[BUG] TokenCredential of AddBlobServiceClient(...) is always DefaultAzureCredential

[lschoenawa]

Library name and version

Microsoft.Extensions.Azure 1.11.0

Describe the bug

Within the BlobClientBuilderExtensions the method

public static IAzureClientBuilder<BlobServiceClient, BlobClientOptions> AddBlobServiceClient<TBuilder>(this TBuilder builder, Uri serviceUri, TokenCredential tokenCredential)
    where TBuilder : IAzureClientFactoryBuilderWithCredential
{
    return builder.RegisterClientFactory<BlobServiceClient, BlobClientOptions>((options, token) => new BlobServiceClient(serviceUri, token, options));
}

is not passing down the provided TokenCredential.

Expected behavior

The provided TokenCredential will be used, maybe like this:

public static IAzureClientBuilder<BlobServiceClient, BlobClientOptions> AddBlobServiceClient<TBuilder>(this TBuilder builder, Uri serviceUri, TokenCredential tokenCredential)
    where TBuilder : IAzureClientFactoryBuilderWithCredential
{
    return builder.RegisterClientFactory<BlobServiceClient, BlobClientOptions>((options, _) => new BlobServiceClient(serviceUri, tokenCredential, options));
}

Actual behavior

The DefaultAzureCredential is always being used, which leads to unnecessary token requests, that mostly cannot be resolved and even throw exceptions when some configuration is missing.

Reproduction Steps

Add the service to the IServiceCollection like this:

services.AddAzureClients(
    config =>
    {
        config.AddBlobServiceClient(
            new Uri("<url to the storage account>"),
            new AzureCliCredential());
    });

Environment

No response

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @amnguye @jalauzon-msft @jaschrep-msft @nickliu-msft @seanmcc-msft.

[github-actions]

Hi @lschoenawa, I'm an AI Support assistant here to help with your issue. While the Azure SDK team reviews your request, I wanted to provide some possible tips and documentation that might help you in the meantime.

• The issue appears to be that the client registration isn’t using the provided TokenCredential; instead, it creates a new BlobServiceClient with a token supplied by the default credential chain.
• In your expected behavior, the tokenCredential argument is passed directly to BlobServiceClient (e.g., using (options, _) => new BlobServiceClient(serviceUri, tokenCredential, options)), which avoids unnecessary token requests and potential configuration issues.
• To help diagnose similar authentication problems (for example, when an unexpected credential in the chain is used), consider enabling logging as described in Azure Identity troubleshooting. This can help determine which credential is being used:
  • Azure Identity Troubleshooting
• Ensure that the client factory registration in AddBlobServiceClient follows the expected pattern so that the provided TokenCredential isn’t inadvertently replaced by the default credential retrieval logic.

References:

• Azure Identity Troubleshooting Guide
• Expected client configuration snippet

The Azure SDK team will respond to your issue shortly. I hope these suggestions are helpful in the meantime. If this comment helped you, please give it a 👍. If the suggestion was not helpful or incorrect, please give it a 👎. Your feedback helps us improve!

[jsquire]

Hi @lschoenawa. Thank you for reaching out and we regret that you're experiencing difficulties. There is intentionally no overload that accepts a credential, as there are extensions available which allow you to set either a new global credential used by all Azure clients or a local credential used just for a specific registration. These are discussed in Dependency injection with the Azure SDK for .NET and use would look something like:

Register a token to be used as the default for all Azure clients

builder.Services.AddAzureClients(clientBuilder =>
{
    clientBuilder.AddBlobServiceClient(new Uri("<storage_url>"));

    // Set a credential for all clients to use by default
    clientBuilder.UseCredential(new ManagedIdentityCredential());
}

Register a token to be used as the default for a specific Azure client registration

builder.Services.AddAzureClients(clientBuilder =>
{
    clientBuilder
        .AddBlobServiceClient(new Uri("<storage_url>"))
        .WithCredential(new ManagedIdentityCredential());
}

[github-actions]

Hi @lschoenawa. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[lschoenawa]

Hi @jsquire
Thank you for showing me, how it should be done right. I will go with the proposed solution.

But: in fact, there is this overload, which I was using (see description), that accepts a credential. The credential is just not being used within the method. You might want to remove the unused parameter to avoid any confusions.

[jsquire]

Thanks for the heads-up, @lschoenawa. That's a known issue tracked here: #49564