How can I override/modify "Active Directory Default" credential behavior?

[Astrophizz]

This is in Q&A though I mistakenly got the answer from the Azure/azure-sdk-for-net repository.

There's an issue in Azure.Core 1.60.0+ where the DefaultAzureCredential fails to attempt to authenticate beyond ManagedIdentityCredential. The direct workaround is to (in the appropriate context) set ExcludeManagedIdentityCredential = true in DefaultAzureCredentialOptions. I didn't know how to apply that to Microsoft.Data.SqlClient.Extensions.Azure though.

The Microsoft.Data.SqlClient.Extensions.Azure-specific workaround/answer is that there is an AccessTokenCallback property in SqlConnection that I can have return a token generated from a DefaultAzureCredential with ExcludeManagedIdentityCredential = true and TokenRequestContext(["https://database.windows.net/.default"].

See also: Connect to Azure SQL with Microsoft Entra authentication and SqlClient: Using AccessTokenCallback