microsoft/azure-appconfiguration-py
| Azure App Configuration SDK for Python. Use for centralized configuration management, feature flags, and dynamic settings.
npx skills add https://github.com/microsoft/skills --skill azure-appconfiguration-py
Centralized configuration management with feature flags and dynamic settings.
pip install azure-appconfiguration
AZURE_APPCONFIGURATION_ENDPOINT=https://<name>.azconfig.io # Required for Entra ID auth
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in production
> 🔑 Two rules apply to every code sample below:
>
> 1. Prefer DefaultAzureCredential. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation.
> - Local dev: DefaultAzureCredential works as-is.
> - Production: set AZURE_TOKEN_CREDENTIALS=prod (or AZURE_TOKEN_CREDENTIALS=<specific_credential>) to constrain the credential chain to production-safe credentials.
> 2. Wrap every client in a context manager so HTTP transports, sockets, and token caches are released deterministically:
> - Sync: with <Client>(...) as client:
> - Async: async with <Client>(...) as client: and async with DefaultAzureCredential() as credential: (from azure.identity.aio)
>
> Snippets may abbreviate this setup, but production code should always follow both rules.
import os
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
# Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
credential = DefaultAzureCredential(require_envvar=True)
# Or use a specific credential directly in production:
# See https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
with AzureAppConfigurationClient(
base_url=os.environ["AZURE_APPCONFIGURATION_ENDPOINT"],
credential=credential
) as client:
# Use client here (see following sections for operations)
...
setting = client.get_configuration_setting(key="app:settings:message")
print(f"{setting.key} = {setting.value}")
# Labels allow environment-specific values
setting = client.get_configuration_setting(
key="app:settings:message",
label="production"
)
from azure.appconfiguration import ConfigurationSetting
setting = ConfigurationSetting(
key="app:settings:message",
value="Hello, World!",
label="development",
content_type="text/plain",
tags={"environment": "dev"}
)
client.set_configuration_setting(setting)
client.delete_configuration_setting(
key="app:settings:message",
label="development"
)
settings = client.list_configuration_settings()
for setting in settings:
print(f"{setting.key} [{setting.label}] = {setting.value}")
settings = client.list_configuration_settings(
key_filter="app:settings:*"
)
settings = client.list_configuration_settings(
label_filter="production"
)
from azure.appconfiguration import ConfigurationSetting
import json
feature_flag = ConfigurationSetting(
key=".appconfig.featureflag/beta-feature",
value=json.dumps({
"id": "beta-feature",
"enabled": True,
"conditions": {
"client_filters": []
}
}),
content_type="application/vnd.microsoft.appconfig.ff+json;charset=utf-8"
)
client.set_configuration_setting(feature_flag)
setting = client.get_configuration_setting(
key=".appconfig.featureflag/beta-feature"
)
flag_data = json.loads(setting.value)
print(f"Feature enabled: {flag_data['enabled']}")
flags = client.list_configuration_settings(
key_filter=".appconfig.featureflag/*"
)
for flag in flags:
data = json.loads(flag.value)
print(f"{data['id']}: {'enabled' if data['enabled'] else 'disabled'}")
# Make setting read-only
client.set_read_only(
configuration_setting=setting,
read_only=True
)
# Remove read-only
client.set_read_only(
configuration_setting=setting,
read_only=False
)
from azure.appconfiguration import ConfigurationSnapshot, ConfigurationSettingFilter
snapshot = ConfigurationSnapshot(
name="v1-snapshot",
filters=[
ConfigurationSettingFilter(key="app:*", label="production")
]
)
created = client.begin_create_snapshot(
name="v1-snapshot",
snapshot=snapshot
).result()
settings = client.list_configuration_settings(
snapshot_name="v1-snapshot"
)
from azure.appconfiguration.aio import AzureAppConfigurationClient
from azure.identity.aio import DefaultAzureCredential
async def main():
async with DefaultAzureCredential() as credential:
async with AzureAppConfigurationClient(
base_url=endpoint,
credential=credential
) as client:
setting = await client.get_configuration_setting(key="app:message")
print(setting.value)
| Operation | Description |
|-----------|-------------|
| get_configuration_setting | Get single setting |
| set_configuration_setting | Create or update setting |
| delete_configuration_setting | Delete setting |
| list_configuration_settings | List with filters |
| set_read_only | Lock/unlock setting |
| begin_create_snapshot | Create point-in-time snapshot |
| list_snapshots | List all snapshots |
azure.xxx sync clients with azure.xxx.aio async clients in the same call path. Choose one mode per module.with Client(...) as client: (sync) or async with Client(...) as client: (async). For async DefaultAzureCredential from azure.identity.aio, also use async with credential: so tokens and transports are cleaned up.| File | Contents |
|------|----------|
| references/capabilities.md | Additional non-hero capabilities, operation-group coverage, and production checklists. |
| references/non-hero-scenarios.md | Dedicated non-hero examples for secondary/advanced scenarios. |
Take microsoft/azure-appconfiguration-py from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.
The instructions reference pip.
Without those the skill loads but fails at the first command.