{
  "name": "azure/credentials",
  "version": 1,
  "title": "Azure — service principal",
  "keys": {
    "AZURE_TENANT_ID": {
      "required": true,
      "sensitivity": "secret",
      "obtain": "https://portal.azure.com/",
      "description": "Which directory. Azure states no sensitivity for it, and it is one of the three values that together authenticate, so it is kept with them."
    },
    "AZURE_CLIENT_ID": {
      "required": true,
      "sensitivity": "secret",
      "obtain": "https://portal.azure.com/",
      "description": "The app registration. Azure never says this may be published, so it is not treated as public here."
    },
    "AZURE_CLIENT_SECRET": {
      "required": false,
      "sensitivity": "secret",
      "obtain": "https://portal.azure.com/",
      "description": "One of two ways to prove the app registration. Azure shows the value once. Add a new secret before removing the old; there is no editing one in place."
    },
    "AZURE_CLIENT_CERTIFICATE_PATH": {
      "required": false,
      "sensitivity": "secret",
      "obtain": "https://learn.microsoft.com/",
      "description": "The other way: a path to a certificate and private key in PEM or PFX. Set this or the secret above, not both."
    },
    "AZURE_CLIENT_CERTIFICATE_PASSWORD": {
      "required": false,
      "sensitivity": "secret",
      "obtain": "https://learn.microsoft.com/",
      "description": "Protects that file, when it is a PFX."
    }
  }
}