Credentials

Introduction

The LocalStack Azure emulator implements the Azure authentication endpoints, but it doesn’t check credentials. It accepts any service principal and secret, and it has a single subscription in a single tenant. You can therefore run the same code against the emulator and against Azure, without a real Microsoft Entra tenant.

Keep two kinds of credentials apart:

• Your LocalStack Auth Token is a real credential that licenses the emulator. Keep it secret. For more information, see Auth Token.
• The Azure credentials on this page are placeholders that only the emulator accepts. They aren’t secret, and they don’t work with Azure.

Subscription and tenant

Setting	Value
Subscription ID	00000000-0000-0000-0000-000000000000
Subscription name	Emulated Azure Subscription by LocalStack
Tenant ID	00000000-0000-0000-0000-000000000000
Client ID	Any value, for example any-app
Client secret	Any value, for example dummy

To check these values with the Azure CLI, run the following commands:

lstk az start-interception
az account show

Output

{
  "environmentName": "LocalStack",
  "homeTenantId": "00000000-0000-0000-0000-000000000000",
  "id": "00000000-0000-0000-0000-000000000000",
  "isDefault": true,
  "managedByTenants": [],
  "name": "Emulated Azure Subscription by LocalStack",
  "state": "Enabled",
  "tenantId": "00000000-0000-0000-0000-000000000000",
  "user": {
    "name": "any-app",
    "type": "servicePrincipal"
  }
}

lstk az start-interception signs the Azure CLI in as the service principal any-app.

Endpoints

The emulator describes its endpoints in a metadata document at /metadata/endpoints. Tools such as Terraform and Pulumi read them from there when you give them the metadata host:

Endpoint	Value
Metadata host	azure.localhost.localstack.cloud:4566
Azure Resource Manager	https://azure.localhost.localstack.cloud:4566
Microsoft Entra ID authority	https://azure.localhost.localstack.cloud:4566
Storage endpoint suffix	core.azure.localhost.localstack.cloud:4566
Key Vault DNS suffix	vault.azure.localhost.localstack.cloud:4566

lstk az start-interception registers the same values as the LocalStack cloud of the Azure CLI:

az cloud show --name LocalStack \
  --query "{resourceManager: endpoints.resourceManager, authority: endpoints.activeDirectory, \
            storageSuffix: suffixes.storageEndpoint, keyVaultSuffix: suffixes.keyvaultDns}"

Output

{
  "authority": "https://azure.localhost.localstack.cloud:4566",
  "keyVaultSuffix": ".vault.azure.localhost.localstack.cloud:4566",
  "resourceManager": "https://azure.localhost.localstack.cloud:4566/",
  "storageSuffix": "core.azure.localhost.localstack.cloud:4566"
}

The public DNS resolves localhost.localstack.cloud and all its subdomains to 127.0.0.1. Host names for individual resources, such as mystorageaccount.blob.core.azure.localhost.localstack.cloud, therefore work without entries in your hosts file.

Configure your tools

Tool	What it needs
Azure CLI	lstk az start-interception, which signs in for you
Azure PowerShell	Add-AzEnvironment with the emulator’s endpoints, and DisableInstanceDiscovery
Azure SDK for Python	The PythonLocalSdk helper from the azlocal package
ARM templates and Bicep	The Azure CLI, after lstk az start-interception
Terraform	metadata_host and the all-zero subscription_id in the azurerm provider, and the Azure CLI sign-in from lstk az start-interception
Pulumi	metadataHost and disableInstanceDiscovery in the azure-native provider
Azure Developer CLI	The azdlocal wrapper from the azlocal package

Caution

Some tools ask Microsoft Entra ID to validate the authority before they request a token. This step is called instance discovery. Microsoft Entra ID doesn’t know the emulator’s authority, so the check fails or waits for a timeout, and sign-in fails or seems to hang. Turn the check off with disableInstanceDiscovery in Pulumi and DisableInstanceDiscovery in Azure PowerShell.

Managed identities

Applications that run in the emulator, such as Web Apps and Function Apps, can use managed identities to access other services. For working examples, see the following samples:

• Web App on AKS with Managed Identities (Python, .NET)
• Web App on App Services with Managed Identities (Python, .NET)
• Function App with Managed Identities (Python)

For more information, see Managed Identity.