refactor: update credential retrieval logic based on environment

[KanchanN-Microsoft]

Purpose

This pull request updates the Azure credential selection logic to improve environment-specific authentication and fixes the usage of the get_async_azure_credential function in token provider setup. The most important changes are:

Azure Credential Selection Logic:

• Updated get_async_azure_credential in azure_credential_utils.py to select credentials based on the APP_ENV environment variable: uses AsyncDefaultAzureCredential for development (dev), and AsyncManagedIdentityCredential with a client ID for production and other environments. Added logging and print statements to clarify which credential is being used.

Token Provider Setup:

• Changed both get_async_bearer_token_provider in azure_credential_utils.py and credential_util.py to call get_async_azure_credential() synchronously (removed await), aligning with the updated credential function's implementation. [1] [2]

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
libs/utils
azure_credential_utils.py	105	6	94%	196–198, 202–203, 206
TOTAL	1225	167	86%

Tests	Skipped	Failures	Errors	Time
244	0 💤	0 ❌	0 🔥	3.220s ⏱️

[Copilot]

Pull request overview

This PR refactors Azure authentication helpers to adjust how async credentials are selected and to align bearer token provider setup with the (synchronous) get_async_azure_credential() implementation.

Changes:

• Updated async bearer token provider setup to call get_async_azure_credential() without await.
• Modified get_async_azure_credential() (async path) to select a fallback credential based on APP_ENV (dev vs non-dev), with additional logging/console output.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/ContentProcessor/src/libs/utils/credential_util.py	Removes await when retrieving the async credential for the async token provider.
src/ContentProcessor/src/libs/utils/azure_credential_utils.py	Removes await in async token provider and adds APP_ENV-based fallback credential selection in async credential helper.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/ContentProcessor/src/libs/utils/azure_credential_utils.py:198

• The APP_ENV gating here only treats exactly "prod" as production; any other value (e.g., "staging", "qa") falls back to AsyncDefaultAzureCredential, which contradicts the PR description (managed identity for production and other non-dev environments) and makes the CodeQL note inaccurate (DefaultAzureCredential would be used outside development). Consider inverting the condition: use DefaultAzureCredential only when APP_ENV=dev; otherwise use Managed Identity.

    # All async CLI credentials failed. Select the final credential based on the
    # environment: production uses Managed Identity, while development uses
    # DefaultAzureCredential. Defaults to production when APP_ENV is not set.
    app_env = os.getenv("APP_ENV", "prod").lower()
    if app_env == "prod":

src/ContentProcessor/src/libs/utils/azure_credential_utils.py:199

• The new APP_ENV-based fallback behavior introduces a distinct path where managed identity is selected even when no Azure environment indicators are present (e.g., APP_ENV=prod/qa/staging and CLI creds fail). There isn't a corresponding unit test covering this branch, so regressions here may go unnoticed.

    app_env = os.getenv("APP_ENV", "prod").lower()
    if app_env == "prod":
        client_id = os.getenv("AZURE_CLIENT_ID")

infra/main.bicep:564

• Adding the resource group tag SecurityControl: 'Ignore' can be interpreted by governance/policy tooling as an explicit opt-out and may weaken compliance posture. If this tag is not required by an approved policy exception workflow, it should be removed.

      DeploymentName: deployment().name
      SecurityControl: 'Ignore'
    }

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/ContentProcessor/src/libs/utils/azure_credential_utils.py:198

• APP_ENV defaults to "prod" here and, when no Azure environment indicators are present, the function will still return AsyncManagedIdentityCredential(). In non-Azure runtimes (e.g., local dev without APP_ENV set) this can cause long timeouts while probing IMDS/managed identity endpoints. Since you already gate managed identity on azure_env_indicators above, consider failing fast for APP_ENV=prod when no Azure MI indicators are detected, and only using AsyncDefaultAzureCredential for non-prod/local.

Also, the trailing comment says DefaultAzureCredential is "only used in development", but this branch triggers for any non-"prod" value (staging/test/etc.), so the comment is inaccurate.

    app_env = os.getenv("APP_ENV", "prod").lower()
    if app_env == "prod":
        client_id = os.getenv("AZURE_CLIENT_ID")
        if client_id:
            logging.info(

src/tests/ContentProcessor/utils/test_azure_credential_utils_extended.py:113

• This test clears Azure environment indicators before asserting the CLI->Default fallback, but it doesn't clear CONTAINER_REGISTRY_LOGIN, which is also treated as an Azure-hosted indicator in get_async_azure_credential(). If the CI environment happens to set this variable, the function will return managed identity and this test will become flaky.

        for key in ["WEBSITE_SITE_NAME", "AZURE_CLIENT_ID", "MSI_ENDPOINT",
                    "IDENTITY_ENDPOINT", "KUBERNETES_SERVICE_HOST"]:
            monkeypatch.delenv(key, raising=False)
        monkeypatch.setenv("APP_ENV", "dev")

src/ContentProcessor/src/libs/utils/credential_util.py:50

• azure_credential_utils.get_async_azure_credential() now contains APP_ENV-based selection logic, but credential_util.get_async_azure_credential() still uses the older behavior. Since both modules expose get_async_bearer_token_provider(), this creates inconsistent auth behavior depending on which helper a caller uses.

To avoid drift, consider delegating to libs.utils.azure_credential_utils.get_async_azure_credential() from this function (or otherwise consolidating these two nearly-identical modules).

    Returns:
        A callable suitable for SDK clients that accept a token provider.
    """
    credential = get_async_azure_credential()
    return identity_get_async_bearer_token_provider(
        credential, "https://cognitiveservices.azure.com/.default"

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/ContentProcessor/src/libs/utils/azure_credential_utils.py:198

• APP_ENV branching only treats exactly prod as managed identity; any other non-dev environment (e.g., staging, test) will fall back to AsyncDefaultAzureCredential, which contradicts the PR description (“production and other environments”) and also makes the CodeQL comment (“only used in development”) inaccurate. Consider making dev the only case that uses AsyncDefaultAzureCredential and using managed identity for all other APP_ENV values (consistent with ContentProcessorAPI/app/utils/azure_credential_utils.py).

    app_env = os.getenv("APP_ENV", "prod").lower()
    if app_env == "prod":
        client_id = os.getenv("AZURE_CLIENT_ID")
        if client_id:
            logging.info(