UsernamePasswordCredential Class

Authenticates a user with a username and password.

In general, Microsoft doesn't recommend this kind of authentication, because it's less secure than other authentication flows.

Authentication with this credential is not interactive, so it is not compatible with any form of multi-factor authentication or consent prompting. The application must already have consent from the user or a directory admin.

This credential can only authenticate work and school accounts; Microsoft accounts are not supported. See Microsoft Entra ID documentation for more information about account types.

Inheritance

azure.identity._internal.interactive.InteractiveCredential

UsernamePasswordCredential

Constructor

UsernamePasswordCredential(client_id: str, username: str, password: str, **kwargs: Any)

Parameters

Name	Description
client_id Required	str The application's client ID
username Required	str The user's username (usually an email address)
password Required	str The user's password

Keyword-Only Parameters

Name	Description
authority	str Authority of a Microsoft Entra endpoint, for example "login.microsoftonline.com", the authority for Azure Public Cloud (which is the default). AzureAuthorityHosts defines authorities for other clouds.
tenant_id	str Tenant ID or a domain associated with a tenant. If not provided, defaults to the "organizations" tenant, which supports only Microsoft Entra work or school accounts.
cache_persistence_options	TokenCachePersistenceOptions Configuration for persistent token caching. If unspecified, the credential will cache tokens in memory.
disable_instance_discovery	bool Determines whether or not instance discovery is performed when attempting to authenticate. Setting this to true will completely disable both instance discovery and authority validation. This functionality is intended for use in scenarios where the metadata endpoint cannot be reached, such as in private clouds or Azure Stack. The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority. By setting this to True, the validation of the authority is disabled. As a result, it is crucial to ensure that the configured authority host is valid and trustworthy.
additionally_allowed_tenants	List[str] Specifies tenants in addition to the specified "tenant_id" for which the credential may acquire tokens. Add the wildcard value "*" to allow the credential to acquire tokens for any tenant the application can access.
enable_support_logging	bool Enables additional support logging in the underlying MSAL library. This logging potentially contains personally identifiable information and is intended to be used only for troubleshooting purposes.

Examples

Create a UsernamePasswordCredential.

   from azure.identity import UsernamePasswordCredential

   credential = UsernamePasswordCredential(
       client_id="<client_id>",
       username="<username>",
       password="<password>",
   )

Methods

authenticate	Interactively authenticate a user.
close
get_token	Request an access token for scopes. This method is called automatically by Azure SDK clients.

authenticate

Interactively authenticate a user.

authenticate(*, scopes: Iterable[str] | None = None, claims: str | None = None, **kwargs: Any) -> AuthenticationRecord

Keyword-Only Parameters

Name	Description
scopes	Iterable[str] scopes to request during authentication, such as those provided by scopes. If provided, successful authentication will cache an access token for these scopes.
claims	str additional claims required in the token, such as those provided by claims

Returns

Type	Description
AuthenticationRecord

Exceptions

Type	Description
ClientAuthenticationError	authentication failed. The error's message attribute gives a reason.

close

close() -> None

Keyword-Only Parameters

Name	Description
scopes	Iterable[str] scopes to request during authentication, such as those provided by scopes. If provided, successful authentication will cache an access token for these scopes.
claims	str additional claims required in the token, such as those provided by claims

Exceptions

Type	Description
ClientAuthenticationError	authentication failed. The error's message attribute gives a reason.

get_token

Request an access token for scopes.

This method is called automatically by Azure SDK clients.

get_token(*scopes: str, claims: str | None = None, tenant_id: str | None = None, enable_cae: bool = False, **kwargs: Any) -> AccessToken

Parameters

Name	Description
scopes Required	str desired scopes for the access token. This method requires at least one scope. For more information about scopes, see https://learn.microsoft.com/azure/active-directory/develop/scopes-oidc.

Keyword-Only Parameters

Name	Description
claims	str additional claims required in the token, such as those returned in a resource provider's claims challenge following an authorization failure
tenant_id	str optional tenant to include in the token request.
enable_cae	bool indicates whether to enable Continuous Access Evaluation (CAE) for the requested token. Defaults to False.

Returns

Type	Description
AccessToken	An access token with the desired scopes.

Exceptions

Type	Description
CredentialUnavailableError	the credential is unable to attempt authentication because it lacks required data, state, or platform support
ClientAuthenticationError	authentication failed. The error's message attribute gives a reason.
AuthenticationRequiredError	user interaction is necessary to acquire a token, and the credential is configured not to begin this automatically. Call
authenticate	to begin interactive authentication.