Repository navigation
[FEATURE]: Azure AI Foundry Microsoft Entra (OAuth) authentication #21658
Description
Feature hasn't been suggested before.
- I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
It appears Microsoft Entra authentication with the Azure AI Foundry is not supported yet (or I can't find anything about it 😉).
A customer of ours deployed Anthropic models in an Azure AI Foundry with a custom base URL and provided instructions only for Anthropic CLI. The existing provider relies on an API key, but the customer expressly does not want to provide one to strengthen security and enforces Entra authentication using the Azure CLI instead.
These are the steps they document (not using OpenCode):
export ANTHROPIC_FOUNDRY_BASE_URL=https://their-custom-domain.azure-api.net/ai/anthropicexport CLAUDE_CODE_USE_FOUNDRY="1"az loginto sign in to Azure using Entra Authentication (OAuth).claude run
Steps 1, 2 and 4 appear already possible with OpenCode (#4474 (comment)), but for 3 an API key is expected by OpenCode instead.
They also mention the Azure CLI session can expire every so often (10 hours in their case), in which case az logout followed by az login is required - mentioning it as reauthenticating might be relevant for OpenCode also.
Activity
feat(pulse): include Negotiating leads in pulse-all default scorecard
v1.3.50 — daemon auto-update + stale DO URL purge + venues (#31)
fix(update): iris update now purges stale DO URLs from config (#32)
fix(install): nuke stale bridge — git pull fails silently on client m…
OpeOginni commentedon Jun 16, 2026
Got this PR ready to go, adds OAuth through the az cli #31351
github-actions commentedon Aug 16, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
mkemmerz commentedon Aug 16, 2026
Please reopen - great feature
OpeOginni commentedon Aug 28, 2026
Should work after new release!
NoTuxNoBux commentedon Aug 31, 2026
I'm testing out the new functionality, but still not entirely sure how to configure it for my scenario in the OP. This is the flow I'm seeing now:
PermissionDeniedwithout further details.The customer I'm working for has a bit of a special setup:
https://their-custom-domain.azure-api.net/that seems to forward all calls (so/ai/*) tohttps://their-actual-foundry-swedencentral-001.cognitiveservices.azure.com(so e.g. Claude CLI useshttps://their-custom-domain.azure-api.net/ai/anthropic).validate-azure-ad-tokenset.In other words they don't seem to support directly using the Foundry URL in question and Entra-authenticated calls need to go through a custom URL/domain instead. Is there any way to configure
opencode.jsoncto use the new Entra authentication instead of an API key? The main problem seems to be that I need to be able to enter a fully custom URL (as opposed to just a resource name).OpeOginni commentedon Aug 31, 2026
@NoTuxNoBux are you making use of the Opencode v2?
NoTuxNoBux commentedon Aug 31, 2026
Thanks for the response. I'm not sure what you mean by v2, is that a new in-progress version on the main branch? I'm currently on 1.18.25.
OpeOginni commentedon Aug 31, 2026
No v2 is the new version of clone code coming soon, you can download it here try that an see if it works, it's still wip and should be official in some weeks https://opencode.ai/v2/docs
neriousy commentedon Sep 1, 2026
Yeah, the custom URL stuff probably needs to be set through config. I'll take a look at it later today!