Authenticate .NET apps to Azure services during local development using developer accounts

When creating cloud applications, developers need to debug and test applications on their local workstation. When an application is run on a developer's workstation during local development, it still must authenticate to any Azure services used by the app. This article covers how to use a developer's Azure credentials to authenticate the app to Azure during local development.

A diagram showing how an app running in local developer will obtain the application service principal from a .env file and then use that identity to connect to Azure resources.

For an app to authenticate to Azure during local development using the developer's Azure credentials, the developer must be signed-in to Azure from the VS Code Azure Tools extension, the Azure CLI, or Azure PowerShell. The Azure SDK for .NET is able to detect that the developer is signed-in from one of these tools and then obtain the necessary credentials from the credentials cache to authenticate the app to Azure as the signed-in user.

This approach is easiest to set up for a development team since it takes advantage of the developers' existing Azure accounts. However, a developer's account will likely have more permissions than required by the application, therefore exceeding the permissions the app will run with in production. As an alternative, you can create application service principals to use during local development which can be scoped to have only the access needed by the app.

1 - Create Azure AD group for local development

Since there are almost always multiple developers who work on an application, it's recommended to first create an Azure AD group to encapsulate the roles (permissions) the app needs in local development. This offers the following advantages.

  • Every developer is assured to have the same roles assigned since roles are assigned at the group level.
  • If a new role is needed for the app, it only needs to be added to the Azure AD group for the app.
  • If a new developer joins the team, they simply must be added to the correct Azure AD group to get the correct permissions to work on the app.

If you have an existing Azure AD group for your development team, you can use that group. Otherwise, complete the following steps to create an Azure AD group.

Instructions Screenshot
Navigate to the Azure Active Directory page in the Azure portal by typing Azure Active Directory into the search box at the top of the page and then selecting Azure Active Directory from under services. A screenshot showing how to use the top search bar in the Azure portal to search for and navigate to the Azure Active Directory page.
On the Azure Active Directory page, select Groups from the left-hand menu. A screenshot showing the location of the Groups menu item in the left-hand menu of the Azure Active Directory Default Directory page.
On the All groups page, select New group. A screenshot showing the location of the New Group button in the All groups page.
On the New Group page:
  1. Group typeSecurity
  2. Group name → A name for the security group, typically created from the application name. It is also helpful to include a string like local-dev in the name of the group to indicate the purpose of the group.
  3. Group description → A description of the purpose of the group.
  4. Select the No members selected link under Members to add members to the group.
A screenshot showing how to fill out the form to create a new Azure Active Directory group for the application.  This screenshot also shows the location of the link to select to add members to this group
On the Add members dialog box:
  1. Use the search box to filter the list of user names in the list.
  2. Select the user(s) for local development for this app. As objects are selected, they will move to the Selected items list at the bottom of the dialog.
  3. When finished, select the Select button.
A screenshot of the Add members dialog box showing how to select developer accounts to be included in the group.
Back on the New group page, select Create to create the group.

The group will be created and you will be taken back to the All groups page. It may take up to 30 seconds for the group to appear and you may need to refresh the page due to caching in the Azure portal.
A screenshot of the New Group page showing how to complete the process by selecting the Create button.

2 - Assign roles to the Azure AD group

Next, you need to determine what roles (permissions) your app needs on what resources and assign those roles to your app. In this example, the roles will be assigned to the Azure Active Directory group created in step 1. Roles can be assigned a role at a resource, resource group, or subscription scope. This example will show how to assign roles at the resource group scope since most applications group all their Azure resources into a single resource group.

Instructions Screenshot
Locate the resource group for your application by searching for the resource group name using the search box at the top of the Azure portal.

Navigate to your resource group by selecting the resource group name under the Resource Groups heading in the dialog box.
A screenshot showing how to use the top search box in the Azure portal to locate and navigate to the resource group you want to assign roles (permissions) to.
On the page for the resource group, select Access control (IAM) from the left-hand menu. A screenshot of the resource group page showing the location of the Access control (IAM) menu item.
On the Access control (IAM) page:
  1. Select the Role assignments tab.
  2. Select + Add from the top menu and then Add role assignment from the resulting drop-down menu.
A screenshot showing how to navigate to the role assignments tab and the location of the button used to add role assignments to a resource group.
The Add role assignment page lists all of the roles that can be assigned for the resource group.
  1. Use the search box to filter the list to a more manageable size. This example shows how to filter for Storage Blob roles.
  2. Select the role that you want to assign.
    Select Next to go to the next screen.
A screenshot showing how to filter and select role assignments to be added to the resource group.
The next Add role assignment page allows you to specify what user to assign the role to.
  1. Select User, group, or service principal under Assign access to.
  2. Select + Select members under Members
A dialog box will open on the right-hand side of the Azure portal.
A screenshot showing the radio button to select to assign a role to an Azure AD group and the link used to select the group to assign the role to.
In the Select members dialog:
  1. The Select text box can be used to filter the list of users and groups in your subscription. If needed, type the first few characters of the local development Azure AD group you created for the app.
  2. Select the local development Azure AD group associated with your application.
Select Select at the bottom of the dialog to continue.
A screenshot showing how to filter for and select the Azure AD group for the application in the Select members dialog box.
The Azure AD group will now show as selected on the Add role assignment screen.

Select Review + assign to go to the final page and then Review + assign again to complete the process.
A screenshot showing the completed Add role assignment page and the location of the Review + assign button used to complete the process.

3 - Sign-in to Azure using .NET Tooling

Next you need to sign in to Azure using one of several .NET tooling options. The account you sign into should also exist in the Azure Active Directory group you created and configured earlier.

On the top menu of Visual Studio, navigate to Tools > Options to open the options dialog. In the search bar in the upper left, type Azure to filter the options. Under the Azure Service Authentication, choose Account Selection.

Select the drop-down menu under Choose an account and choose to add a Microsoft Account. A window will open prompting you to pick an account. Enter the credentials for your desired Azure account, and then select the confirmation.

A screenshot showing how to sign in to Azure using Visual Studio.

4 - Implement DefaultAzureCredential in your application

DefaultAzureCredential supports multiple authentication methods and determines the authentication method being used at runtime. In this way, your app can use different authentication methods in different environments without implementing environment specific code.

The order and locations in which DefaultAzureCredential looks for credentials is found at DefaultAzureCredential.

To implement DefaultAzureCredential, first add the Azure.Identity and optionally the Microsoft.Extensions.Azure packages to your application. You can do this using either the command line or the NuGet Package Manager.

Open a terminal environment of your choice in the application project directory and enter the command below.

dotnet add package Azure.Identity
dotnet add package Microsoft.Extensions.Azure

Azure services are generally accessed using corresponding client classes from the SDK. These classes and your own custom services should be registered in the Program.cs file so they can be accessed via dependency injection throughout your app. Inside of Program.cs, follow the steps below to correctly setup your service and DefaultAzureCredential.

  1. Include the Azure.Identity and Microsoft.Extensions.Azure namespaces with a using statement.
  2. Register the Azure service using relevant helper methods.
  3. Pass an instance of the DefaultAzureCredential object to the UseCredential method.

An example of this is shown in the following code segment.

using Microsoft.Extensions.Azure;
using Azure.Identity;

// Inside of Program.cs
builder.Services.AddAzureClients(x =>
    x.AddBlobServiceClient(new Uri("https://<account-name>"));
    x.UseCredential(new DefaultAzureCredential());

Alternatively, you can also utilize DefaultAzureCredential in your services more directly without the help of additional Azure registration methods, as seen below.

using Azure.Identity;

// Inside of Program.cs
builder.Services.AddSingleton<BlobServiceClient>(x => 
    new BlobServiceClient(
        new Uri("https://<account-name>"),
        new DefaultAzureCredential()));

When the above code is run on your local workstation during local development, it will look in the environment variables for an application service principal or at Visual Studio, VS Code, the Azure CLI, or Azure PowerShell for a set of developer credentials, either of which can be used to authenticate the app to Azure resources during local development.

When deployed to Azure this same code can also authenticate your app to other Azure resources. DefaultAzureCredential can retrieve environment settings and managed identity configurations to authenticate to other services automatically.