Diagnose: DefaultAzureCredential failed to retrieve a token from the included credentials

TL;DR: Symptom: DefaultAzureCredential failed to retrieve a token from the included credentials Cause: None of the credentials in the chain could produce a token. Locally this means no az login, no usable env vars, and no VS/VS Code auth; on Azure it means no managed identity is assigned or the IMDS en CONFIRM IT CONFIRM: run with debug logging (AZURELOGLEVEL=debug in Python). FIX FIX: local dev: az login (or set AZURECLIENTID / AZURETENANTID / AZURECLIENTSECRET for a service principal).

The fix

SYMPTOM DefaultAzureCredential failed to retrieve a token from the included credentials

CAUSE None of the credentials in the chain could produce a token. Locally this means no az login, no usable env vars, and no VS/VS Code auth; on Azure it means no managed identity is assigned or the IMDS endpoint is blocked.

CONFIRM IT CONFIRM: run with debug logging (AZURELOGLEVEL=debug in Python). The log lists each credential tried and why it was skipped: EnvironmentCredential missing vars, ManagedIdentityCredential endpoint not found, AzureCliCredential 'not logged in'. Locally, run az account get-access-token - if that fails, no dev-tool step in the chain can work either.

FIX FIX: local dev: az login (or set AZURECLIENTID / AZURETENANTID / AZURECLIENTSECRET for a service principal). On Azure: assign a managed identity to the host (VM/App Service/Functions identity blade) and grant it the data-plane role the code needs. If IMDS is blocked by firewall/proxy, allow the instance metadata endpoint.

VERIFY VERIFY: re-run with debug logging and confirm one credential step reports success; then run the actual SDK call and confirm data returns instead of the credential error.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Diagnose.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/azure/developer/python/sdk/authentication/credential-chains?tabs=dac