[AZINTS-4591] Introduce Secretless Auth Flag for Azure App Registration Integrations

.generator/schemas/v1/openapi.yaml

@@ -791,6 +791,11 @@ components:
           items:
             $ref: "#/components/schemas/ResourceProviderConfig"
           type: array
+        secretless_auth_enabled:
+          description: |-
+            When enabled, Datadog authenticates with this app registration using federated workload identity credentials instead of a client secret.
+          example: true
+          type: boolean
         tenant_name:
           description: Your Azure Active Directory ID.
           example: "testc44-1234-5678-9101-cc00736ftest"

examples/v1/azure-integration/UpdateAzureHostFilters.py

@@ -30,6 +30,7 @@
             namespace="Microsoft.Compute",
         ),
     ],
+    secretless_auth_enabled=True,
     tenant_name="testc44-1234-5678-9101-cc00736ftest",
     usage_metrics_enabled=True,
 )

examples/v1/azure-integration/UpdateAzureIntegration.py

@@ -21,6 +21,7 @@
     new_client_id="9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
     new_tenant_name="9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
     resource_collection_enabled=True,
+    secretless_auth_enabled=True,
     tenant_name="9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
 )
 

src/datadog_api_client/v1/model/azure_account.py

@@ -38,6 +38,7 @@ def openapi_types(_):
             "new_tenant_name": (str,),
             "resource_collection_enabled": (bool,),
             "resource_provider_configs": ([ResourceProviderConfig],),
+            "secretless_auth_enabled": (bool,),
             "tenant_name": (str,),
             "usage_metrics_enabled": (bool,),
         }
@@ -58,6 +59,7 @@ def openapi_types(_):
         "new_tenant_name": "new_tenant_name",
         "resource_collection_enabled": "resource_collection_enabled",
         "resource_provider_configs": "resource_provider_configs",
+        "secretless_auth_enabled": "secretless_auth_enabled",
         "tenant_name": "tenant_name",
         "usage_metrics_enabled": "usage_metrics_enabled",
     }
@@ -79,6 +81,7 @@ def __init__(
         new_tenant_name: Union[str, UnsetType] = unset,
         resource_collection_enabled: Union[bool, UnsetType] = unset,
         resource_provider_configs: Union[List[ResourceProviderConfig], UnsetType] = unset,
+        secretless_auth_enabled: Union[bool, UnsetType] = unset,
         tenant_name: Union[str, UnsetType] = unset,
         usage_metrics_enabled: Union[bool, UnsetType] = unset,
         **kwargs,
@@ -135,6 +138,9 @@ def __init__(
         :param resource_provider_configs: Configuration settings applied to resources from the specified Azure resource providers.
         :type resource_provider_configs: [ResourceProviderConfig], optional
 
+        :param secretless_auth_enabled: When enabled, Datadog authenticates with this app registration using federated workload identity credentials instead of a client secret.
+        :type secretless_auth_enabled: bool, optional
+
         :param tenant_name: Your Azure Active Directory ID.
         :type tenant_name: str, optional
 
@@ -171,6 +177,8 @@ def __init__(
             kwargs["resource_collection_enabled"] = resource_collection_enabled
         if resource_provider_configs is not unset:
             kwargs["resource_provider_configs"] = resource_provider_configs
+        if secretless_auth_enabled is not unset:
+            kwargs["secretless_auth_enabled"] = secretless_auth_enabled
         if tenant_name is not unset:
             kwargs["tenant_name"] = tenant_name
         if usage_metrics_enabled is not unset:

tests/v1/cassettes/test_scenarios/test_delete_an_azure_integration_returns_ok_response.frozen

@@ -1 +1 @@
-2024-12-17T21:43:00.678Z
+2026-05-04T13:56:51.846Z

tests/v1/cassettes/test_scenarios/test_delete_an_azure_integration_returns_ok_response.yaml

@@ -1,6 +1,6 @@
 interactions:
 - request:
-    body: '{"app_service_plan_filters":"key:value,filter:example","automute":true,"client_id":"17344717-0000-0000-0000-173447178000","client_secret":"TestingRh2nx664kUy5dIApvM54T4AtO","container_app_filters":"key:value,filter:example","cspm_enabled":true,"custom_metrics_enabled":true,"errors":["*"],"host_filters":"key:value,filter:example","metrics_enabled":true,"metrics_enabled_default":true,"new_client_id":"17344717-0000-0000-0000-173447178000","new_tenant_name":"17344717-0000-0000-0000-173447178000","resource_collection_enabled":true,"resource_provider_configs":[{"metrics_enabled":false,"namespace":"Microsoft.Compute"},{"metrics_enabled":false,"namespace":"Microsoft.Web"}],"tenant_name":"17344717-0000-0000-0000-173447178000","usage_metrics_enabled":true}'
+    body: '{"app_service_plan_filters":"key:value,filter:example","automute":true,"client_id":"17779030-0000-0000-0000-177790301100","client_secret":"TestingRh2nx664kUy5dIApvM54T4AtO","container_app_filters":"key:value,filter:example","cspm_enabled":true,"custom_metrics_enabled":true,"errors":["*"],"host_filters":"key:value,filter:example","metrics_enabled":true,"metrics_enabled_default":true,"new_client_id":"17779030-0000-0000-0000-177790301100","new_tenant_name":"17779030-0000-0000-0000-177790301100","resource_collection_enabled":true,"resource_provider_configs":[{"metrics_enabled":false,"namespace":"Microsoft.Compute"},{"metrics_enabled":false,"namespace":"Microsoft.Web"}],"secretless_auth_enabled":false,"tenant_name":"17779030-0000-0000-0000-177790301100","usage_metrics_enabled":true}'
     headers:
       accept:
       - application/json
@@ -20,7 +20,7 @@ interactions:
       code: 200
       message: OK
 - request:
-    body: '{"client_id":"17344717-0000-0000-0000-173447178000","tenant_name":"17344717-0000-0000-0000-173447178000"}'
+    body: '{"client_id":"17779030-0000-0000-0000-177790301100","tenant_name":"17779030-0000-0000-0000-177790301100"}'
     headers:
       accept:
       - application/json
@@ -40,7 +40,7 @@ interactions:
       code: 200
       message: OK
 - request:
-    body: '{"client_id":"17344717-0000-0000-0000-173447178000","tenant_name":"17344717-0000-0000-0000-173447178000"}'
+    body: '{"client_id":"17779030-0000-0000-0000-177790301100","tenant_name":"17779030-0000-0000-0000-177790301100"}'
     headers:
       accept:
       - application/json

tests/v1/cassettes/test_scenarios/test_update_an_azure_integration_returns_ok_response.frozen

@@ -1 +1 @@
-2024-12-17T21:43:01.129Z
+2026-05-04T13:56:52.686Z

tests/v1/cassettes/test_scenarios/test_update_an_azure_integration_returns_ok_response.yaml

@@ -1,6 +1,6 @@
 interactions:
 - request:
-    body: '{"app_service_plan_filters":"key:value,filter:example","automute":true,"client_id":"17344717-0000-0000-0000-173447178100","client_secret":"TestingRh2nx664kUy5dIApvM54T4AtO","container_app_filters":"key:value,filter:example","cspm_enabled":true,"custom_metrics_enabled":true,"errors":["*"],"host_filters":"key:value,filter:example","metrics_enabled":true,"metrics_enabled_default":true,"new_client_id":"17344717-0000-0000-0000-173447178100","new_tenant_name":"17344717-0000-0000-0000-173447178100","resource_collection_enabled":true,"resource_provider_configs":[{"metrics_enabled":false,"namespace":"Microsoft.Compute"},{"metrics_enabled":false,"namespace":"Microsoft.Web"}],"tenant_name":"17344717-0000-0000-0000-173447178100","usage_metrics_enabled":true}'
+    body: '{"app_service_plan_filters":"key:value,filter:example","automute":true,"client_id":"17779030-0000-0000-0000-177790301200","client_secret":"TestingRh2nx664kUy5dIApvM54T4AtO","container_app_filters":"key:value,filter:example","cspm_enabled":true,"custom_metrics_enabled":true,"errors":["*"],"host_filters":"key:value,filter:example","metrics_enabled":true,"metrics_enabled_default":true,"new_client_id":"17779030-0000-0000-0000-177790301200","new_tenant_name":"17779030-0000-0000-0000-177790301200","resource_collection_enabled":true,"resource_provider_configs":[{"metrics_enabled":false,"namespace":"Microsoft.Compute"},{"metrics_enabled":false,"namespace":"Microsoft.Web"}],"secretless_auth_enabled":false,"tenant_name":"17779030-0000-0000-0000-177790301200","usage_metrics_enabled":true}'
     headers:
       accept:
       - application/json
@@ -20,7 +20,7 @@ interactions:
       code: 200
       message: OK
 - request:
-    body: '{"app_service_plan_filters":"key:value,filter:example","automute":true,"client_id":"17344717-0000-0000-0000-173447178100","client_secret":"TestingRh2nx664kUy5dIApvM54T4AtO","container_app_filters":"key:value,filter:example","cspm_enabled":true,"custom_metrics_enabled":true,"errors":["*"],"host_filters":"key:value,filter:example","new_client_id":"17344717-0000-0000-0000-173447178100","new_tenant_name":"17344717-0000-0000-0000-173447178100","resource_collection_enabled":true,"tenant_name":"17344717-0000-0000-0000-173447178100"}'
+    body: '{"app_service_plan_filters":"key:value,filter:example","automute":true,"client_id":"17779030-0000-0000-0000-177790301200","client_secret":"TestingRh2nx664kUy5dIApvM54T4AtO","container_app_filters":"key:value,filter:example","cspm_enabled":true,"custom_metrics_enabled":true,"errors":["*"],"host_filters":"key:value,filter:example","new_client_id":"17779030-0000-0000-0000-177790301200","new_tenant_name":"17779030-0000-0000-0000-177790301200","resource_collection_enabled":true,"secretless_auth_enabled":true,"tenant_name":"17779030-0000-0000-0000-177790301200"}'
     headers:
       accept:
       - application/json
@@ -40,7 +40,7 @@ interactions:
       code: 200
       message: OK
 - request:
-    body: '{"client_id":"17344717-0000-0000-0000-173447178100","tenant_name":"17344717-0000-0000-0000-173447178100"}'
+    body: '{"client_id":"17779030-0000-0000-0000-177790301200","tenant_name":"17779030-0000-0000-0000-177790301200"}'
     headers:
       accept:
       - application/json

tests/v1/features/azure_integration.feature

@@ -12,7 +12,7 @@ Feature: Azure Integration
   @generated @skip @team:DataDog/azure-integrations
   Scenario: Create an Azure integration returns "Bad Request" response
     Given new "CreateAzureIntegration" request
-    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
+    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "secretless_auth_enabled": true, "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
     When the request is sent
     Then the response status is 400 Bad Request
 
@@ -26,7 +26,7 @@ Feature: Azure Integration
   @generated @skip @team:DataDog/azure-integrations
   Scenario: Delete an Azure integration returns "Bad Request" response
     Given new "DeleteAzureIntegration" request
-    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
+    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "secretless_auth_enabled": true, "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
     When the request is sent
     Then the response status is 400 Bad Request
 
@@ -53,28 +53,28 @@ Feature: Azure Integration
   @generated @skip @team:DataDog/azure-integrations
   Scenario: Update Azure integration host filters returns "Bad Request" response
     Given new "UpdateAzureHostFilters" request
-    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
+    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "secretless_auth_enabled": true, "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
     When the request is sent
     Then the response status is 400 Bad Request
 
   @generated @skip @team:DataDog/azure-integrations
   Scenario: Update Azure integration host filters returns "OK" response
     Given new "UpdateAzureHostFilters" request
-    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
+    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "secretless_auth_enabled": true, "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
     When the request is sent
     Then the response status is 200 OK
 
   @generated @skip @team:DataDog/azure-integrations
   Scenario: Update an Azure integration returns "Bad Request" response
     Given new "UpdateAzureIntegration" request
-    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
+    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "testc7f6-1234-5678-9101-3fcbf464test", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "metrics_enabled": true, "metrics_enabled_default": true, "new_client_id": "new1c7f6-1234-5678-9101-3fcbf464test", "new_tenant_name": "new1c44-1234-5678-9101-cc00736ftest", "resource_collection_enabled": true, "resource_provider_configs": [{"metrics_enabled": true, "namespace": "Microsoft.Compute"}], "secretless_auth_enabled": true, "tenant_name": "testc44-1234-5678-9101-cc00736ftest", "usage_metrics_enabled": true}
     When the request is sent
     Then the response status is 400 Bad Request
 
   @team:DataDog/azure-integrations
   Scenario: Update an Azure integration returns "OK" response
     Given there is a valid "azure_account" in the system
     And new "UpdateAzureIntegration" request
-    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "{{ uuid }}", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "new_client_id": "{{ uuid }}", "new_tenant_name": "{{ uuid }}", "resource_collection_enabled": true, "tenant_name": "{{ uuid }}"}
+    And body with value {"app_service_plan_filters": "key:value,filter:example", "automute": true, "client_id": "{{ uuid }}", "client_secret": "TestingRh2nx664kUy5dIApvM54T4AtO", "container_app_filters": "key:value,filter:example", "cspm_enabled": true, "custom_metrics_enabled": true, "errors": ["*"], "host_filters": "key:value,filter:example", "new_client_id": "{{ uuid }}", "new_tenant_name": "{{ uuid }}", "resource_collection_enabled": true, "secretless_auth_enabled": true, "tenant_name": "{{ uuid }}"}
     When the request is sent
     Then the response status is 200 OK