Operations
| Operation | Description |
|---|---|
Azure.EnsureAuthenticated | Authenticate to Azure using the best available method. Uses service principal credentials when provided (explicit arguments or AZURE_CLIENT_ID/SECRET/TENANT_ID), otherwise falls back to an existing CLI session or interactive login. Pass requireServicePrincipal: true (or set ANDO_REQUIRE_SERVICE_PRINCIPAL) to force service principal auth and fail instead of ever using a developer's az login session. Default behavior is unchanged (fallback allowed). When service principal credentials are used, the login runs against an isolated, per-build AZURE_CONFIG_DIR so the user's ~/.azure profile is never read or modified. |
Azure.EnsureLoggedIn | Verify the user is logged in to Azure CLI. Fails if not authenticated. |
Azure.ShowAccount | Display current Azure account information. |
Azure.LoginWithServicePrincipal | Login with a Service Principal (for CI/CD). Runs against an isolated, per-build AZURE_CONFIG_DIR in the system temp directory, so the user's ~/.azure profile is never read or modified; the isolated profile is deleted when the build process exits. |
Azure.LoginWithManagedIdentity | Login with Managed Identity (for Azure-hosted environments). Runs against an isolated, per-build AZURE_CONFIG_DIR in the system temp directory, so the user's ~/.azure profile is never read or modified; the isolated profile is deleted when the build process exits. |
Azure.SetSubscription | Set the active Azure subscription. |
Azure.CreateResourceGroup | Create a resource group if it doesn't exist. |
Operation Details
Azure.EnsureAuthenticated
source
Authenticate to Azure using the best available method. Uses service principal credentials when provided (explicit arguments or AZURE_CLIENT_ID/SECRET/TENANT_ID), otherwise falls back to an existing CLI session or interactive login. Pass requireServicePrincipal: true (or set ANDO_REQUIRE_SERVICE_PRINCIPAL) to force service principal auth and fail instead of ever using a developer's az login session. Default behavior is unchanged (fallback allowed). When service principal credentials are used, the login runs against an isolated, per-build AZURE_CONFIG_DIR so the user's ~/.azure profile is never read or modified.
Azure.EnsureAuthenticated(); // Auto-detects: SP env vars, else CLI session/interactive
Azure.EnsureAuthenticated(clientId, secret, tenantId); // explicit SP, no env reliance
Azure.EnsureAuthenticated(clientId, secret, tenantId, requireServicePrincipal: true); // never fall back to az loginAzure.EnsureLoggedIn
source
Verify the user is logged in to Azure CLI. Fails if not authenticated.
Azure.EnsureLoggedIn();Azure.ShowAccount
source
Display current Azure account information.
Azure.ShowAccount();Azure.LoginWithServicePrincipal
source
Login with a Service Principal (for CI/CD). Runs against an isolated, per-build AZURE_CONFIG_DIR in the system temp directory, so the user's ~/.azure profile is never read or modified; the isolated profile is deleted when the build process exits.
Azure.LoginWithServicePrincipal(clientId, secret, tenantId);
Azure.LoginWithServicePrincipal(); // Uses AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID env varsAzure.LoginWithManagedIdentity
source
Login with Managed Identity (for Azure-hosted environments). Runs against an isolated, per-build AZURE_CONFIG_DIR in the system temp directory, so the user's ~/.azure profile is never read or modified; the isolated profile is deleted when the build process exits.
Azure.LoginWithManagedIdentity(); // System-assigned
Azure.LoginWithManagedIdentity("client-id"); // User-assignedAzure.SetSubscription
source
Set the active Azure subscription.
Azure.SetSubscription("subscription-id");
Azure.SetSubscription(); // Uses AZURE_SUBSCRIPTION_ID env varAzure.CreateResourceGroup
source
Create a resource group if it doesn't exist.
Azure.CreateResourceGroup("my-rg", "eastus");
Azure.CreateResourceGroup("prod-rg", "westeurope");Authentication
Azure operations require authentication via the Azure CLI. Choose the method that fits your environment.
Environment Variables (Service Principal)
| Variable | Description |
|---|---|
AZURE_CLIENT_ID | Service principal application ID |
AZURE_CLIENT_SECRET | Service principal secret |
AZURE_TENANT_ID | Azure AD tenant ID |
AZURE_SUBSCRIPTION_ID | Target subscription ID |
ANDO_REQUIRE_SERVICE_PRINCIPAL | When truthy (1, true, yes, on), forces service principal auth and fails instead of falling back to an existing CLI session or interactive login |
Requiring Service Principal Authentication
By default, Azure.EnsureAuthenticated() uses service principal credentials when available and otherwise falls back to an existing az login session or interactive login. In CI/CD you often want to guarantee the build runs as the intended service principal and never as a developer’s personal session.
Pass requireServicePrincipal: true (or set the ANDO_REQUIRE_SERVICE_PRINCIPAL environment variable) to fail fast when no service principal credentials are present. You can also pass credentials explicitly instead of relying on environment variables:
// Force SP auth, reading credentials from env vars
Azure.EnsureAuthenticated(requireServicePrincipal: true);
// Force SP auth with explicit credentials (no env reliance)
Azure.EnsureAuthenticated(clientId, clientSecret, tenantId, requireServicePrincipal: true);Isolated CLI Profile
Service principal and managed identity logins always run against an isolated, per-build AZURE_CONFIG_DIR created in the system temp directory. The user’s ~/.azure profile is never read or modified: an ANDO build cannot overwrite a developer’s personal az login session, and az steps in the build cannot silently fall back to it. The isolated profile (which holds the service principal’s access tokens) is deleted when the build process exits.
Example
Authenticate and create a resource group.
// For CI/CD: login with service principal
Azure.LoginWithServicePrincipal();
Azure.SetSubscription();
// For local dev: ensure already logged in
Azure.EnsureLoggedIn();
// Create resource group
Azure.CreateResourceGroup("my-app-rg", "eastus");