Contradicting information in Azure docs (DefaultAzureCredential)

Question

On this page, the order is as follows:

However, on this page, the order between AzureCli and AzurePowerShell is different.

Which one comes first?

Answer 1

Hello Omar Saleh,

Thank you for reaching out to MS Q&A. I am here to assist you in resolving your issues.

The order of credential evaluation in DefaultAzureCredential varies depending on the version of the Azure Identity library.

• In the first image, AzurePowerShellCredential appears before AzureCliCredential.

• In the second image, AzureCliCredential comes before AzurePowerShellCredential.

The correct order depends on the version of the Azure.Identity library you are using:

Before version 1.10.0, the order was: EnvironmentCredential → ManagedIdentityCredential → SharedTokenCacheCredential → VisualStudioCredential → AzurePowerShellCredential → AzureCliCredential → InteractiveBrowserCredential.

From version 1.10.0 and later, the order was updated. As of v1.14.0 (seen in the second screenshot), the order is:

EnvironmentCredential

WorkloadIdentityCredential

ManagedIdentityCredential

SharedTokenCacheCredential

VisualStudioCredential

AzureCliCredential

AzurePowerShellCredential

AzureDeveloperCliCredential

InteractiveBrowserCredential.

In Azure.Identity v1.14.0, the correct order is: AzureCliCredential first, followed by AzurePowerShellCredential.

You can verify your exact version by checking your project’s csproj or package.json file, or by running: dotnet list package | findstr Azure.Identity tr Azure.Identitytr Azure.IdentityIf the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Siri

Answer 2

Hi @Omar Saleh,

Thank you for contacting Q&A Forum. I would like to provide my findings and proposed solution:
Here’s a quick summary of the DefaultAzureCredential lookup order and where to find the official flow diagrams for each SDK version:

Credential types and lookup order – As described in your first reference, Azure will attempt multiple credential sources in a fixed sequence until one succeeds (environment variables, managed identity, Visual Studio, CLI, etc.).

Confirmed flow order – The second document you provided shows the exact sequence Azure.Identity follows.

Version-specific diagrams – For Azure.Identity 1.9.0: https://www.nuget.org/packages/Azure.Identity/1.9.0 – For Azure.Identity 1.14.0: https://www.nuget.org/packages/Azure.Identity/1.14.0

Each package page includes a detailed “DefaultAzureCredential Authentication Flow” graphic. Please review the one that matches your library version. If you need any further clarification, just let us know!

Kindly let me know if this work for you and please let me know if you have any further questions.

If I have answered your question, please accept this answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,
Eric