# Azure OpenAI

The [Azure OpenAI](https://learn.microsoft.com/en-us/azure/ai-services/openai/reference#chat-completions) provider, `azure` uses the `AZURE_OPENAI_...` environment variables. You can use a managed identity (recommended) or an API key to authenticate with the Azure OpenAI service. You can also use a service principal as documented in [automation](/genaiscript/getting-started/automating-scripts).

```js
script({ model: "azure:deployment-id" });
```

Tip

If you are a Visual Studio Subscriber, you can [get free Azure credits](https://azure.microsoft.com/en-us/pricing/member-offers/credit-for-visual-studio-subscribers/) to try the Azure OpenAI service.

### Managed Identity (Entra ID)

[Section titled “Managed Identity (Entra ID)”](#managed-identity-entra-id)

1. Open your Azure OpenAI resource in the [Azure Portal](https://portal.azure.com)

2. Navigate to **Access Control (IAM)**, then **View My Access**. Make sure your user or service principal has the **Cognitive Services OpenAI User/Contributor** role. If you get a `401` error, click on **Add**, **Add role assignment** and add the **Cognitive Services OpenAI User** role to your user.

3. Navigate to **Resource Management**, then **Keys and Endpoint**.

4. Update the `.env` file with the endpoint.

   .env

   ```txt
   AZURE_OPENAI_API_ENDPOINT=https://....openai.azure.com
   ```

   Note

   Make sure to remove any `AZURE_API_KEY`, `AZURE_OPENAI_API_KEY` entries from `.env` file.

5. Navigate to **deployments** and make sure that you have your LLM deployed and copy the `deployment-id`, you will need it in the script.

6. Open a terminal and **login** with [Azure CLI](https://learn.microsoft.com/en-us/javascript/api/overview/azure/identity-readme?view=azure-node-latest#authenticate-via-the-azure-cli).

   ```sh
   az login
   ```

7. Update the `model` field in the `script` function to match the model deployment name in your Azure resource.

   ```js
   script({
       model: "azure:deployment-id",
       ...
   })
   ```

Set the `NODE_ENV` environment variable to `development` to enable the `DefaultAzureCredential` to work with the Azure CLI. Otherwise, it will use a chained token credential with `env`, `workload`, `managed identity`, `azure cli`, `azure dev cli`, `azure powershell`, `devicecode` credentials.

### Listing models

[Section titled “Listing models”](#listing-models)

There are two ways to list the models in your Azure OpenAI resource: use the Azure Management APIs or by calling into a custom `/models` endpoint.

### Using the management APIs (this is the common way)

[Section titled “Using the management APIs (this is the common way)”](#using-the-management-apis-this-is-the-common-way)

In order to allow GenAIScript to list deployments in your Azure OpenAI service, you need to provide the Subscription ID **and you need to use Microsoft Entra!**.

1. Open the Azure OpenAI resource in the [Azure Portal](https://portal.azure.com), open the **Overview** tab and copy the **Subscription ID**.

2. Update the `.env` file with the subscription id.

   .env

   ```txt
   AZURE_OPENAI_SUBSCRIPTION_ID="..."
   ```

3. Test your configuration by running

   ```sh
   npx genaiscript models azure
   ```

   Note

   This feature will probably not work with `AZURE_OPENAI_API_KEY` as the token does not have the proper scope to query the list of deployments.

#### Using the `/models` endpoint

[Section titled “Using the /models endpoint”](#using-the-models-endpoint)

This approach assumes you have set a OpenAI comptaible `/models` enpoint in your subscription that returns the list of deployments in a format compatible with the OpenAI API.

You can set the `AZURE_OPENAI_API_MODELS_TYPE` environment variable to point to `openai`.

.env

```txt
AZURE_OPENAI_API_MODELS_TYPE="openai"
```

### Custom credentials

[Section titled “Custom credentials”](#custom-credentials)

In some situations, the default credentials chain lookup may not work. In that case, you can specify an additional environment variable `AZURE_OPENAI_API_CREDENTIALS` with the type of credential that should be used.

.env

```txt
AZURE_OPENAI_API_CREDENTIALS=cli
```

The types are mapped directly to their [@azure/identity](https://www.npmjs.com/package/@azure/identity) credential types:

* `cli` - `AzureCliCredential`
* `env` - `EnvironmentCredential`
* `powershell` - `AzurePowerShellCredential`
* `devcli` - `AzureDeveloperCliCredential`
* `workloadidentity` - `WorkloadIdentityCredential`
* `managedidentity` - `ManagedIdentityCredential`

Set `NODE_ENV` to `development` to use the `DefaultAzureCredential` with the GenAIScript.

### Custom token scopes

[Section titled “Custom token scopes”](#custom-token-scopes)

The default token scope for Azure OpenAI access is `https://cognitiveservices.azure.com/.default`. You can override this value using the `AZURE_OPENAI_TOKEN_SCOPES` environment variable.

.env

```txt
AZURE_OPENAI_TOKEN_SCOPES=...
```

### API Version

[Section titled “API Version”](#api-version)

GenAIScript maintains a [default API version](https://learn.microsoft.com/en-us/azure/ai-services/openai/api-version-deprecation) to access Azure OpenAI.

* current version: 2025-04-01-preview

You can override this value using the `AZURE_OPENAI_API_VERSION` environment variable.

.env

```txt
AZURE_OPENAI_API_VERSION=2025-01-01-preview
```

You can also override the API version on a per-deployment basis by settings the `AZURE_OPENAI_API_VERSION_<deployment-id>` environment variable (where deployment-id is capitalized).

.env

```txt
AZURE_OPENAI_API_VERSION_GPT-4O=2025-01-01-preview
```

### API Key

[Section titled “API Key”](#api-key)

1. Open your [Azure OpenAI resource](https://portal.azure.com) and navigate to **Resource Management**, then **Keys and Endpoint**.

2. Update the `.env` file with the secret key (**Key 1** or **Key 2**) and the endpoint.

   .env

   ```txt
   AZURE_OPENAI_API_KEY=...
   AZURE_OPENAI_API_ENDPOINT=https://....openai.azure.com
   ```

3. The rest of the steps are the same: Find the deployment name and use it in your script, `model: "azure:deployment-id"`.

### Aliases

The following model aliases are attempted by default in GenAIScript.

| Alias | Model identifier |
| ----- | ---------------- |

### Limitations

* Ignore prediction of output tokens