Azure OpenAI

The Azure OpenAI provider, azure uses the AZURE_OPENAI_... environment variables. You can use a managed identity (recommended) or an API key to authenticate with the Azure OpenAI service. You can also use a service principal as documented in automation.

script({ model: "azure:deployment-id" });

Managed Identity (Entra ID)

Open your Azure OpenAI resource in the Azure Portal
Navigate to Access Control (IAM), then View My Access. Make sure your user or service principal has the Cognitive Services OpenAI User/Contributor role. If you get a 401 error, click on Add, Add role assignment and add the Cognitive Services OpenAI User role to your user.
Navigate to Resource Management, then Keys and Endpoint.
Update the .env file with the endpoint.
.env
```
AZURE_OPENAI_API_ENDPOINT=https://....openai.azure.com
```
Make sure to remove any AZURE_API_KEY, AZURE_OPENAI_API_KEY entries from .env file.
Navigate to deployments and make sure that you have your LLM deployed and copy the deployment-id, you will need it in the script.
Open a terminal and login with Azure CLI.
Terminal window
```
az login
```
Update the model field in the script function to match the model deployment name in your Azure resource.
```
script({
    model: "azure:deployment-id",
    ...
})
```

Set the NODE_ENV environment variable to development to enable the DefaultAzureCredential to work with the Azure CLI. Otherwise, it will use a chained token credential with env, workload, managed identity, azure cli, azure dev cli, azure powershell, devicecode credentials.

Listing models

There are two ways to list the models in your Azure OpenAI resource: use the Azure Management APIs or by calling into a custom /models endpoint.

Using the management APIs (this is the common way)

In order to allow GenAIScript to list deployments in your Azure OpenAI service, you need to provide the Subscription ID and you need to use Microsoft Entra!.

Open the Azure OpenAI resource in the Azure Portal, open the Overview tab and copy the Subscription ID.
Update the .env file with the subscription id.
.env
```
AZURE_OPENAI_SUBSCRIPTION_ID="..."
```
Test your configuration by running
Terminal window
```
npx genaiscript models azure
```
This feature will probably not work with AZURE_OPENAI_API_KEY as the token does not have the proper scope to query the list of deployments.

Using the `/models` endpoint

This approach assumes you have set a OpenAI comptaible /models enpoint in your subscription that returns the list of deployments in a format compatible with the OpenAI API.

You can set the AZURE_OPENAI_API_MODELS_TYPE environment variable to point to openai.

AZURE_OPENAI_API_MODELS_TYPE="openai"

Custom credentials

In some situations, the default credentials chain lookup may not work. In that case, you can specify an additional environment variable AZURE_OPENAI_API_CREDENTIALS with the type of credential that should be used.

AZURE_OPENAI_API_CREDENTIALS=cli

The types are mapped directly to their @azure/identity credential types:

cli - AzureCliCredential
env - EnvironmentCredential
powershell - AzurePowerShellCredential
devcli - AzureDeveloperCliCredential
workloadidentity - WorkloadIdentityCredential
managedidentity - ManagedIdentityCredential

Set NODE_ENV to development to use the DefaultAzureCredential with the GenAIScript.

Custom token scopes

The default token scope for Azure OpenAI access is https://cognitiveservices.azure.com/.default. You can override this value using the AZURE_OPENAI_TOKEN_SCOPES environment variable.

AZURE_OPENAI_TOKEN_SCOPES=...

API Version

GenAIScript maintains a default API version to access Azure OpenAI.

current version: 2025-04-01-preview

You can override this value using the AZURE_OPENAI_API_VERSION environment variable.

AZURE_OPENAI_API_VERSION=2025-01-01-preview

You can also override the API version on a per-deployment basis by settings the AZURE_OPENAI_API_VERSION_<deployment-id> environment variable (where deployment-id is capitalized).

AZURE_OPENAI_API_VERSION_GPT-4O=2025-01-01-preview

API Key

Open your Azure OpenAI resource and navigate to Resource Management, then Keys and Endpoint.

Update the .env file with the secret key (Key 1 or Key 2) and the endpoint.

AZURE_OPENAI_API_KEY=...
AZURE_OPENAI_API_ENDPOINT=https://....openai.azure.com

The rest of the steps are the same: Find the deployment name and use it in your script, model: "azure:deployment-id".

Aliases

The following model aliases are attempted by default in GenAIScript.

Alias	Model identifier

Limitations

Ignore prediction of output tokens