feat(llm): Entra ID auth for the Azure OpenAI backend - #2389
Graphify — looks good
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Details
Graphify reviewed this change.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify review — findings
This PR adds Entra ID (Azure AD) authentication as an alternative to API-key auth for the Azure OpenAI backend in graphify/llm.py. It introduces an AZURE_OPENAI_AUTH_MODE=entra (or aad) option that routes the AzureOpenAI client through a DefaultAzureCredential-based bearer token provider instead of an API key, and updates the key-requirement check and detect_backend to treat Azure as ambiently authenticated in that mode. Supporting changes update the azure extra to include azure-identity, add it to the all extra, extend README docs, and add tests covering the Entra path, credential wiring, and scope.
No blocking issues surfaced. 1 lower-confidence candidate did not survive cross-model review.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 683 functions depend on the 289 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
extract_files_direct()— 16 callers, 20 callees - worse:
detect_backend()— 18 callers, 4 callees - worse:
_azure_client()— 6 callers, 3 callees
Verification — 683 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 471 function(s) in the blast radius were not formally verified this run