Azure App Configuration Client

Warnings

• gotcha Authentication failures are common with `DefaultAzureCredential`. It relies on a specific order of authentication methods (environment variables, managed identity, Azure CLI login, etc.). Ensure your environment variables (e.g., `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`) are correctly set, or that you are logged in via Azure CLI (`az login`).
  Fix: Verify `az login` status, ensure required environment variables are correctly configured, or use a more specific credential type like `ClientSecretCredential` if `DefaultAzureCredential` is problematic.
• gotcha App Configuration settings can have optional 'labels'. When retrieving a setting using `get_configuration_setting(key='my_key')`, it only returns settings with a 'null' label by default. If your setting has a label (e.g., 'development'), you must explicitly specify it: `get_configuration_setting(key='my_key', label='development')`. For listing settings, use `label_filter`.
  Fix: Always consider if your configuration settings use labels. Explicitly include the `label` parameter in `get_configuration_setting` or `label_filter` in `list_configuration_settings` if your settings are labeled. Use `label=None` or `label_filter=LabelFilter.NULL` to specifically target settings without a label.
• gotcha The client requires appropriate Azure Role-Based Access Control (RBAC) permissions. To read settings, the principal needs 'App Configuration Data Reader' role. To write (set/delete) settings, 'App Configuration Data Owner' is required. Lack of proper roles will result in authorization errors, typically '403 Forbidden'.
  Fix: Grant the appropriate RBAC roles ('App Configuration Data Reader' or 'App Configuration Data Owner') to the identity used by `DefaultAzureCredential` (e.g., your user account, service principal, or managed identity) on the Azure App Configuration resource.
• gotcha The SDK provides both synchronous (`AzureAppConfigurationClient`) and asynchronous (`AsyncAzureAppConfigurationClient`) clients. Mixing synchronous client calls within an asynchronous context (or vice versa) without proper handling can lead to blocking behavior or runtime errors. Choose the appropriate client for your application's concurrency model.
  Fix: Use `AsyncAzureAppConfigurationClient` with `await` in an `async` function for asynchronous operations, or stick to `AzureAppConfigurationClient` for synchronous code. Do not mix them without explicitly managing task execution.

Install

• pip install azure-appconfiguration azure-identity Install with authentication library

Imports

• AzureAppConfigurationClient

  from azure.appconfiguration import AzureAppConfigurationClient

• ConfigurationSetting

  from azure.appconfiguration import ConfigurationSetting

• DefaultAzureCredential

  from azure.identity import DefaultAzureCredential

  Required for authenticating with Azure services.

Quickstart

Connect to an Azure App Configuration store and retrieve a key-value setting using `DefaultAzureCredential` for authentication. Remember to set the `AZURE_APPCONFIGURATION_ENDPOINT` environment variable and ensure the specified key exists.

import os
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import DefaultAzureCredential

# It is recommended to set environment variables for your App Configuration endpoint and credentials.
# For example:
# AZURE_APPCONFIGURATION_ENDPOINT="https://<your-app-config-name>.azconfig.io"
# AZURE_CLIENT_ID="<your-client-id>"
# AZURE_CLIENT_SECRET="<your-client-secret>"
# AZURE_TENANT_ID="<your-tenant-id>" (if using service principal)

app_config_endpoint = os.environ.get('AZURE_APPCONFIGURATION_ENDPOINT', 'https://YOUR_APP_CONFIG_ENDPOINT.azconfig.io')
# The key of the setting you want to retrieve
config_key = "MyApplication:Settings:MyKey"

try:
    # DefaultAzureCredential attempts to authenticate via various methods:
    # Environment variables, Managed Identity, Azure CLI, Visual Studio Code, etc.
    credential = DefaultAzureCredential()

    # Create a synchronous client
    client = AzureAppConfigurationClient(endpoint=app_config_endpoint, credential=credential)

    # Retrieve a configuration setting.
    # By default, get_configuration_setting retrieves settings with no label.
    # If your setting has a label, you must specify it, e.g., label="development"
    setting = client.get_configuration_setting(key=config_key)

    if setting:
        print(f"Successfully retrieved setting:")
        print(f"  Key: {setting.key}")
        print(f"  Value: {setting.value}")
        print(f"  Label: {setting.label if setting.label else 'None'}")
        print(f"  Content Type: {setting.content_type if setting.content_type else 'None'}")
    else:
        print(f"Setting with key '{config_key}' not found or no label matched.")

except Exception as e:
    print(f"An error occurred: {e}")
    print("Please ensure 'AZURE_APPCONFIGURATION_ENDPOINT' is set and valid.")
    print(f"Also verify that a setting with key '{config_key}' exists in your Azure App Configuration store and your credentials have 'App Configuration Data Reader' permissions.")