Skip to content

Document Azure:CredentialProcessTimeoutSeconds option #737

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eerhardt wants to merge 1 commit into from
+19 −0
Closed

Document Azure:CredentialProcessTimeoutSeconds option #737

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/frontend/src/content/docs/deployment/azure/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ After authentication succeeds, `aspire deploy` still needs a small set of shared
| `Azure:SubscriptionId` | `Azure__SubscriptionId` | Target Azure subscription |
| `Azure:Location` | `Azure__Location` | Default Azure region for provisioned resources |
| `Azure:ResourceGroup` | `Azure__ResourceGroup` | Resource group to create or reuse |
| `Azure:CredentialProcessTimeoutSeconds` | `Azure__CredentialProcessTimeoutSeconds` | Override the credential subprocess timeout (5–600 seconds) when `az login` validation is slow |
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The setting description ties this timeout specifically to az login validation, but this table is meant to cover shared settings after authentication and the page also describes non-Azure-CLI auth flows (GitHub Actions OIDC, Azure DevOps service connections). Consider rephrasing the purpose to be credential-source-agnostic (e.g., “credential subprocess operations” / “Azure CLI or other process-based credentials”) so it doesn’t read as Azure CLI-specific in contexts where az login isn’t used.

Suggested change
| `Azure:CredentialProcessTimeoutSeconds` | `Azure__CredentialProcessTimeoutSeconds` | Override the credential subprocess timeout (5–600 seconds) when `az login` validation is slow |
| `Azure:CredentialProcessTimeoutSeconds` | `Azure__CredentialProcessTimeoutSeconds` | Override the credential subprocess timeout (5–600 seconds) when Azure CLI or other process-based credentials are slow |

Copilot uses AI. Check for mistakes.

### Local settings

Expand All @@ -79,6 +80,7 @@ After your CI/CD system authenticates to Azure, provide the shared Azure setting
| Azure subscription | `Azure__SubscriptionId` | Select the target Azure subscription |
| Azure location | `Azure__Location` | Set the default region for provisioned resources |
| Azure resource group | `Azure__ResourceGroup` | Select the resource group to create or reuse |
| Credential process timeout | `Azure__CredentialProcessTimeoutSeconds` | Override the credential subprocess timeout (5–600 seconds) when `az login` validation is slow on the build agent |
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same issue as above: in the CI/CD settings table, the purpose text mentions az login being slow on the build agent, but CI auth is often via OIDC/service connection (no az login). Suggest rewording to describe slow credential subprocess validation more generally, or to explicitly scope this input to scenarios where the pipeline is using Azure CLI/PowerShell/AZD-based credentials.

Suggested change
| Credential process timeout | `Azure__CredentialProcessTimeoutSeconds` | Override the credential subprocess timeout (5–600 seconds) when `az login` validation is slow on the build agent |
| Credential process timeout | `Azure__CredentialProcessTimeoutSeconds` | Override the credential subprocess timeout (5–600 seconds) when Azure CLI, PowerShell, or AZD credential validation is slow on the build agent |

Copilot uses AI. Check for mistakes.
| AppHost parameters | `Parameters__*` environment variables | Supply any required AppHost inputs |
| Aspire environment | `aspire deploy --environment <name>` | Select the Aspire environment, such as `Production`, for environment-scoped parameter resolution |

Expand Down
17 changes: 17 additions & 0 deletions src/frontend/src/content/docs/integrations/cloud/azure/local-provisioning.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,7 @@ The following configuration options are available:
| `Azure:ResourceGroupPrefix` | Prefix used when Aspire generates a resource group name | `rg-aspire` |
| `Azure:CredentialSource` | Authentication method for local provisioning | `Default` |
| `Azure:AllowResourceGroupCreation` | Allow creating resource groups | `true` |
| `Azure:CredentialProcessTimeoutSeconds` | Timeout in seconds for credential subprocess operations (must be between 5 and 600) | Azure SDK default |

## Resource group management

Expand Down Expand Up @@ -192,6 +193,22 @@ If you want to force a specific local credential, set `Azure:CredentialSource` t
| `AzurePowerShell` | Azure PowerShell sign-in |
| `InteractiveBrowser` | Browser-based sign-in prompt |

### Credential process timeout

Most local credential sources (Azure CLI, Azure PowerShell, Visual Studio, Azure Developer CLI, and the development `Default` chain) acquire tokens by invoking a subprocess. On machines where these tools are slow to respond — for example, due to antivirus scanning or network latency — credential validation can time out before authentication completes.

Use `Azure:CredentialProcessTimeoutSeconds` to override the credential subprocess timeout. The value must be between **5** and **600** seconds. When unset, the Azure SDK's default timeout is used.

```json title="appsettings.Development.json"
{
"Azure": {
"CredentialProcessTimeoutSeconds": 120
}
}
```

This setting applies to the `AzureCli`, `AzurePowerShell`, `VisualStudio`, and `AzureDeveloperCli` credential sources, and to the development credential chain used when `CredentialSource` isn't explicitly set. It has no effect on `InteractiveBrowser`, which doesn't shell out to a subprocess.
Comment on lines +198 to +210
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new section lists which CredentialSource values this setting applies to, but it omits VisualStudioCode even though it’s listed as a supported Azure:CredentialSource value just above. This makes it unclear whether Azure:CredentialProcessTimeoutSeconds affects VS Code auth; please either include VisualStudioCode in the applicability list or explicitly call out that it’s not affected (and adjust the earlier “Most local credential sources … invoke a subprocess” wording accordingly).

Copilot uses AI. Check for mistakes.

## Provisioned resource naming

Aspire generates unique resource names following Azure naming conventions:
Expand Down
Loading