed_hsm_cli].


  In order to interact with the Azure Key Vault service, you will need an instance of a [KeyClient][key_client_docs], as
  well as a **vault URL** and a credential object. This document demonstrates using a
  [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios. We recommend using a
  [managed identity][managed_identity] for authentication in production environments.

  See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their
  corresponding credential types.


  After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of
  authentication, you can do the following to create a key client (replacing the value of `VAULT_URL` with your vault's
  URL):

  <!-- SNIPPET:hello_world.create_a_key_client -->

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient

  VAULT_URL = os.environ["VAULT_URL"]
  credential = DefaultAzureCredential()
  client = KeyClient(vault_url=VAULT_URL, credential=credential)
  ```

  <!-- END SNIPPET -->

  > **NOTE:** For an asynchronous client, import `azure.keyvault.keys.aio`'s `KeyClient` instead.



  Azure Key Vault can create and store RSA and elliptic curve keys. Both can optionally be protected by hardware security
  modules (HSMs). Azure Key Vault can also perform cryptographic operations with them. For more information about keys
  and supported operations and algorithms, see the
  [Key Vault documentation](https://docs.microsoft.com/azure/key-vault/keys/about-keys).

  [KeyClient][key_client_docs] can create keys in the vault, get existing keys
  from the vault, update key metadata, and delete keys, as shown in the
  [examples](#examples) below.


  This section contains code snippets covering common tasks:
  * [Create a key](#create-a-key)
  * [Retrieve a key](#retrieve-a-key)
  * [Update an existing key](#update-an-existing-key)
  * [Delete a key](#delete-a-key)
  * [Configure automatic key rotation](#configure-automatic-key-rotation)
  * [List keys](#list-keys)
  * [Perform cryptographic operations](#cryptographic-operations)
  * [Async API](#async-api)
  * [Asynchronously create a key](#asynchronously-create-a-key)
  * [Asynchronously list keys](#asynchronously-list-keys)


  The [create_key](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.create_key) method can be
  used by a `KeyClient` to create a key of any type -- alternatively, specific helpers such as
  [create_rsa_key](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.create_rsa_key) and
  [create_ec_key](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.create_ec_key)
  create RSA and elliptic curve keys in the vault, respectively. If a key with the same name already exists, a new version
  of that key is created.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient

  credential = DefaultAzureCredential()

  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)


  rsa_key = key_client.create_rsa_key("rsa-key-name", size=2048)
  print(rsa_key.name)
  print(rsa_key.key_type)


  ec_key = key_client.create_ec_key("ec-key-name", curve="P-256")
  print(ec_key.name)
  print(ec_key.key_type)
  ```


  [get_key](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.get_key) retrieves a key
  previously stored in the Vault.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient

  credential = DefaultAzureCredential()

  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  key = key_client.get_key("key-name")
  print(key.name)
  ```


  [update_key_properties](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.update_key_properties)
  updates the properties of a key previously stored in the Key Vault.
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient

  credential = DefaultAzureCredential()

  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)


  updated_key = key_client.update_key_properties("key-name", enabled=False)

  print(updated_key.name)
  print(updated_key.properties.enabled)
  ```


  [begin_delete_key](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.begin_delete_key)
  requests Key Vault delete a key, returning a poller which allows you to wait for the deletion to finish. Waiting is
  helpful when the vault has [soft-delete][soft_delete] enabled, and you want to purge (permanently delete) the key as
  soon as possible. When [soft-delete][soft_delete] is disabled, `begin_delete_key` itself is permanent.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient

  credential = DefaultAzureCredential()

  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  deleted_key = key_client.begin_delete_key("key-name").result()

  print(deleted_key.name)
  print(deleted_key.deleted_date)
  ```


  [update_key_rotation_policy](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.update_key_rotation_policy)
  can be used by a `KeyClient` to configure automatic key rotation for a key by specifying a rotation policy.

  <!-- SNIPPET:key_rotation.update_a_rotation_policy -->

  ```python
  from azure.keyvault.keys import KeyRotationLifetimeAction, KeyRotationPolicy, KeyRotationPolicyAction




  actions = [KeyRotationLifetimeAction(KeyRotationPolicyAction.rotate, time_after_create="P2M")]
  updated_policy = client.update_key_rotation_policy(
      "rotation-sample-key", policy=KeyRotationPolicy(), expires_in="P90D", lifetime_actions=actions
  )
  assert updated_policy.expires_in == "P90D"
  ```

  <!-- END SNIPPET -->

  In addition,
  [rotate_key](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.rotate_key)
  allows you to rotate a key on-demand by creating a new version of the given key.

  <!-- SNIPPET:key_rotation.rotate_key -->

  ```python
  rotated_key = client.rotate_key("rotation-sample-key")
  print(f"Rotated the key on-demand; new version is {rotated_key.properties.version}")
  ```

  <!-- END SNIPPET -->


  [list_properties_of_keys](https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient.list_properties_of_keys)
  lists the properties of all of the keys in the client's vault.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient

  credential = DefaultAzureCredential()

  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  keys = key_client.list_properties_of_keys()

  for key in keys:
      
      print(key.name)
  ```


  [CryptographyClient](https://aka.ms/azsdk/python/keyvault-keys/crypto/docs#azure.keyvault.keys.crypto.CryptographyClient)
  enables cryptographic operations (encrypt/decrypt, wrap/unwrap, sign/verify) using a particular key.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient
  from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm

  credential = DefaultAzureCredential()
  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  key = key_client.get_key("key-name")
  crypto_client = CryptographyClient(key, credential=credential)
  plaintext = b"plaintext"

  result = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, plaintext)
  decrypted = crypto_client.decrypt(result.algorithm, result.ciphertext)
  ```

  See the
  [package documentation][crypto_client_docs]
  for more details of the cryptography API.


  This library includes a complete set of async APIs. To use them, you must
  first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/).
  See
  [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport)
  for more information.

  Async clients and credentials should be closed when they're no longer needed. These
  objects are async context managers and define async `close` methods. For
  example:

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.keys.aio import KeyClient

  credential = DefaultAzureCredential()


  client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  ...
  await client.close()
  await credential.close()


  client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  async with client:
    async with credential:
      ...
  ```


  [create_rsa_key](https://aka.ms/azsdk/python/keyvault-keys/aio/docs#azure.keyvault.keys.aio.KeyClient.create_rsa_key) and
  [create_ec_key](https://aka.ms/azsdk/python/keyvault-keys/aio/docs#azure.keyvault.keys.aio.KeyClient.create_ec_key)
  create RSA and elliptic curve keys in the vault, respectively. If a key with the same name already exists, a new
  version of the key is created.

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.keys.aio import KeyClient

  credential = DefaultAzureCredential()
  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)


  rsa_key = await key_client.create_rsa_key("rsa-key-name", size=2048)
  print(rsa_key.name)
  print(rsa_key.key_type)


  ec_key = await key_client.create_ec_key("ec-key-name", curve="P-256")
  print(ec_key.name)
  print(ec_key.key_type)
  ```


  [list_properties_of_keys](https://aka.ms/azsdk/python/keyvault-keys/aio/docs#azure.keyvault.keys.aio.KeyClient.list_properties_of_keys)
  lists the properties of all of the keys in the client's vault.

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.keys.aio import KeyClient

  credential = DefaultAzureCredential()
  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  keys = key_client.list_properties_of_keys()

  async for key in keys:
      print(key.name)
  ```



  See the `azure-keyvault-keys`
  [troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/TROUBLESHOOTING.md)
  for details on how to diagnose various failure scenarios.


  Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions].
  For example, if you try to get a key that doesn't exist in the vault, [KeyClient][key_client_docs]
  raises [ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error):

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient
  from azure.core.exceptions import ResourceNotFoundError

  credential = DefaultAzureCredential()
  key_client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  try:
      key_client.get_key("which-does-not-exist")
  except ResourceNotFoundError as e:
      print(e.message)
  ```


  This library uses the standard
  [logging](https://docs.python.org/3/library/logging.html) library for logging.
  Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO
  level.

  Detailed DEBUG level logging, including request/response bodies and unredacted
  headers, can be enabled on a client with the `logging_enable` argument:
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.keys import KeyClient
  import sys
  import logging


  logger = logging.getLogger('azure')
  logger.setLevel(logging.DEBUG)


  handler = logging.StreamHandler(stream=sys.stdout)
  logger.addHandler(handler)

  credential = DefaultAzureCredential()


  client = KeyClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential, logging_enable=True)
  ```

  Similarly, `logging_enable` can enable detailed logging for a single operation,
  even when it isn't enabled for the client:
  ```python
  client.get_key("my-key", logging_enable=True)
  ```


  Several samples are available in the Azure SDK for Python GitHub repository.
  These provide example code for additional Key Vault scenarios:

  - [Create/get/update/delete keys][hello_world_sample] ([async version][hello_world_async_sample])
  - [Basic list operations for keys][list_operations_sample] ([async version][list_operations_async_sample])
  - [Back up and recover keys][backup_operations_sample] ([async version][backup_operations_async_sample])
  - [Recover and purge keys][recover_purge_sample] ([async version][recover_purge_async_sample])
  - [Create/update key rotation policies and rotate keys on-demand][key_rotation_sample] ([async version][key_rotation_async_sample])
  - [Use the `send_request` client method][send_request_sample]


  For more extensive documentation on Azure Key Vault, see the
  [API reference documentation][reference_docs].


  This project welcomes contributions and suggestions. Most contributions require
  you to agree to a Contributor License Agreement (CLA) declaring that you have
  the right to, and actually do, grant us the rights to use your contribution.
  For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether
  you need to provide a CLA and decorate the PR appropriately (e.g., label,
  comment). Simply follow the instructions provided by the bot. You will only
  need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct].
  For more information, see the
  [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact opencode@microsoft.com with any additional questions or comments.


  <!-- LINKS -->
  [azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions
  [azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
  [azure_identity_pypi]: https://pypi.org/project/azure-identity/
  [azure_keyvault]: https://docs.microsoft.com/azure/key-vault/
  [azure_keyvault_cli]: https://docs.microsoft.com/azure/key-vault/general/quick-create-cli
  [azure_sub]: https://azure.microsoft.com/free/

  [backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/backup_restore_operations.py
  [backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/backup_restore_operations_async.py

  [code_of_conduct]: https://opensource.microsoft.com/codeofconduct/
  [crypto_client_docs]: https://aka.ms/azsdk/python/keyvault-keys/crypto/docs

  [default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential

  [hello_world_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/hello_world.py
  [hello_world_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/hello_world_async.py

  [key_client_docs]: https://aka.ms/azsdk/python/keyvault-keys/docs#azure.keyvault.keys.KeyClient
  [key_rotation_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/samples/key_rotation.py
  [key_rotation_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/samples/key_rotation_async.py
  [key_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/samples

  [library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys
  [list_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/list_operations.py
  [list_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/list_operations_async.py

  [managed_hsm]: https://docs.microsoft.com/azure/key-vault/managed-hsm/overview
  [managed_hsm_cli]: https://docs.microsoft.com/azure/key-vault/managed-hsm/quick-create-cli
  [managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview

  [pip]: https://pypi.org/project/pip/
  [pypi_package_keys]: https://pypi.org/project/azure-keyvault-keys/

  [recover_purge_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/recover_purge_operations.py
  [recover_purge_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-keys/samples/recover_purge_operations_async.py
  [reference_docs]: https://aka.ms/azsdk/python/keyvault-keys/docs

  [send_request_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/samples/send_request.py
  [soft_delete]: https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fkeyvault%2Fazure-keyvault-keys%2FREADME.png)







  - Added support for service API version `7.5`
  - (From 4.9.0b2) The `cryptography` library's `RSAPrivateKey` and `RSAPublicKey` interfaces are now implemented by
    `KeyVaultRSAPrivateKey` and `KeyVaultRSAPublicKey` classes that can use keys managed by Key Vault
  - (From 4.9.0b2) `CryptographyClient` has `create_rsa_private_key` and `create_rsa_public_key` methods that return a
    `KeyVaultRSAPrivateKey` and `KeyVaultRSAPublicKey`, respectively
  - (From 4.9.0b3) Added `KeyProperties.hsm_platform` to get the underlying HSM platform


  - (From 4.9.0b1) Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))


  - Python 3.7 is no longer supported. Please use Python version 3.8 or later.
  - `asyncio` is no longer directly referenced by the library
    ([#33819](https://github.com/Azure/azure-sdk-for-python/pull/33819))
  - Updated minimum `azure-core` version to 1.29.5
  - Dropped `azure-common` requirement




  - Added support for service API version `7.5-preview.1`
  - Added `KeyProperties.hsm_platform` to get the underlying HSM platform


  - Key Vault API version `7.5-preview.1` is now the default




  - The `cryptography` library's `RSAPrivateKey` and `RSAPublicKey` interfaces are now implemented by
    `KeyVaultRSAPrivateKey` and `KeyVaultRSAPublicKey` classes that can use keys managed by Key Vault
  - `CryptographyClient` has `create_rsa_private_key` and `create_rsa_public_key` methods that return a
    `KeyVaultRSAPrivateKey` and `KeyVaultRSAPublicKey`, respectively




  - Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))




  - Added support for service API version `7.4`
  - Clients each have a `send_request` method that can be used to send custom requests using the
    client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172))
  - (From 4.8.0b1) An attempt will be made to generate an IV if one isn't provided for local encryption
    ([#25380](https://github.com/Azure/azure-sdk-for-python/pull/25380))


  > These changes do not impact the API of stable versions such as 4.7.0. Only code written against a beta version such as 4.8.0b2 may be affected.
  - Removed support for octet key pair (OKP) keys and operations


  - Key Vault API version `7.4` is now the default
  - (From 4.8.0b1) Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - (From 4.8.0b1) Updated minimum `azure-core` version to 1.24.0
  - (From 4.8.0b1) Updated minimum `msrest` version to 0.7.1
  - (From 4.8.0b2) Dropped `msrest` requirement
  - (From 4.8.0b2) Dropped `six` requirement
  - (From 4.8.0b2) Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`)
  - (From 4.8.0b2) Added requirement for `typing-extensions>=4.0.1`




  - Added support for service API version `7.4-preview.1`
  - `KeyClient` has a `create_okp_key` method to create an octet key pair (OKP) on Managed HSM
  - Added `eddsa` to `SignatureAlgorithm` enum to support signing and verifying using an
    Edwards-Curve Digital Signature Algorithm (EdDSA) on Managed HSM
  - Added `okp` and `okp_hsm` to `KeyType` enum for octet key pairs
  - Added `ed25519` to `KeyCurveName` enum to support use of the Ed25519 Edwards curve


  - Key Vault API version `7.4-preview.1` is now the default
  - Dropped `msrest` requirement
  - Dropped `six` requirement
  - Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`)
  - Added requirement for `typing-extensions>=4.0.1`




  - An attempt will be made to generate an IV if one isn't provided for local encryption
    ([#25380](https://github.com/Azure/azure-sdk-for-python/pull/25380))


  - Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - Updated minimum `azure-core` version to 1.24.0
  - Updated minimum `msrest` version to 0.7.1




  - Clients verify the challenge resource matches the vault domain. This should affect few customers,
    who can provide `verify_challenge_resource=False` to client constructors to disable.
    See https://aka.ms/azsdk/blog/vault-uri for more information.


  - Changes from version 4.7.0b1 have been reverted and will be included in version 4.8.0b1




  - An attempt will be made to generate an IV if one isn't provided for local encryption
    ([#25380](https://github.com/Azure/azure-sdk-for-python/pull/25380))


  - The most recent release was version 4.6.1 instead of the intended version, 4.5.2.
    The next stable release is planned to be version 4.7.0.
  - Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - Updated minimum `azure-core` version to 1.24.0




  - Documentation improvements
    ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039))




  - If a key's ID contains a port number, this port will now be preserved in the vault URL of a
    `CryptographyClient` instance created from this key
    ([#24446](https://github.com/Azure/azure-sdk-for-python/issues/24446))
    - Port numbers are now preserved in the `vault_url` property of a `KeyVaultKeyIdentifier`




  - Fixed error that could occur when fetching a key rotation policy that has no defined
    `lifetime_actions`.




  - Key Vault API version 7.3 is now the default
  - Added support for multi-tenant authentication when using `azure-identity`
    1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))
  - (From 4.5.0b1) `KeyClient` has a `get_random_bytes` method for getting a requested number of
    random bytes from a managed HSM
  - (From 4.5.0b2) Added support for secure key release from a Managed HSM
    ([#19588](https://github.com/Azure/azure-sdk-for-python/issues/19588))
    - Added `release_key` method to `KeyClient` for releasing the private component of a key
    - Added `exportable` and `release_policy` keyword-only arguments to key creation and import
      methods
    - Added `KeyExportEncryptionAlgorithm` enum for specifying an encryption algorithm to be used
      in key release
  - (From 4.5.0b4) Added `KeyClient.get_cryptography_client`, which provides a simple way to
    create a `CryptographyClient` for a key, given its name and optionally a version
    ([#20621](https://github.com/Azure/azure-sdk-for-python/issues/20621))
  - (From 4.5.0b4) Added support for automated and on-demand key rotation in Azure Key Vault
    ([#19840](https://github.com/Azure/azure-sdk-for-python/issues/19840))
    - Added `KeyClient.rotate_key` to rotate a key on-demand
    - Added `KeyClient.update_key_rotation_policy` to update a key's automated rotation policy
  - (From 4.5.0b6) Added `immutable` keyword-only argument and property to `KeyReleasePolicy` to
    support immutable release policies. Once a release policy is marked as immutable, it can no
    longer be modified.


  > These changes do not impact the API of stable versions such as 4.4.0.
  > Only code written against a beta version such as 4.5.0b1 may be affected.
  - `KeyClient.update_key_rotation_policy` accepts a required `policy` argument
    ([#22981](https://github.com/Azure/azure-sdk-for-python/issues/22981))
  - The optional `version` parameter in `KeyClient.release_key` is now a keyword-only argument
    ([#22981](https://github.com/Azure/azure-sdk-for-python/issues/22981))
  - Renamed the `name` parameter in `KeyClient.get_key_rotation_policy` and
    `KeyClient.update_key_rotation_policy` to `key_name`
    ([#22981](https://github.com/Azure/azure-sdk-for-python/issues/22981))
  - Enum values in `azure-keyvault-keys` are now uniformly lower-cased
    ([#22981](https://github.com/Azure/azure-sdk-for-python/issues/22981))


  - `KeyType` now ignores casing during declaration, which resolves a scenario where Key Vault
    keys created with non-standard casing could not be fetched with the SDK
    ([#22797](https://github.com/Azure/azure-sdk-for-python/issues/22797))


  - (From 4.5.0b6) Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - (From 4.5.0b6) Updated minimum `azure-core` version to 1.20.0
  - (From 4.5.0b3) Updated type hints to fix mypy errors
    ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158))
  - (From 4.5.0b4) `CryptographyClient` no longer requires a key version when providing a key ID to its constructor
    (though providing a version is still recommended)
  - (From 4.5.0b5) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See
    https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate
    this parameter if `get_token` is implemented by a custom credential.
  - (From 4.5.0b6) Updated type hints for `KeyProperties` model's `managed`, `exportable`, and
    `release_policy` properties ([#22368](https://github.com/Azure/azure-sdk-for-python/pull/22368))




  - Added `immutable` keyword-only argument and property to `KeyReleasePolicy` to support immutable
    release policies. Once a release policy is marked as immutable, it can no longer be modified.


  > These changes do not impact the API of stable versions such as 4.4.0.
  > Only code written against a beta version such as 4.5.0b1 may be affected.
  - Renamed the required argument `data` in `KeyReleasePolicy`'s constructor to
    `encoded_policy`


  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - Updated minimum `azure-core` version to 1.20.0
  - Updated type hints for `KeyProperties` model's `managed`, `exportable`, and `release_policy`
    properties ([#22368](https://github.com/Azure/azure-sdk-for-python/pull/22368))
  - (From 4.5.0b5) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))




  - Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))


  > These changes do not impact the API of stable versions such as 4.4.0.
  > Only code written against a beta version such as 4.5.0b1 may be affected.
  - `KeyClient.get_random_bytes` now returns bytes instead of RandomBytes. The RandomBytes class
    has been removed
  - Renamed the `version` keyword-only argument in `KeyClient.get_cryptography_client` to
    `key_version`
  - Renamed `KeyReleasePolicy.data` to `KeyReleasePolicy.encoded_policy`
  - Renamed the `target` parameter in `KeyClient.release_key` to `target_attestation_token`


  - Updated minimum `azure-core` version to 1.15.0




  - Added `KeyClient.get_cryptography_client`, which provides a simple way to create a
    `CryptographyClient` for a key, given its name and optionally a version
    ([#20621](https://github.com/Azure/azure-sdk-for-python/issues/20621))
  - Added support for automated and on-demand key rotation in Azure Key Vault
    ([#19840](https://github.com/Azure/azure-sdk-for-python/issues/19840))
    - Added `KeyClient.rotate_key` to rotate a key on-demand
    - Added `KeyClient.update_key_rotation_policy` to update a key's automated rotation policy


  - `CryptographyClient` no longer requires a key version when providing a key ID to its constructor
    (though providing a version is still recommended)




  - Updated type hints to fix mypy errors
    ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158))




  - Added support for secure key release from a Managed HSM
    ([#19588](https://github.com/Azure/azure-sdk-for-python/issues/19588))
    - Added `release_key` method to `KeyClient` for releasing the private component of a key
    - Added `exportable` and `release_policy` keyword-only arguments to key creation and import
      methods
    - Added `KeyExportEncryptionAlgorithm` enum for specifying an encryption algorithm to be used
      in key release


  > These changes do not impact the API of stable versions such as 4.4.0.
  > Only code written against a beta version such as 4.5.0b1 may be affected.
  - `KeyClient.get_random_bytes` now returns a `RandomBytes` model with bytes in a `value`
    property, rather than returning the bytes directly
    ([#19895](https://github.com/Azure/azure-sdk-for-python/issues/19895))


  Beginning with this release, this library requires Python 2.7 or 3.6+.


  - Key Vault API version 7.3-preview is now the default
  - `KeyClient` has a `get_random_bytes` method for getting a requested number of random
    bytes from a managed HSM


  This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+.

  - Key Vault API version 7.2 is now the default
  - (From 4.4.0b1) Updated minimum `msrest` version to 0.6.21


  - `KeyClient` has a `create_oct_key` method for creating symmetric keys
  - `KeyClient`'s `create_key` and `create_rsa_key` methods now accept a `public_exponent`
    keyword-only argument ([#18016](https://github.com/Azure/azure-sdk-for-python/issues/18016))
  - (From 4.4.0b1) Added support for Key Vault API version 7.2
    ([#16566](https://github.com/Azure/azure-sdk-for-python/pull/16566))
    - Added `oct_hsm` to `KeyType`
    - Added 128-, 192-, and 256-bit AES-GCM, AES-CBC, and AES-CBCPAD encryption
      algorithms to `EncryptionAlgorithm`
    - Added 128- and 192-bit AES-KW key wrapping algorithms to `KeyWrapAlgorithm`
    - `CryptographyClient`'s `encrypt` method accepts `iv` and
      `additional_authenticated_data` keyword arguments
    - `CryptographyClient`'s `decrypt` method accepts `iv`,
      `additional_authenticated_data`, and `authentication_tag` keyword arguments
    - Added `iv`, `aad`, and `tag` properties to `EncryptResult`
  - (From 4.4.0b3) `CryptographyClient` will perform all operations locally if initialized with
    the `.from_jwk` factory method
    ([#16565](https://github.com/Azure/azure-sdk-for-python/pull/16565))
  - (From 4.4.0b3) Added requirement for `six`>=1.12.0
  - (From 4.4.0b4) `CryptographyClient` can perform AES-CBCPAD encryption and decryption locally
    ([#17762](https://github.com/Azure/azure-sdk-for-python/pull/17762))


  > These changes do not impact the API of stable versions such as 4.3.1.
  > Only code written against a beta version such as 4.4.0b1 may be affected.
  - `parse_key_vault_key_id` and `KeyVaultResourceId` have been replaced by a
    `KeyVaultKeyIdentifier` class, which can be initialized with a key ID



  - `CryptographyClient` can perform AES-CBCPAD encryption and decryption locally
    ([#17762](https://github.com/Azure/azure-sdk-for-python/pull/17762))



  - `CryptographyClient` will perform all operations locally if initialized with
    the `.from_jwk` factory method
    ([#16565](https://github.com/Azure/azure-sdk-for-python/pull/16565))
  - Added requirement for six>=1.12.0



  - API versions older than 7.2-preview no longer raise `ImportError` when
    performing async operations ([#16680](https://github.com/Azure/azure-sdk-for-python/pull/16680))



  - Key Vault API version 7.2-preview is now the default
  - Updated msrest requirement to >=0.6.21


  - Support for Key Vault API version 7.2-preview
    ([#16566](https://github.com/Azure/azure-sdk-for-python/pull/16566))
    - Added `oct_hsm` to `KeyType`
    - Added 128-, 192-, and 256-bit AES-GCM, AES-CBC, and AES-CBCPAD encryption
      algorithms to `EncryptionAlgorithm`
    - Added 128- and 192-bit AES-KW key wrapping algorithms to `KeyWrapAlgorithm`
    - `CryptographyClient`'s `encrypt` method accepts `iv` and
      `additional_authenticated_data` keyword arguments
    - `CryptographyClient`'s `decrypt` method accepts `iv`,
      `additional_authenticated_data`, and `authentication_tag` keyword arguments
    - Added `iv`, `aad`, and `tag` properties to `EncryptResult`
  - Added method `parse_key_vault_key_id` that parses out a full ID returned by
  Key Vault, so users can easily access the key's `name`, `vault_url`, and `version`.



  - `CryptographyClient` operations no longer raise `AttributeError` when
    the client was constructed with a key ID
    ([#15608](https://github.com/Azure/azure-sdk-for-python/issues/15608))



  - `CryptographyClient` can perform decrypt and sign operations locally
    ([#9754](https://github.com/Azure/azure-sdk-for-python/issues/9754))


  - Correct typing for async paging methods



  - Values of `x-ms-keyvault-region` and `x-ms-keyvault-service-version` headers
    are no longer redacted in logging output
  - `CryptographyClient` will no longer perform encrypt or wrap operations when
    its key has expired or is not yet valid


  - Key Vault API version 7.1 is now the default
  - Updated minimum `azure-core` version to 1.7.0


  - At construction, clients accept a `CustomHookPolicy` through the optional
    keyword argument `custom_hook_policy`
  - All client requests include a unique ID in the header `x-ms-client-request-id`
  - Dependency on `azure-common` for multiapi support


  - Support for Key Vault API version 7.1-preview
  ([#10124](https://github.com/Azure/azure-sdk-for-python/pull/10124))
    - Added `import_key` to `KeyOperation`
    - Added `recoverable_days` to `CertificateProperties`
    - Added `ApiVersion` enum identifying Key Vault versions supported by this package


  - `KeyClient` instances have a `close` method which closes opened sockets. Used
  as a context manager, a `KeyClient` closes opened sockets on exit.
  ([#9906](https://github.com/Azure/azure-sdk-for-python/pull/9906))
  - Pollers no longer sleep after operation completion
  ([#9991](https://github.com/Azure/azure-sdk-for-python/pull/9991))


  - `azure.keyvault.keys` defines `__version__`
  - Challenge authentication policy preserves request options
  ([#8999](https://github.com/Azure/azure-sdk-for-python/pull/8999))
  - Updated `msrest` requirement to >=0.6.0
  - Challenge authentication policy requires TLS
  ([#9457](https://github.com/Azure/azure-sdk-for-python/pull/9457))
  - Methods no longer raise the internal error `KeyVaultErrorException`
  ([#9690](https://github.com/Azure/azure-sdk-for-python/issues/9690))
  - Fix `AttributeError` in async CryptographyClient when verifying signatures remotely
  ([#9734](https://github.com/Azure/azure-sdk-for-python/pull/9734))



  - Removed `KeyClient.get_cryptography_client()` and `CryptographyClient.get_key()`
  - Moved the optional parameters of several methods into kwargs (
  [docs](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-keyvault-keys/4.0.0/index.html)
  detail the new keyword arguments):
    - `create_key` now has positional parameters `name` and `key_type`
    - `create_ec_key` and `create_rsa_key` now have one positional parameter, `name`
    - `update_key_properties` now has two positional parameters, `name` and
       (optional) `version`
    - `import_key` now has positional parameters `name` and `key`
  - `CryptographyClient` operations return class instances instead of tuples and renamed the following
  properties
      - Renamed the `decrypted_bytes` property of `DecryptResult` to `plaintext`
      - Renamed the `unwrapped_bytes` property of `UnwrapResult` to `key`
      - Renamed the `result` property of `VerifyResult` to `is_valid`
  - Renamed the `UnwrapKeyResult` and `WrapKeyResult` classes to `UnwrapResult` and `WrapResult`
  - Renamed `list_keys` to `list_properties_of_keys`
  - Renamed `list_key_versions` to `list_properties_of_key_versions`
  - Renamed sync method `delete_key` to `begin_delete_key`
  - The sync method `begin_delete_key` and async `delete_key` now return pollers that return a `DeletedKey`
  - Renamed `Key` to `KeyVaultKey`
  - `KeyVaultKey` properties `created`, `expires`, and `updated` renamed to `created_on`,
  `expires_on`, and `updated_on`
  - The `vault_endpoint` parameter of `KeyClient` has been renamed to `vault_url`
  - The property `vault_endpoint` has been renamed to `vault_url` in all models


  - Now all `CryptographyClient` returns include `key_id` and `algorithm` properties



  - Enums `JsonWebKeyCurveName`, `JsonWebKeyOperation`, and `JsonWebKeyType` have
  been renamed to `KeyCurveName`, `KeyOperation`, and `KeyType`, respectively.
  - `Key` now has attribute `properties`, which holds certain properties of the
  key, such as `version`. This changes the shape of the returned `Key` type,
  as certain properties of `Key` (such as `version`) have to be accessed
  through the `properties` property.

  - `update_key` has been renamed to `update_key_properties`
  - The `vault_url` parameter of `KeyClient` has been renamed to `vault_endpoint`
  - The property `vault_url` has been renamed to `vault_endpoint` in all models


  - The `key` argument to `import_key` should be an instance of `azure.keyvault.keys.JsonWebKey`
  ([#7590](https://github.com/Azure/azure-sdk-for-python/pull/7590))




  - `CryptographyClient` methods `wrap` and `unwrap` are renamed `wrap_key` and
  `unwrap_key`, respectively.


  - `CryptographyClient` performs encrypt, verify and wrap operations locally
  when its key's public material is available (i.e., when it has keys/get
  permission).



  - Removed `azure.core.Configuration` from the public API in preparation for a
  revamped configuration API. Static `create_config` methods have been renamed
  `_create_config`, and will be removed in a future release.
  - Removed `wrap_key` and `unwrap_key` from `KeyClient`. These are now available
  through `CryptographyClient`.
  - This version of the library requires `azure-core` 1.0.0b2
    - If you later want to revert to a version requiring azure-core 1.0.0b1,
    of this or another Azure SDK library, you must explicitly install azure-core
    1.0.0b1 as well. For example:
    `pip install azure-core==1.0.0b1 azure-keyvault-keys==4.0.0b1`


  - Added `CryptographyClient`, a client for performing cryptographic operations
  (encrypt/decrypt, wrap/unwrap, sign/verify) with a key.
  - Distributed tracing framework OpenCensus is now supported
  - Added support for HTTP challenge based authentication, allowing clients to
  interact with vaults in sovereign clouds.


  - Async clients use [aiohttp](https://pypi.org/project/aiohttp/) for transport
  by default. See
  [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md/#transport)
  for more information about using other transports.


  Version 4.0.0b1 is the first preview of our efforts to create a user-friendly
  and Pythonic client library for Azure Key Vault. For more information about
  preview releases of other Azure SDK libraries, please visit
  https://aka.ms/azure-sdk-preview1-python.

  This library is not a direct replacement for `azure-keyvault`. Applications
  using that library would require code changes to use `azure-keyvault-keys`.
  This package's
  [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/README.md)
  and
  [samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/samples)
  demonstrate the new API.


  - Packages scoped by functionality
      - `azure-keyvault-keys` contains a client for key operations,
      `azure-keyvault-secrets` contains a client for secret operations
  - Client instances are scoped to vaults (an instance interacts with one vault
  only)
  - Asynchronous API supported on Python 3.5.3+
      - the `azure.keyvault.keys.aio` namespace contains an async equivalent of
      the synchronous client in `azure.keyvault.keys`
  - Authentication using `azure-identity` credentials
    - see this package's
    [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys/README.md)
    , and the
    [Azure Identity documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md)
    for more information


  - Certificate management APIs
  - Cryptographic operations, e.g. sign, un/wrap_key, verify, en- and
  decrypt
  - National cloud support. This release supports public global cloud vaults,
      e.g. https://{vault-name}.vault.azure.net


pkgId: 2770598fc0ae8e2a731cd62428768d232ea845fad201d692033b43db1a8a87fe
name: python-azure-keyvault-nspkg
arch: src
version: 1.0.0
epoch: 0
release: 1
summary: Microsoft Azure Key Vault Namespace Package [Internal]
url: https://github.com/Azure/azure-sdk-for-python/tree/master/sdk/keyvault
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-keyvault-nspkg-1.0.0-1.src.rpm
checksum_type: sha256
description:
  This is the Microsoft Azure Key Vault namespace package. It isn't intended to
  be installed directly. Key Vault client libraries are located elsewhere:
  - [`azure-keyvault-certificates`](https://pypi.org/project/azure-keyvault-certificates)
  - [`azure-keyvault-keys`](https://pypi.org/project/azure-keyvault-keys/)
  - [`azure-keyvault-secrets`](https://pypi.org/project/azure-keyvault-secrets)

  This package is for Python 2 only. It provides the necessary files for other
  packages to extend the `azure` namespace. Python 3.x libraries use
  [`PEP420`](https://www.python.org/dev/peps/pep-0420/) instead.

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fkeyvault%2Fazure-keyvault-nspkg%2FFREADME.png)


pkgId: ae72f55dd55035a6e3b1d8928ffd4f27bb9748591b58ca81eb1cec30f7f965e6
name: python-azure-keyvault-secrets
arch: src
version: 4.8.0
epoch: 0
release: 1
summary: Microsoft Azure Key Vault Secrets Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-keyvault-secrets-4.8.0-1.src.rpm
checksum_type: sha256
description:
  Azure Key Vault helps solve the following problems:

  - Secrets management (this library) -
  securely store and control access to tokens, passwords, certificates, API keys,
  and other secrets
  - Cryptographic key management
  ([azure-keyvault-keys](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-keys)) -
  create, store, and control access to the keys used to encrypt your data
  - Certificate management
  ([azure-keyvault-certificates](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-certificates)) -
  create, manage, and deploy public and private SSL/TLS certificates
  - Vault administration ([azure-keyvault-administration](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration)) - role-based access control (RBAC), and vault-level backup and restore options

  [Source code][library_src]
  | [Package (PyPI)][pypi_package_secrets]
  | [Package (Conda)](https://anaconda.org/microsoft/azure-keyvault/)
  | [API reference documentation][reference_docs]
  | [Product documentation][azure_keyvault]
  | [Samples][secret_samples]



  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to https://github.com/Azure/azure-sdk-for-python/issues/20691_.
  _Python 3.8 or later is required to use this package. For more details, please refer to [Azure SDK for Python version support policy](https://github.com/Azure/azure-sdk-for-python/wiki/Azure-SDKs-Python-version-support-policy)._



  Install [azure-keyvault-secrets][pypi_package_secrets] and
  [azure-identity][azure_identity_pypi] with [pip][pip]:
  ```Bash
  pip install azure-keyvault-secrets azure-identity
  ```
  [azure-identity][azure_identity] is used for Azure Active Directory
  authentication as demonstrated below.


  * An [Azure subscription][azure_sub]
  * Python 3.8 or later
  * An existing [Azure Key Vault][azure_keyvault]. If you need to create one, you can do so using the Azure CLI by following the steps in [this document][azure_keyvault_cli].


  In order to interact with the Azure Key Vault service, you will need an instance of a [SecretClient][secret_client_docs], as well as a **vault url** and a credential object. This document demonstrates using a [DefaultAzureCredential][default_cred_ref], which is appropriate for most scenarios, including local development and production environments. We recommend using a [managed identity][managed_identity] for authentication in production environments.

  See [azure-identity][azure_identity] documentation for more information about other methods of authentication and their corresponding credential types.


  After configuring your environment for the [DefaultAzureCredential][default_cred_ref] to use a suitable method of authentication, you can do the following to create a secret client (replacing the value of `VAULT_URL` with your vault's URL):

  <!-- SNIPPET:hello_world.create_secret_client -->

  ```python
  VAULT_URL = os.environ["VAULT_URL"]
  credential = DefaultAzureCredential()
  client = SecretClient(vault_url=VAULT_URL, credential=credential)
  ```

  <!-- END SNIPPET -->

  > **NOTE:** For an asynchronous client, import `azure.keyvault.secrets.aio`'s `SecretClient` instead.



  A secret consists of a secret value and its associated metadata and management
  information. This library handles secret values as strings, but Azure Key Vault
  doesn't store them as such. For more information about secrets and how Key
  Vault stores and manages them, see the
  [Key Vault documentation](https://docs.microsoft.com/azure/key-vault/general/about-keys-secrets-certificates).

  [SecretClient][secret_client_docs] can set secret values in the vault, update
  secret metadata, and delete secrets, as shown in the
  [examples](#examples) below.


  This section contains code snippets covering common tasks:
  * [Set a secret](#set-a-secret)
  * [Retrieve a secret](#retrieve-a-secret)
  * [Update secret metadata](#update-secret-metadata)
  * [Delete a secret](#delete-a-secret)
  * [List secrets](#list-secrets)
  * [Async API](#async-api)
  * [Asynchronously create a secret](#asynchronously-create-a-secret)
  * [Asynchronously list secrets](#asynchronously-list-secrets)


  [set_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.set_secret)
  creates new secrets and changes the values of existing secrets. If no secret with the
  given name exists, `set_secret` creates a new secret with that name and the
  given value. If the given name is in use, `set_secret` creates a new version
  of that secret, with the given value.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient

  credential = DefaultAzureCredential()

  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  secret = secret_client.set_secret("secret-name", "secret-value")

  print(secret.name)
  print(secret.value)
  print(secret.properties.version)
  ```


  [get_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.get_secret)
  retrieves a secret previously stored in the Key Vault.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient

  credential = DefaultAzureCredential()

  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  secret = secret_client.get_secret("secret-name")

  print(secret.name)
  print(secret.value)
  ```


  [update_secret_properties](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.update_secret_properties)
  updates a secret's metadata. It cannot change the secret's value; use [set_secret](#set-a-secret) to set a secret's
  value.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient

  credential = DefaultAzureCredential()

  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)


  content_type = "text/plain"



  updated_secret_properties = secret_client.update_secret_properties("secret-name", content_type=content_type, enabled=False)

  print(updated_secret_properties.updated_on)
  print(updated_secret_properties.content_type)
  print(updated_secret_properties.enabled)
  ```


  [begin_delete_secret](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.begin_delete_secret)
  requests Key Vault delete a secret, returning a poller which allows you to wait for the deletion to finish. Waiting is
  helpful when the vault has [soft-delete][soft_delete] enabled, and you want to purge (permanently delete) the secret as
  soon as possible. When [soft-delete][soft_delete] is disabled, `begin_delete_secret` itself is permanent.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient

  credential = DefaultAzureCredential()

  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  deleted_secret = secret_client.begin_delete_secret("secret-name").result()

  print(deleted_secret.name)
  print(deleted_secret.deleted_date)
  ```


  [list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient.list_properties_of_secrets)
  lists the properties of all of the secrets in the client's vault. This list doesn't include the secret's values.

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient

  credential = DefaultAzureCredential()

  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  secret_properties = secret_client.list_properties_of_secrets()

  for secret_property in secret_properties:
      
      print(secret_property.name)
  ```


  This library includes a complete set of async APIs. To use them, you must
  first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/).
  See
  [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport)
  for more information.

  Async clients and credentials should be closed when they're no longer needed. These
  objects are async context managers and define async `close` methods. For
  example:

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.secrets.aio import SecretClient

  credential = DefaultAzureCredential()


  client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  ...
  await client.close()
  await credential.close()


  client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  async with client:
    async with credential:
      ...
  ```


  [set_secret](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.set_secret)
  creates a secret in the Key Vault with the specified optional arguments.
  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.secrets.aio import SecretClient

  credential = DefaultAzureCredential()
  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  secret = await secret_client.set_secret("secret-name", "secret-value")

  print(secret.name)
  print(secret.value)
  print(secret.properties.version)
  ```


  [list_properties_of_secrets](https://aka.ms/azsdk/python/keyvault-secrets/aio/docs#azure.keyvault.secrets.aio.SecretClient.list_properties_of_secrets)
  lists the properties of all of the secrets in the client's vault.

  ```python
  from azure.identity.aio import DefaultAzureCredential
  from azure.keyvault.secrets.aio import SecretClient

  credential = DefaultAzureCredential()
  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)
  secret_properties = secret_client.list_properties_of_secrets()

  async for secret_property in secret_properties:
      
      print(secret_property.name)
  ```



  See the `azure-keyvault-secrets`
  [troubleshooting guide](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/TROUBLESHOOTING.md)
  for details on how to diagnose various failure scenarios.


  Key Vault clients raise exceptions defined in [azure-core][azure_core_exceptions].
  For example, if you try to get a key that doesn't exist in the vault,
  [SecretClient][secret_client_docs] raises
  [ResourceNotFoundError](https://aka.ms/azsdk-python-core-exceptions-resource-not-found-error):

  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient
  from azure.core.exceptions import ResourceNotFoundError

  credential = DefaultAzureCredential()
  secret_client = SecretClient(vault_url="https://my-key-vault.vault.azure.net/", credential=credential)

  try:
      secret_client.get_secret("which-does-not-exist")
  except ResourceNotFoundError as e:
      print(e.message)
  ```


  This library uses the standard
  [logging](https://docs.python.org/3.5/library/logging.html) library for logging.
  Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO
  level.

  Detailed DEBUG level logging, including request/response bodies and unredacted
  headers, can be enabled on a client with the `logging_enable` argument:
  ```python
  from azure.identity import DefaultAzureCredential
  from azure.keyvault.secrets import SecretClient
  import sys
  import logging


  logger = logging.getLogger('azure')
  logger.setLevel(logging.DEBUG)


  handler = logging.StreamHandler(stream=sys.stdout)
  logger.addHandler(handler)

  credential = DefaultAzureCredential()


  secret_client = SecretClient(
      vault_url="https://my-key-vault.vault.azure.net/",
      credential=credential,
      logging_enable=True
  )
  ```

  Similarly, `logging_enable` can enable detailed logging for a single operation,
  even when it isn't enabled for the client:
  ```python
  secret_client.get_secret("my-secret", logging_enable=True)
  ```


  Several samples are available in the Azure SDK for Python GitHub repository.
  These provide example code for additional Key Vault scenarios:

  - [Create/get/update/delete secrets][hello_world_sample] ([async version][hello_world_async_sample])
  - [Basic list operations for secrets][list_operations_sample] ([async version][list_operations_async_sample])
  - [Back up and restore secrets][backup_operations_sample] ([async version][backup_operations_async_sample])
  - [Recover and purge secrets][recover_purge_sample] ([async version][recover_purge_async_sample])


  For more extensive documentation on Azure Key Vault, see the
  [API reference documentation][reference_docs].


  This project welcomes contributions and suggestions. Most contributions require
  you to agree to a Contributor License Agreement (CLA) declaring that you have
  the right to, and actually do, grant us the rights to use your contribution.
  For details, visit https://cla.microsoft.com.

  When you submit a pull request, a CLA-bot will automatically determine whether
  you need to provide a CLA and decorate the PR appropriately (e.g., label,
  comment). Simply follow the instructions provided by the bot. You will only
  need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct][code_of_conduct].
  For more information, see the
  [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
  contact opencode@microsoft.com with any additional questions or comments.


  <!-- LINKS -->
  [azure_cloud_shell]: https://shell.azure.com/bash
  [azure_core_exceptions]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/core/azure-core#azure-core-library-exceptions
  [azure_identity]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity
  [azure_identity_pypi]: https://pypi.org/project/azure-identity/
  [azure_keyvault]: https://docs.microsoft.com/azure/key-vault/general/overview
  [azure_keyvault_cli]: https://docs.microsoft.com/azure/key-vault/general/quick-create-cli
  [azure_sub]: https://azure.microsoft.com/free/

  [backup_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations.py
  [backup_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/backup_restore_operations_async.py

  [code_of_conduct]: https://opensource.microsoft.com/codeofconduct/

  [default_cred_ref]: https://aka.ms/azsdk/python/identity/docs#azure.identity.DefaultAzureCredential

  [hello_world_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world.py
  [hello_world_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/hello_world_async.py

  [library_src]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets
  [list_operations_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations.py
  [list_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/list_operations_async.py

  [managed_identity]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview

  [pip]: https://pypi.org/project/pip/
  [pypi_package_secrets]: https://pypi.org/project/azure-keyvault-secrets/

  [recover_purge_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations.py
  [recover_purge_async_sample]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/keyvault/azure-keyvault-secrets/samples/recover_purge_operations_async.py
  [reference_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs

  [secret_client_docs]: https://aka.ms/azsdk/python/keyvault-secrets/docs#azure.keyvault.secrets.SecretClient
  [secret_samples]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples
  [soft_delete]: https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview

  ![Impressions](https://azure-sdk-impressions.azurewebsites.net/api/impressions/azure-sdk-for-python%2Fsdk%2Fkeyvault%2Fazure-keyvault-secrets%2FREADME.png)







  - Added support for service API version `7.5`


  - (From 4.8.0b1) Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))


  - Python 3.7 is no longer supported. Please use Python version 3.8 or later.
  - `asyncio` is no longer directly referenced by the library
    ([#33819](https://github.com/Azure/azure-sdk-for-python/pull/33819))
  - Updated minimum `azure-core` version to 1.29.5
  - Dropped `azure-common` requirement




  - Added support for service API version `7.5-preview.1`


  - Key Vault API version `7.5-preview.1` is now the default




  - Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
    ([#29888](https://github.com/Azure/azure-sdk-for-python/issues/29888))




  - Added support for service API version `7.4`
  - Clients each have a `send_request` method that can be used to send custom requests using the
    client's existing pipeline ([#25172](https://github.com/Azure/azure-sdk-for-python/issues/25172))


  - Python 3.6 is no longer supported. Please use Python version 3.7 or later.
  - Key Vault API version `7.4` is now the default
  - Updated minimum `azure-core` version to 1.24.0
  - Dropped `msrest` requirement
  - Added requirement for `isodate>=0.6.1` (`isodate` was required by `msrest`)
  - Added requirement for `typing-extensions>=4.0.1`




  - Clients verify the challenge resource matches the vault domain. This should affect few customers,
    who can provide `verify_challenge_resource=False` to client constructors to disable.
    See https://aka.ms/azsdk/blog/vault-uri for more information.




  - Documentation improvements
    ([#25039](https://github.com/Azure/azure-sdk-for-python/issues/25039))




  - Port numbers are now preserved in the `vault_url` property of a `KeyVaultSecretIdentifier`
    ([#24446](https://github.com/Azure/azure-sdk-for-python/issues/24446))




  - Key Vault API version 7.3 is now the default
  - Added support for multi-tenant authentication when using `azure-identity`
    1.8.0 or newer ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))
  - (From 4.4.0b3) Added `managed` property to SecretProperties


  - (From 4.4.0b3) Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - Updated minimum `azure-core` version to 1.20.0
  - (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698)). See
    https://aka.ms/azsdk/python/identity/tokencredential for more details on how to integrate
    this parameter if `get_token` is implemented by a custom credential.




  - Added `managed` property to SecretProperties


  - Python 2.7 is no longer supported. Please use Python version 3.6 or later.
  - (From 4.4.0b2) To support multi-tenant authentication, `get_token` calls during challenge
    authentication requests now pass in a `tenant_id` keyword argument
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))




  - Added support for multi-tenant authentication when using `azure-identity` 1.7.1 or newer
    ([#20698](https://github.com/Azure/azure-sdk-for-python/issues/20698))


  - Updated minimum `azure-core` version to 1.15.0




  - Key Vault API version 7.3-preview is now the default


  - Updated type hints to fix mypy errors
    ([#19158](https://github.com/Azure/azure-sdk-for-python/issues/19158))


  This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+.

  - Correct typing for async paging methods


  - Key Vault API version 7.2 is now the default
  - Updated minimum `msrest` version to 0.6.21


  - Added class `KeyVaultSecretIdentifier` that parses out a full ID returned by Key Vault,
    so users can easily access the secret's `name`, `vault_url`, and `version`.



  - Values of `x-ms-keyvault-region` and `x-ms-keyvault-service-version` headers
    are no longer redacted in logging output


  - Key Vault API version 7.1 is now the default
  - Updated minimum `azure-core` version to 1.7.0


  - At construction, clients accept a `CustomHookPolicy` through the optional
    keyword argument `custom_hook_policy`
  - All client requests include a unique ID in the header `x-ms-client-request-id`
  - Dependency on `azure-common` for multiapi support


  - Support for Key Vault API version 7.1-preview
  ([#10124](https://github.com/Azure/azure-sdk-for-python/pull/10124))
    - Added `recoverable_days` to `CertificateProperties`
    - Added `ApiVersion` enum identifying Key Vault versions supported by this package


  - `SecretClient` instances have a `close` method which closes opened sockets.
  Used as a context manager, a `SecretClient` closes opened sockets on exit.
  ([#9906](https://github.com/Azure/azure-sdk-for-python/pull/9906))
  - Pollers no longer sleep after operation completion
  ([#9991](https://github.com/Azure/azure-sdk-for-python/pull/9991))


  - `azure.keyvault.secrets` defines `__version__`
  - Challenge authentication policy preserves request options
  ([#8999](https://github.com/Azure/azure-sdk-for-python/pull/8999))
  - Updated `msrest` requirement to >=0.6.0
  - Challenge authentication policy requires TLS
  ([#9457](https://github.com/Azure/azure-sdk-for-python/pull/9457))
  - Methods no longer raise the internal error `KeyVaultErrorException`
  ([#9690](https://github.com/Azure/azure-sdk-for-python/issues/9690))



  - Moved optional parameters of two methods into kwargs (
  [docs](https://azuresdkdocs.blob.core.windows.net/$web/python/azure-keyvault-secrets/4.0.0/azure.keyvault.secrets.html)
  detail the new keyword arguments):
    - `set_secret` now has positional parameters `name` and `value`
    - `update_secret_properties` now has positional parameters `name` and
      (optional) `version`
  - Renamed `list_secrets` to `list_properties_of_secrets`
  - Renamed `list_secret_versions` to `list_properties_of_secret_versions`
  - Renamed sync method `delete_secret` to `begin_delete_secret`
  - The sync method `begin_delete_secret` and async `delete_secret` now return pollers that return a `DeletedSecret`
  - Renamed `Secret` to `KeyVaultSecret`
  - `KeyVaultSecret`  properties `created`, `expires`, and `updated` renamed to `created_on`,
  `expires_on`, and `updated_on`
  - The `vault_endpoint` parameter of `SecretClient` has been renamed to `vault_url`
  - The property `vault_endpoint` has been renamed to `vault_url` in all models




  - `Secret` now has attribute `properties`, which holds certain properties of the
  secret, such as `version`. This changes the shape of the returned `Secret` type,
  as certain properties of `Secret` (such as `version`) have to be accessed
  through the `properties` property.

  - `update_secret` has been renamed to `update_secret_properties`
  - The `vault_url` parameter of `SecretClient` has been renamed to `vault_endpoint`
  - The property `vault_url` has been renamed to `vault_endpoint` in all models


  - `list_secrets` and `list_secret_versions` return the correct type


  This release includes only internal changes.



  - Removed `azure.core.Configuration` from the public API in preparation for a
  revamped configuration API. Static `create_config` methods have been renamed
  `_create_config`, and will be removed in a future release.
  - This version of the library requires `azure-core` 1.0.0b2
    - If you later want to revert to a version requiring azure-core 1.0.0b1,
    of this or another Azure SDK library, you must explicitly install azure-core
    1.0.0b1 as well. For example:
    `pip install azure-core==1.0.0b1 azure-keyvault-secrets==4.0.0b1`


  - Distributed tracing framework OpenCensus is now supported
  - Added support for HTTP challenge based authentication, allowing clients to
  interact with vaults in sovereign clouds.


  Version 4.0.0b1 is the first preview of our efforts to create a user-friendly
  and Pythonic client library for Azure Key Vault. For more information about
  preview releases of other Azure SDK libraries, please visit
  https://aka.ms/azure-sdk-preview1-python.

  This library is not a direct replacement for `azure-keyvault`. Applications
  using that library would require code changes to use `azure-keyvault-secrets`.
  This package's
  [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md)
  and
  [samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/samples)
  demonstrate the new API.


  - Packages scoped by functionality
      - `azure-keyvault-secrets` contains a client for secret operations,
      `azure-keyvault-keys` contains a client for key operations
  - Client instances are scoped to vaults (an instance interacts with one vault
  only)
  - Asynchronous API supported on Python 3.5.3+
      - the `azure.keyvault.secrets.aio` namespace contains an async equivalent of
      the synchronous client in `azure.keyvault.secrets`
  - Authentication using `azure-identity` credentials
    - see this package's
    [documentation](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-secrets/README.md)
    , and the
    [Azure Identity documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/README.md)
    for more information


  - Certificate management APIs
  - National cloud support. This release supports public global cloud vaults,
      e.g. https://{vault-name}.vault.azure.net


pkgId: 6cd5b2cd79fe06d31e613f4646d5d34749673c8d327039c6c9fe083e8c41da09
name: python-azure-maps-geolocation
arch: src
version: 1.0.0b2
epoch: 0
release: 1
summary: Microsoft Azure Maps Geolocation Client Library for Python
url: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/maps/azure-maps-geolocation
rpm_license: MIT License
rpm_group: Unspecified
rpm_buildhost: localhost
location_href: Packages/python-azure-maps-geolocation-1.0.0b2-1.src.rpm
checksum_type: sha256
description:
  This package contains a Python SDK for Azure Maps Services for Geolocation.
  Read more about Azure Maps Services [here](https://docs.microsoft.com/azure/azure-maps/)

  [Source code](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/maps/azure-maps-geolocation) | [API reference documentation](https://docs.microsoft.com/rest/api/maps/geolocation) | [Product documentation](https://docs.microsoft.com/azure/azure-maps/)



  _Azure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer to <https://github.com/Azure/azure-sdk-for-python/issues/20691>_





  - Python 3.8 or later is required to use this package.
  - An [Azure subscription][azure_subscription] and an [Azure Maps account](https://docs.microsoft.com/azure/azure-maps/how-to-manage-account-keys).
  - A deployed Maps Services resource. You can create the resource via [Azure Portal][azure_portal] or [Azure CLI][azure_cli].

  If you use Azure CLI, replace `<resource-group-name>` and `<account-name>` of your choice, and select a proper [pricing tier](https://docs.microsoft.com/azure/azure-maps/choose-pricing-tier) based on your needs via the `<sku-name>` parameter. Please refer to [this page](https://docs.microsoft.com/cli/azure/maps/account?view=azure-cli-latest#az_maps_account_create) for more details.

  ```bash
  az maps account create --resource-group <resource-group-name> --account-name <account-name> --sku <sku-name>
  ```



  Install the Azure Maps Service Geolocation SDK.

  ```bash
  pip install azure-maps-geolocation
  ```



  To create a client object to access the Azure Maps Geolocation API, you will need a **credential** object. Azure Maps Geolocation client also support two ways to authenticate.



  You can authenticate with your Azure Maps Subscription Key.
  Once the Azure Maps Subscription Key is created, set the value of the key as environment variable: `AZURE_SUBSCRIPTION_KEY`.
  Then pass an `AZURE_SUBSCRIPTION_KEY` as the `credential` parameter into an instance of [AzureKeyCredential][azure-key-credential].

  ```python
  from azure.core.credentials import AzureKeyCredential
  from azure.maps.geolocation import MapsGeolocationClient

  credential = AzureKeyCredential(os.environ.get("AZURE_SUBSCRIPTION_KEY"))

  geolocation_client = MapsGeolocationClient(
      credential=credential,
  )
  ```



  You can authenticate with [Azure Active Directory (AAD) token credential][maps_authentication_aad] using the [Azure Identity library][azure_identity].
  Authentication by using AAD requires some initial setup:

  - Install [azure-identity][azure-key-credential]
  - Register a [new AAD application][register_aad_app]
  - Grant access to Azure Maps by assigning the suitable role to your service principal. Please refer to the [Manage authentication page][manage_aad_auth_page].

  After setup, you can choose which type of [credential][azure-key-credential] from `azure.identity` to use.
  As an example, [DefaultAzureCredential][default_azure_credential]
  can be used to authenticate the client:

  Next, set the values of the client ID, tenant ID, and client secret of the AAD application as environment variables:
  `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_SECRET`

  You will also need to specify the Azure Maps resource you intend to use by specifying the `clientId` in the client options. The Azure Maps resource client id can be found in the Authentication sections in the Azure Maps resource. Please refer to the [documentation][how_to_manage_authentication] on how to find it.

  ```python
  from azure.maps.geolocation import MapsGeolocationClient
  from azure.identity import DefaultAzureCredential

  credential = DefaultAzureCredential()
  geolocation_client = MapsGeolocationClient(
      client_id="<Azure Maps Client ID>",
      credential=credential
  )
  ```



  The Azure Maps Geolocation client library for Python allows you to interact with each of the components through the use of a dedicated client object.



  `MapsGeolocationClient` is the primary client for developers using the Azure Maps Geolocation client library for Python.
  Once you initialized a `MapsGeolocationClient` class, you can explore the methods on this client object to understand the different features of the Azure Maps Geolocation service that you can access.



  This library includes a complete async API supported on Python 3.8+. To use it, you must first install an async transport, such as [aiohttp](https://pypi.org/project/aiohttp/).
  See [azure-core documentation](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/CLIENT_LIBRARY_DEVELOPER.md#transport) for more information.

  Async clients and credentials should be closed when they're no longer needed. These
  objects are async context managers and define async `close` methods.



  The following sections provide several code snippets covering some of the most common Azure Maps Geolocation tasks, including:

  - [Get Geolocation](#get-geolocation)



  This service will return the ISO country code for the provided IP address. Developers can use this information to block or alter certain content based on geographical locations where the application is being viewed from.

  ```python
  from azure.maps.geolocation import MapsGeolocationClient

  BLOCK_COUNTRY_LIST = ['US', 'TW', 'AF', 'AX', 'DL']
  INCOME_IP_ADDRESS = "2001:4898:80e8:b::189"
  geolocation_result = client.get_country_code(ip_address=INCOME_IP_ADDRESS)

  result_country_code = geolocation_result.iso_code

  if result_country_code in BLOCK_COUNTRY_LIST:
      raise Exception("These IP address is from forebiden country")
  ```





  Maps Geolocation clients raise exceptions defined in [Azure Core](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/core/azure-core/README.md).

  This list can be used for reference to catch thrown exceptions. To get the specific error code of the exception, use the `error_code` attribute, i.e, `exception.error_code`.



  This library uses the standard [logging](https://docs.python.org/3/library/logging.html) library for logging.
  Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO level.

  Detailed DEBUG level logging, including request/response bodies and unredacted headers, can be enabled on a client with the `logging_enable` argument:

  ```python
  import sys
  import logging
  from azure.maps.geolocation import MapsGeolocationClient


  logger = logging.getLogger('azure.maps.geolocation')
  logger.setLevel(logging.DEBUG)


  handler = logging.StreamHandler(stream=sys.stdout)
  logger.addHandler(handler)

  ```



  Still running into issues? If you encounter any bugs or have suggestions, please file an issue in the [Issues](<https://github.com/Azure/azure-sdk-for-python/issues>) section of the project.





  Get started with our [Maps Geolocation samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/maps/azure-maps-geolocation/samples) ([Async Version samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/maps/azure-maps-geolocation/samples/async_samples)).

  Several Azure Maps Geolocation Python SDK samples are available to you in the SDK's GitHub repository. These samples provide example code for additional scenarios commonly encountered while working with Maps Geolocation

  ```bash
  set AZURE_SUBSCRIPTION_KEY="<RealSubscriptionKey>"

  pip install azure-maps-geolocation --pre

  python samples/sample_authentication.py
  python sample/sample_get_country_code.py
  ```

  > Notes: `--pre` flag can be optionally added, it is to include pre-release and development versions for `pip install`. By default, `pip` only finds stable versions.

  Further detail please refer to [Samples Introduction](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/maps/azure-maps-geolocation/samples/README.md)



  For more extensive documentation on Azure Maps Geolocation, see the [Azure Maps Geolocation documentation](https://docs.microsoft.com/rest/api/maps/geolocation) on docs.microsoft.com.



  This project welcomes contributions and suggestions.  Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit <https://cla.microsoft.com>.

  When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

  This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

  <!-- LINKS -->
  [azure_subscription]: https://azure.microsoft.com/free/
  [azure_identity]: https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/identity/azure-identity
  [azure_portal]: https://portal.azure.com
  [azure_cli]: https://docs.microsoft.com/cli/azure
  [azure-key-credential]: https://aka.ms/azsdk/python/core/azurekeycredential
  [default_azure_credential]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity#defaultazurecredential
  [register_aad_app]: https://docs.microsoft.com/powershell/module/Az.Resources/New-AzADApplication?view=azps-8.0.0
  [maps_authentication_aad]: https://docs.microsoft.com/azure/azure-maps/how-to-manage-authentication
  [create_new_application_registration]: https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/AspNetWebAppQuickstartPage/sourceType/docs
  [manage_aad_auth_page]: https://docs.microsoft.com/azure/azure-maps/how-to-manage-authentication
  [how_to_manage_authentication]: https://docs.microsoft.com/azure/azure-maps/how-to-manage-authentication#view-authentication-details








  - Remove python 3.6 support
  - Fix API version error
  - Fix Sphinx errors
  - Fix mypy typing errors for mypy version 1.6.1





  - Initial release


