How can I override/modify "Active Directory Default" credential behavior?

[Astrophizz]

This is in Q&A though I mistakenly got the answer from the Azure/azure-sdk-for-net repository.

There's an issue in Azure.Core 1.60.0+ where the DefaultAzureCredential fails to attempt to authenticate beyond ManagedIdentityCredential. The direct workaround is to (in the appropriate context) set ExcludeManagedIdentityCredential = true in DefaultAzureCredentialOptions. I didn't know how to apply that to Microsoft.Data.SqlClient.Extensions.Azure though.

The Microsoft.Data.SqlClient.Extensions.Azure-specific workaround/answer is that there is an AccessTokenCallback property in SqlConnection that I can have return a token generated from a DefaultAzureCredential with ExcludeManagedIdentityCredential = true and TokenRequestContext(["https://database.windows.net/.default"].

See also: Connect to Azure SQL with Microsoft Entra authentication and SqlClient: Using AccessTokenCallback

[hippi345]

No code needed. "Active Directory Default" just builds a plain DefaultAzureCredential, and that reads the AZURE_TOKEN_CREDENTIALS env var. Set it to dev and you only get the dev-tool credentials (VS, VS Code, Azure CLI, PowerShell, azd), so ManagedIdentityCredential never runs. You can also name a single one, e.g. AzureCliCredential.

$env:AZURE_TOKEN_CREDENTIALS = "dev"

Put it in launchSettings.json for local runs and leave it unset in Azure where you actually want MI.