Skip to content

Consul Docs: Azure auto-join MSI clarification #1346

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Consul Docs: Azure auto-join MSI clarification #1346

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4ec79c5
Add note about MSI and client IDs
nphilbrook Nov 19, 2025
42bc6be
Merge branch 'main' into nphilbrook_azure_auto_join
nphilbrook Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions content/consul/v1.22.x/content/docs/deploy/server/cloud-auto-join.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,6 +191,14 @@ Variables can also be provided by environmental variables:
- `ARM_CLIENT_ID` for client
- `ARM_CLIENT_SECRET` for secret access key

<Note>

If any of the tentant, client, or client_secret arguments are omitted, then Consul will fall back to Managed Service Identities (see below) and
any client_id that _was_ specified will be ignored for the purposes of MSI. To pass a specific client_id to MSI (for example,
to use a User-Managed identity on a VM that also has a System-Managed identity, you must use the environment variable `AZURE_CLIENT_ID` (reference the [Azure autorest package documentation](https://github.com/Azure/go-autorest/blob/autorest/v0.11.29/autorest/azure/auth/auth.go#L43)

</Note>
Comment on lines +194 to +200
Copy link
Contributor

@boruszak boruszak Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<Note>
If any of the tentant, client, or client_secret arguments are omitted, then Consul will fall back to Managed Service Identities (see below) and
any client_id that _was_ specified will be ignored for the purposes of MSI. To pass a specific client_id to MSI (for example,
to use a User-Managed identity on a VM that also has a System-Managed identity, you must use the environment variable `AZURE_CLIENT_ID` (reference the [Azure autorest package documentation](https://github.com/Azure/go-autorest/blob/autorest/v0.11.29/autorest/azure/auth/auth.go#L43)
</Note>
If you omit any of the `TENANT`, `CLIENT`, or `CLIENT_SECRET` arguments, then Consul defaults to Managed Service Identities instead. Any client identification that was specified is ignored for the purposes of MSI. To pass client identity to MSI, you must use the `AZURE_CLIENT_ID` environment variable. For more information, refer to the [Azure autorest package documentation](https://github.com/Azure/go-autorest/blob/autorest/v0.11.29/autorest/azure/auth/auth.go#L43).

Style guide alignments and sentence simplification.


Use these configuration parameters when using tags:

- `tag_name` - the name of the tag to auto-join on.
Expand Down
Loading