Most SDK operations require an OAuth token for authentication and authorization. These are
made available in the Go SDK For Azure through types implementing the `Authorizer` interface.
You can get one from Azure Active Directory using the SDK's
[authentication](https://godoc.org/github.com/Azure/go-autorest/autorest/azure/auth) package. The `Authorizer` returned should
be set as the authorizer for the resource client, as shown in the [previous section](#use).
You can get an authorizer in the following ways:
1. From the **Environment**:
- Use `auth.auth.NewAuthorizerFromEnvironment()`. This call will try to get an authorizer based on the environment
variables with different types of credentials in the following order:
1.**Client Credentials**: Uses the AAD App Secret for auth.
-`AZURE_TENANT_ID`: Specifies the Tenant to which to authenticate.
-`AZURE_CLIENT_ID`: Specifies the app client ID to use.
-`AZURE_CLIENT_SECRET`: Specifies the app secret to use.
2.**Client Certificate**: Uses a certificate that was configured on the AAD Service Principal.
-`AZURE_TENANT_ID`: Specifies the Tenant to which to authenticate.
-`AZURE_CLIENT_ID`: Specifies the app client ID to use.
-`AZURE_CERTIFICATE_PATH`: Specifies the certificate Path to use.
-`AZURE_CERTIFICATE_PASSWORD`: Specifies the certificate password to use.
3.**Username Pasword**: Uses a username and a password for auth. This is not recommended. Use `Device Flow` Auth instead for user interactive acccess.
-`AZURE_TENANT_ID`: Specifies the Tenant to which to authenticate.
-`AZURE_CLIENT_ID`: Specifies the app client ID to use.
-`AZURE_USERNAME`: Specifies the username to use.
-`AZURE_PASSWORD`: Specifies the password to use.
4.**MSI**: Only available for apps running in Azure. No configuration needed as it leverages the fact that the app is running in Azure. See [Azure Managed Service Identity](https://docs.microsoft.com/en-us/azure/active-directory/msi-overview).
- Optionally, the following environment variables can be defined:
-`AZURE_ENVIRONMENT`: Specifies the Azure Environment to use. If not set, it defaults to `AzurePublicCloud`. (Not applicable to MSI based auth)
-`AZURE_AD_RESOURCE`: Specifies the AAD resource ID to use. If not set, it defaults to `ResourceManagerEndpoint`which allows management operations against Azure Resource Manager.
2. From an **Auth File**:
- Create a service principal and output the file content using `az ad sp create-for-rbac --sdk-auth` from the Azure CLI.For more details see [az ad sp](https://docs.microsoft.com/en-us/cli/azure/ad/sp).
- Set environment variable `AZURE_AUTH_LOCATION` for finding the file.
- Use `auth.NewAuthorizerFromFile()` for getting the `Authorizer` based on the auth file.
3. From **Device Flow** by configuring `auth.DeviceFlowConfig` and calling the `Authorizer()` method.
Note: To authenticate you first need to create a service principal in Azure. To create a new service principal, run
`az ad sp create-for-rbac -n "<app_name>"` in the
[azure-cli](https://github.com/Azure/azure-cli). See
for more info. Copy the new principal's ID, secret, and tenant ID for use in your app.
Alternatively, if your apps are running in Azure, you can now leverage the [Managed Service Identity](https://docs.microsoft.com/en-us/azure/active-directory/msi-overview).