SYMPTOM
DefaultAzureCredential failed to retrieve a token from the included credentials
CAUSE
None of the credentials in the chain could produce a token. Locally this means no az login, no usable env vars, and no VS/VS Code auth; on Azure it means no managed identity is assigned or the IMDS endpoint is blocked.
CONFIRM IT
CONFIRM: run with debug logging (AZURE_LOG_LEVEL=debug in Python). The log lists each credential tried and why it was skipped: EnvironmentCredential missing vars, ManagedIdentityCredential endpoint not found, AzureCliCredential 'not logged in'. Locally, run `az account get-access-token` - if that fails, no dev-tool step in the chain can work either.
FIX
FIX: local dev: `az login` (or set AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_CLIENT_SECRET for a service principal). On Azure: assign a managed identity to the host (VM/App Service/Functions identity blade) and grant it the data-plane role the code needs. If IMDS is blocked by firewall/proxy, allow the instance metadata endpoint.
VERIFY
VERIFY: re-run with debug logging and confirm one credential step reports success; then run the actual SDK call and confirm data returns instead of the credential error.