{"meta":{"title":"支持 BYOK（自带密钥）的 Azure 托管标识","intro":"GitHub Copilot SDK 的 BYOK （自带密钥） 支持静态 API 密钥，但Azure部署通常使用托管标识（Microsoft Entra ID），而不是长期密钥。 GitHub Copilot SDK 旨在使用Azure标识 SDK 进行组合，以实现最大的灵活性。 提供一个 Bearer 令牌提供程序回调，以便使用 Azure 标识 SDK API 在需要时获取新的令牌。","product":"GitHub Copilot","breadcrumbs":[{"href":"/zh/enterprise-cloud@latest/copilot","title":"GitHub Copilot"},{"href":"/zh/enterprise-cloud@latest/copilot/how-tos","title":"操作方法"},{"href":"/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk","title":"Copilot SDK"},{"href":"/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk/setup","title":"设置 Copilot SDK"},{"href":"/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk/setup/azure-managed-identity","title":"Azure 托管标识"}],"documentType":"article"},"body":"# 支持 BYOK（自带密钥）的 Azure 托管标识\n\nGitHub Copilot SDK 的 BYOK （自带密钥） 支持静态 API 密钥，但Azure部署通常使用托管标识（Microsoft Entra ID），而不是长期密钥。 GitHub Copilot SDK 旨在使用Azure标识 SDK 进行组合，以实现最大的灵活性。 提供一个 Bearer 令牌提供程序回调，以便使用 Azure 标识 SDK API 在需要时获取新的令牌。\n\n\n\n\n\n本指南介绍如何通过 GitHub Copilot SDK 使用 Azure Identity SDK API 对 Microsoft Foundry 模型进行身份验证。 大多数语言使用 `DefaultAzureCredential`；Rust 在本地使用 `DeveloperToolsCredential`，在 Azure 中使用 `ManagedIdentityCredential`。\n\n## 工作原理\n\nMicrosoft Foundry 的 OpenAI 兼容终结点 （`https://.openai.azure.com/openai/v1/`） 接受来自Microsoft Entra ID的持有者令牌，以代替静态 API 密钥。 本指南使用令牌提供程序回调，以便GitHub Copilot SDK 运行时可以按需请求新的令牌。\n\n以Python为例，流为：\n\n1. 为环境配置 `DefaultAzureCredential` 。\n2. 在 BYOK 提供程序配置的 `bearer_token_provider` 中传递一个回调函数，该函数使用 `DefaultAzureCredential` 获取用于 `https://ai.azure.com/.default` 范围的令牌。\n3. 让GitHub Copilot SDK 通过该回调按需请求新令牌。\n\n![关系图：显示描述的过程的序列图。](/assets/images/help/copilot/copilot-sdk/setup-azure-managed-identity-diagram-0.png)\n\n## 代码示例\n\n### 先决条件\n\n为你所用的编程语言安装 Azure Identity 和 GitHub Copilot SDK 包：\n\n
\n
.NET
\n\n\n\n```bash\ndotnet add package GitHub.Copilot.SDK\ndotnet add package Azure.Core\n```\n\n
\n\n
Go
\n\n\n\n```bash\ngo get github.com/github/copilot-sdk/go\ngo get github.com/Azure/azure-sdk-for-go/sdk/azidentity\n```\n\n
\n\n
Java
\n\n\n\n```xml\n\n com.github\n copilot-sdk-java\n ${copilot.sdk.version}\n\n\n\n com.azure\n azure-identity\n ${azure.identity.version}\n\n```\n\n
\n\n
Python
\n\n\n\n```bash\npip install github-copilot-sdk azure-identity\n```\n\n
\n\n
Rust
\n\n\n\n```bash\ncargo add github-copilot-sdk azure_identity azure_core\ncargo add tokio --features macros,rt-multi-thread\n```\n\n
\n\n
TypeScript
\n\n\n\n```bash\nnpm install @github/copilot-sdk @azure/identity\n```\n\n
\n\n
\n\n### 使用令牌提供方回调\n\n如果希望 GitHub Copilot SDK 运行时通过提供的回调按需请求新令牌，请使用此方法。 Azure 标识 SDK 负责令牌缓存和刷新时机。\n\n下面是特定语言的实现：\n\n
\n
.NET
\n\n\n\n```csharp\nusing Azure.Core;\nusing Azure.Identity;\nusing GitHub.Copilot;\n\nDefaultAzureCredential credential = new(\n DefaultAzureCredential.DefaultEnvironmentVariableName);\nawait using CopilotClient client = new();\nstring foundryUrl = Environment.GetEnvironmentVariable(\"FOUNDRY_RESOURCE_URL\")!;\n\nawait using CopilotSession session = await client.CreateSessionAsync(new SessionConfig\n{\n Model = \"gpt-5.5\",\n Provider = new ProviderConfig\n {\n Type = \"openai\",\n BaseUrl = $\"{foundryUrl}/openai/v1/\",\n BearerTokenProvider = async _ =>\n {\n AccessToken token = await credential.GetTokenAsync(\n new TokenRequestContext([\"https://ai.azure.com/.default\"]));\n return token.Token;\n },\n WireApi = \"responses\",\n },\n});\n\nAssistantMessageEvent? response = await session.SendAndWaitAsync(\n new MessageOptions { Prompt = \"Hello from Managed Identity!\" });\nConsole.WriteLine(response?.Data.Content);\n```\n\n
\n\n
Go
\n\n\n\n```golang\npackage main\n\nimport (\n \"context\"\n \"fmt\"\n \"log\"\n \"os\"\n \"time\"\n\n \"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy\"\n \"github.com/Azure/azure-sdk-for-go/sdk/azidentity\"\n copilot \"github.com/github/copilot-sdk/go\"\n)\nfunc main() {\n opts := azidentity.DefaultAzureCredentialOptions{RequireAzureTokenCredentials: true}\n credential, err := azidentity.NewDefaultAzureCredential(&opts)\n if err != nil {\n log.Fatal(err)\n }\n\n getBearerToken := func(args copilot.ProviderTokenArgs) (string, error) {\n token, err := credential.GetToken(context.Background(), policy.TokenRequestOptions{\n Scopes: []string{\"https://ai.azure.com/.default\"},\n })\n if err != nil {\n return \"\", err\n }\n return token.Token, nil\n }\n\n client := copilot.NewClient(nil)\n if err := client.Start(context.Background()); err != nil {\n log.Fatal(err)\n }\n defer client.Stop()\n\n foundryURL := os.Getenv(\"FOUNDRY_RESOURCE_URL\")\n\n session, err := client.CreateSession(context.Background(), &copilot.SessionConfig{\n Model: \"gpt-5.5\",\n Provider: &copilot.ProviderConfig{\n Type: \"openai\",\n BaseURL: fmt.Sprintf(\"%s/openai/v1/\", foundryURL),\n BearerTokenProvider: getBearerToken,\n WireAPI: \"responses\",\n },\n })\n if err != nil {\n log.Fatal(err)\n }\n defer session.Disconnect()\n\n ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)\n defer cancel()\n\n response, err := session.SendAndWait(ctx, copilot.MessageOptions{\n Prompt: \"Hello from Managed Identity!\",\n })\n if err != nil {\n log.Fatal(err)\n }\n\n if response != nil {\n if data, ok := response.Data.(*copilot.AssistantMessageData); ok {\n fmt.Println(data.Content)\n }\n }\n}\n```\n\n
\n\n
Java
\n\n\n\n```java\nimport com.azure.core.credential.TokenRequestContext;\nimport com.azure.identity.AzureIdentityEnvVars;\nimport com.azure.identity.DefaultAzureCredentialBuilder;\nimport com.github.copilot.CopilotClient;\nimport com.github.copilot.generated.AssistantMessageEvent;\nimport com.github.copilot.rpc.BearerTokenProvider;\nimport com.github.copilot.rpc.MessageOptions;\nimport com.github.copilot.rpc.ProviderConfig;\nimport com.github.copilot.rpc.SessionConfig;\n\npublic class ManagedIdentityExample {\n public static void main(String[] args) throws Exception {\n var credential = new DefaultAzureCredentialBuilder()\n .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)\n .build();\n BearerTokenProvider tokenProvider = providerArgs ->\n credential\n .getToken(new TokenRequestContext().addScopes(\"https://ai.azure.com/.default\"))\n .map(accessToken -> accessToken.getToken())\n .toFuture();\n String foundryUrl = System.getenv(\"FOUNDRY_RESOURCE_URL\");\n\n try (var client = new CopilotClient()) {\n client.start().get();\n\n var session = client.createSession(new SessionConfig()\n .setModel(\"gpt-5.5\")\n .setProvider(new ProviderConfig()\n .setType(\"openai\")\n .setBaseUrl(foundryUrl + \"/openai/v1/\")\n .setBearerTokenProvider(tokenProvider)\n .setWireApi(\"responses\")))\n .get();\n\n AssistantMessageEvent response = session\n .sendAndWait(new MessageOptions().setPrompt(\"Hello from Managed Identity!\"))\n .get();\n System.out.println(response.getData().content());\n\n session.disconnect().get();\n }\n }\n}\n```\n\n
\n\n
Python
\n\n\n\n```python\nimport asyncio\nimport os\n\nfrom azure.identity.aio import DefaultAzureCredential\nfrom copilot import CopilotClient\nfrom copilot.session import PermissionHandler, ProviderConfig\n\nasync def main():\n credential = DefaultAzureCredential(require_envvar=True)\n async def get_bearer_token(_args) -> str:\n token = await credential.get_token(\"https://ai.azure.com/.default\")\n return token.token\n\n foundry_url = os.environ[\"FOUNDRY_RESOURCE_URL\"]\n\n client = CopilotClient()\n await client.start()\n\n session = await client.create_session(\n on_permission_request=PermissionHandler.approve_all,\n model=\"gpt-5.5\",\n provider=ProviderConfig(\n type=\"openai\",\n base_url=f\"{foundry_url.rstrip('/')}/openai/v1/\",\n bearer_token_provider=get_bearer_token,\n wire_api=\"responses\",\n ),\n )\n\n response = await session.send_and_wait(\"Hello from Managed Identity!\")\n print(response.data.content)\n\n await client.stop()\n await credential.close()\n\nasyncio.run(main())\n```\n\n
\n\n
Rust
\n\n\n\n```rust\nuse std::sync::Arc;\n\nuse azure_core::credentials::TokenCredential;\nuse azure_identity::{DeveloperToolsCredential, ManagedIdentityCredential};\nuse github_copilot_sdk::{BearerTokenError, Client, ClientOptions, MessageOptions, ProviderTokenArgs};\nuse github_copilot_sdk::types::{ProviderConfig, SessionConfig};\n\nfn credential_for_environment() -> azure_core::Result> {\n match std::env::var(\"AZURE_TOKEN_CREDENTIALS\").as_deref() {\n Ok(\"ManagedIdentityCredential\") => Ok(ManagedIdentityCredential::new(None)?),\n _ => Ok(DeveloperToolsCredential::new(None)?),\n }\n}\n\n#[tokio::main]\nasync fn main() -> Result<(), Box> {\n let credential = credential_for_environment()?;\n let foundry_url = std::env::var(\"FOUNDRY_RESOURCE_URL\")?;\n\n let get_bearer_token = {\n let credential = credential.clone();\n move |_args: ProviderTokenArgs| {\n let credential = credential.clone();\n async move {\n let token = credential\n .get_token(&[\"https://ai.azure.com/.default\"], None)\n .await\n .map_err(|err| BearerTokenError::message(err.to_string()))?;\n Ok(token.token.secret().to_string())\n }\n }\n };\n\n let mut provider = ProviderConfig::default();\n provider.provider_type = Some(\"openai\".to_string());\n provider.base_url = format!(\"{}/openai/v1/\", foundry_url.trim_end_matches('/'));\n provider.bearer_token_provider = Some(Arc::new(get_bearer_token));\n provider.wire_api = Some(\"responses\".to_string());\n\n let mut config = SessionConfig::default();\n config.model = Some(\"gpt-5.5\".to_string());\n config.provider = Some(provider);\n\n let client = Client::start(ClientOptions::default()).await?;\n let session = client.create_session(config).await?;\n\n session\n .send_and_wait(MessageOptions::new(\"Hello from Managed Identity!\"))\n .await?;\n\n session.disconnect().await?;\n client.stop().await?;\n Ok(())\n}\n```\n\n
\n\n
TypeScript
\n\n\n\n```typescript\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { CopilotClient } from \"@github/copilot-sdk\";\n\nconst credential = new DefaultAzureCredential({\n requiredEnvVars: [\"AZURE_TOKEN_CREDENTIALS\"],\n});\nconst getBearerToken = async () => {\n const tokenResponse = await credential.getToken(\"https://ai.azure.com/.default\");\n return tokenResponse.token;\n};\n\nconst client = new CopilotClient();\n\nconst session = await client.createSession({\n model: \"gpt-5.5\",\n provider: {\n type: \"openai\",\n baseUrl: `${process.env.FOUNDRY_RESOURCE_URL}/openai/v1/`,\n bearerTokenProvider: getBearerToken,\n wireApi: \"responses\",\n },\n});\n\nconst response = await session.sendAndWait({ prompt: \"Hello from Managed Identity!\" });\nconsole.log(response?.data.content);\n\nawait client.stop();\n```\n\n
\n\n
\n\n## 环境配置\n\n| Variable | Description | 示例 |\n| ------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | ---------------------------------------- |\n| `AZURE_TOKEN_CREDENTIALS` | 在 **Azure** 中运行时，将其设置为 `ManagedIdentityCredential`. | |\n| **在本地**运行时，将其设置为 `dev` 或开发人员工具凭据名称，例如 `AzureCliCredential`。 | `ManagedIdentityCredential` | |\n| `AZURE_CLIENT_ID` | | |\n| *可选。* 在**Azure**中运行时，使用`ManagedIdentityCredential`时，将此 ID 设置为用户分配的托管标识的客户端 ID。 如果未设置，Azure将使用系统分配的托管标识。 | `11111111-2222-3333-4444-555555555555` | |\n| `FOUNDRY_RESOURCE_URL` | 你的 Microsoft Foundry 资源 URL | `https://.openai.azure.com` |\n\n不需要 API 密钥环境变量 - 身份验证由Azure标识凭据处理。 在 .NET 中，Go、Java、Python 和 TypeScript `DefaultAzureCredential` 会自动支持：\n\n* **托管标识**（系统分配或用户分配）：适用于Azure托管的应用\n* **Azure CLI** （`az login`）：用于本地开发\n* **环境变量**（`AZURE_CLIENT_ID`、`AZURE_TENANT_ID`、`AZURE_CLIENT_SECRET`）：用于服务主体\n* **工作负荷标识**：适用于 Kubernetes\n\n在 .NET、Go、Java、Python 和 TypeScript 中，`ManagedIdentityCredential`读取`AZURE_CLIENT_ID`以选择用户分配的托管标识。 Rust 是本指南中的一个例外。\n\n在 Rust 中，使用 `DeveloperToolsCredential` 进行本地开发，在 Azure 中运行时使用 `ManagedIdentityCredential`。 对于其他语言，请参阅 `DefaultAzureCredential` 文档以了解完整的凭据链：\n\n* [.NET](https://aka.ms/azsdk/net/identity/credential-chains#defaultazurecredential-overview)\n* [Go](https://aka.ms/azsdk/go/identity/credential-chains#defaultazurecredential-overview)\n* [Java](https://aka.ms/azsdk/java/identity/credential-chains#defaultazurecredential-overview)\n* [Python](https://aka.ms/azsdk/python/identity/credential-chains#defaultazurecredential-overview)\n* [TypeScript](https://aka.ms/azsdk/js/identity/credential-chains#defaultazurecredential-overview)\n\n## 何时使用此模式\n\n| 情景 | Recommendation |\n| ------------------------------ | ------------------------------------------------------------------------------------------------ |\n| 带有托管标识的 Azure 托管应用 | |\n| ✅ 使用此模式 | |\n| 使用现有 Microsoft Entra 服务主体的应用程序 | |\n| ✅ 使用此模式 | |\n| 使用 `az login` 进行本地开发 | |\n| ✅ 使用此模式 | |\n| 具有静态 API 密钥的非 Azure 环境 | 使用 [BYOK （自带密钥）](/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk/auth/byok) |\n| GitHub Copilot订阅可用 | 使用 [GitHub OAuth 设置](/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk/setup/github-oauth) |\n\n## 另见\n\n* [BYOK （自带密钥）](/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk/auth/byok)：静态 API 密钥配置\n* [后端服务设置](/zh/enterprise-cloud@latest/copilot/how-tos/copilot-sdk/setup/backend-services)：服务器端部署"}