Pulumi Blog: Azure native

Azure Native 3.8: Unified Credentials and Private Clouds

Eron Wright — Thu, 04 Sep 2025 12:00:00 -0700

Today we’re excited to announce Azure Native Provider v3.8, featuring several enhancements that simplify authentication and extend support to private Azure environments. These updates make it easier than ever to manage Azure infrastructure using credentials provided by the hosting environment, such as in Azure Kubernetes Service (AKS), Azure VM, and Azure Cloud Shell.

Simplified Authentication Across Environments

The highlight of this release is a new authentication mode based on DefaultAzureCredential, a feature of the Azure SDK that unifies authentication-related settings across deployment environments.

What’s New

DefaultAzureCredential automatically discovers and uses the best available authentication method for your environment, eliminating the need for an environment-specific configuration. It follows the Azure SDK’s standard credential chain:

Order	Credential	Description
1	Environment	Reads environment variables (e.g., `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`) to authenticate as a service principal.
2	Workload Identity	For programs run on an Azure Kubernetes Service (AKS) cluster.
3	Managed Identity	For programs deployed to an Azure compute resource (e.g., Azure Virtual Machines) or App hosting platform.
4	Azure CLI	For local development using Azure CLI’s `az login` command.
5	Azure Developer CLI	For local development using Azure Developer CLI’s `azd auth login` command.

Real-World Benefits

This means your Pulumi programs can now run seamlessly across:

Local development machines using Azure CLI credentials
CI/CD pipelines with service principals via environment variables
Azure Kubernetes Service with Workload Identity
Azure VMs and App Services with Managed Identity

All without changing a single line of configuration code.

Getting Started

Enable DefaultAzureCredential using Pulumi configuration:

pulumi config set azure-native:useDefaultAzureCredential true
pulumi config set azure-native:subscriptionId <your-subscription-id>

Note that subscriptionId is a required configuration setting in this (and most) authentication modes; it ensures your resources are deployed to the correct Azure subscription.

Private Azure Cloud Support

This release brings improved support for Azure private clouds. A private cloud is a dedicated cloud computing environment used by a single organization.

The provider can now automatically discover, and configure itself for, any Azure cloud based on the ARM_METADATA_HOSTNAME environment variable. Note that this takes precedence over the ARM_ENVIRONMENT variable.

How To Use

The provider can query the Azure metadata service to automatically configure itself for your specific Azure environment:

# Using environment variable
export ARM_METADATA_HOSTNAME=management.azure.example

# Or via Pulumi configuration
pulumi config set azure-native:metadataHost management.azure.example

The provider expects the 2022-09-01 metadata schema, which resembles:

{
 "authentication": {
 "loginEndpoint": "https://login.microsoftonline.com",
 "audiences": [
 "https://management.core.windows.net/",
 "https://management.azure.com/"
 ]
 },
 "name": "AzureCloud",
 "suffixes": {
 "keyVaultDns": "vault.azure.net",
 "storage": "core.windows.net"
 },
 "resourceManager": "https://management.azure.com/",
 "microsoftGraphResourceId": "https://graph.microsoft.com/"
}

The provider automatically retrieves the correct endpoints for authentication, resource management, and other services.

Disabling Instance Discovery

Also in this release is a new setting, disableInstanceDiscovery, to determine whether the provider requests Microsoft Entra instance metadata from the login endpoint (https://login.microsoftonline.com) before authenticating. This setting is for Pulumi programs authenticating in disconnected clouds or private clouds.

Setting disableInstanceDiscovery to true will completely disable both instance discovery and authority validation. Please ensure that the configured authority host is valid and trustworthy.

How To Use

The provider can be configured to disable instance discovery:

# Using environment variable
export ARM_DISABLE_INSTANCE_DISCOVERY=true

# Or via Pulumi configuration
pulumi config set azure-native:disableInstanceDiscovery true

Authentication in AKS with Workload Identity

For programs run in a pod on an Azure Kubernetes Service (AKS) cluster, DefaultAzureCredential automatically uses the workload identity of the pod’s service account. This workload identity could then be granted roles in Azure to deploy stack resources.

Ensure that the application pods using workload identity include the label azure.workload.identity/use: "true" in the pod spec.

Walkthrough

Let’s use Pulumi Kubernetes Operator (PKO) to demonstrate a use case where you’d run Pulumi deployment operations in a pod and could benefit from workload identity.

The operator allocates a dedicated pod for each Pulumi stack under its management, to serve as the execution environment for stack operations. Each stack may use the same or a different service account. With AKS, that service account has a workload identity that providers may use to authenticate to Azure cloud and even to Pulumi cloud.

Create an AKS Cluster

Please follow the steps in “Deploy and configure workload identity on an Azure Kubernetes Service (AKS) cluster” to create an AKS cluster, managed identity, and Kubernetes service account. Those steps are:

You now have an Azure managed identity and associated Kubernetes service account that DefaultAzureCredential can use to authenticate to Azure cloud.

Take note of the clientId that represents the managed identity:

az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" --query clientId
"c2bbe0f5-6349-480a-9f6f-3a5cb3e4ecf9"

Install the Pulumi Kubernetes Operator

Install the operator into the pulumi-kubernetes-operator namespace:

kubectl apply -f https://raw.githubusercontent.com/pulumi/pulumi-kubernetes-operator/refs/tags/v2.0.0/deploy/quickstart/install.yaml

Configure a Pulumi Cloud Access Token

By default, the operator uses Pulumi Cloud as the state backend for your stacks. Please create a Secret containing a Pulumi access token to be used to authenticate to Pulumi Cloud. Follow these instructions to create a personal, organization, or team access token.

kubectl create secret generic -n ${SERVICE_ACCOUNT_NAMESPACE} pulumi-api-secret --from-literal=accessToken=${PULUMI_ACCESS_TOKEN}

Update the Kubernetes Service Account

To use the service account that was created earlier, we need to grant it the system:auth-delegator role:

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 name: "${SERVICE_ACCOUNT_NAMESPACE}-${SERVICE_ACCOUNT_NAME}:system:auth-delegator"
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: system:auth-delegator
subjects:
- kind: ServiceAccount
 name: "${SERVICE_ACCOUNT_NAME}"
 namespace: "${SERVICE_ACCOUNT_NAMESPACE}"
EOF

Define an Example Program

Let’s define a simple Pulumi program that uses Azure Native 3.8 and calls the “getClientConfig” function to access the current identity of the provider.

cat <<"EOF" | kubectl apply -n ${SERVICE_ACCOUNT_NAMESPACE} -f -
apiVersion: pulumi.com/v1
kind: Program
metadata:
 name: sample-workload-identity
program:
 variables:
 clientConfig:
 fn::invoke:
 function: azure-native:authorization:getClientConfig
 clientToken:
 fn::secret:
 fn::invoke:
 function: azure-native:authorization:getClientToken
 outputs:
 clientConfig: ${clientConfig}
 clientToken: ${clientToken}
EOF

Run the Program using Workload Identity

Create a Stack object to run the Pulumi program using your service account and with azure-native:useDefaultAzureCredential enabled.

cat <<EOF | kubectl apply -f -
apiVersion: pulumi.com/v1
kind: Stack
metadata:
 name: sample-workload-identity
 namespace: "${SERVICE_ACCOUNT_NAMESPACE}"
spec:
 programRef:
 name: sample-workload-identity
 stack: sample-workload-identity
 envRefs:
 PULUMI_ACCESS_TOKEN:
 type: Secret
 secret:
 name: pulumi-api-secret
 key: accessToken
 serviceAccountName: "${SERVICE_ACCOUNT_NAME}"
 config:
 azure-native:useDefaultAzureCredential: "true"
 azure-native:subscriptionId: "${SUBSCRIPTION}"
 workspaceTemplate:
 spec:
 podTemplate:
 metadata:
 labels:
 azure.workload.identity/use: "true"
EOF

Checking the stack outputs, we see a clientId matching that of the managed identity!

kubectl get stack/sample-workload-identity -oyaml

apiVersion: pulumi.com/v1
kind: Stack
metadata:
 name: sample-workload-identity
 namespace: default
status:
 conditions:
 - lastTransitionTime: "2025-09-04T23:32:11Z"
 message: the stack has been processed and is up to date
 reason: ProcessingCompleted
 status: "True"
 type: Ready
 outputs:
 clientConfig:
 clientId: c2bbe0f5-6349-480a-9f6f-3a5cb3e4ecf9
 objectId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 subscriptionId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 tenantId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 clientToken: '[secret]'

Conclusion

Azure Native Provider v3.8 represents our commitment to making Azure infrastructure management work seamlessly across all deployment scenarios, from local development to production, from public cloud to private cloud.

Have questions or feedback? Open an issue on GitHub or join the conversation in our Community Slack (#azure channel).

Azure Native V3: A Leaner, Faster SDK for Microsoft Azure

Thomas Kappler — Thu, 03 Apr 2025 00:00:00 +0000

Pulumi Azure Native V3 is the most comprehensive infrastructure as code (IaC) solution for Microsoft Azure, combining full resource coverage with dramatic improvements in performance and developer experience.

With V3, the Pulumi Azure Native SDK is 75% smaller while maintaining 100% coverage of the Azure Resource Manager (ARM) API. This makes it the most efficient and complete way to define and manage Azure infrastructure with real programming languages.

Pulumi Azure Native provides direct access to the Azure Resource Manager API, making it hands-down the best infrastructure as code solution for Microsoft Azure. Unlike traditional providers that abstract away cloud APIs, Azure Native gives you more resource and property coverage compared to Terraform by directly mapping to Azure’s native REST API. This means:

Complete API coverage: Access every Azure resource available in ARM
Same-day updates: New Azure services and properties are available immediately
Advanced property support: Work with every resource property, not just a subset
Latest API versions: Always up to date with the newest stable Azure APIs

And with V3’s slimmer SDK footprint, developers benefit from faster IDE performance, reduced memory usage, quicker installs, and improved CI/CD pipeline efficiency.

These improvements came about through our RFC process, where we explored various options to balance SDK size with the flexibility needed by advanced users.

A Slimmer, More Efficient SDK

The most significant improvement in Azure Native V3 is the dramatic 75% reduction in SDK size across all languages. By optimizing the SDK to include only the default API versions, we’ve solved one of the main pain points reported by our users, the size of the package:

Language	Before	After	Reduction
.NET	77 MB	15 MB	80.5%
JS/TS	494 MB	87 MB	82.4%
Python	104.6 MB	25 MB	76.3%
Go (source)	910 MB	167 MB	81.6%
Java (explicit versions were not supported in v2)	68 MB	71 MB	+4.4%
YAML	no SDK	no SDK	-

This transformation delivers immediate benefits that every developer will notice: faster IDE performance with reduced load times, more responsive language servers for better autocompletion, reduced memory consumption, significantly quicker package installation, and improved CI/CD pipeline performance.

Additional Enhancements in Azure Native V3

Azure Native V3 introduces more than just SDK size optimization. Other improvements include:

Reorganized module structure better aligned with Azure SDK conventions
Improved resource naming for clearer distinction between similar resources
Enhanced handling of nested properties to avoid accidental overwriting
Better state management with the removal of unnecessary __inputs fields (most noticeable with large stacks)

Understanding Azure Versioning

The Pulumi Azure Native provider needs to manage two different versioning systems:

Pulumi’s Semantic Versioning: Our SDKs follow the traditional major.minor.patch format (e.g., 3.0.0)
- Patch versions (3.0.1) contain bug fixes only
- Minor versions (3.1.0) add new resources and non-breaking features
- Major versions (3.0.0) may contain breaking changes
Azure’s Date-based API Versions: Azure resources use date-based versions like “2024-01-01” or “2023-05-15-preview”
- Each Azure service (resource provider) has its own set of API versions
- Breaking changes can occur between different API versions
- Preview versions (with “-preview” suffix) contain newer features that may not be stable yet

Default API Versions

Azure Native V3 includes refreshed default API versions across nearly all resources, ensuring you’re automatically working with the latest stable Azure features and capabilities without any extra configuration. The new default versions unlock powerful new Azure functionality out of the box, such as:

EventGrid (now 2025-02-15): Support for advanced filtering, dead-lettering, and custom event schemas
MachineLearningServices (now 2024-10-01): Enhanced compute instance capabilities and new model deployment options
Storage (now 2024-01-01): Improved performance tiers and expanded security features
KeyVault (now 2024-03-01): Enhanced certificate management and expanded access policy options

Using Non-Default API Versions

Most users (approximately 95% based on our Pulumi Cloud data) will be perfectly served by these default API versions. However, there are situations where you might need to use a specific API version.

For these cases, Azure Native V3 provides two flexible approaches:

Option 1: Accessing Explicit API Versions via Local Packages

The most type-safe way to use explicit API versions is through local packages. This approach gives you the full SDK experience with strong typing, auto-completion, and documentation.

Add the specific API version package

Use the Pulumi CLI to add just the packages and versions you need:

pulumi package add azure-native storage v20240101

For more details on the package add command, see the CLI documentation.

Step 2: Import and use the versioned package

Once added, you can import and use the specific API version in your code:

import * as resources from "@pulumi/azure-native/resources";
import * as storage_v20240101 from "@pulumi/azure-native_storage_v20240101";

const resourceGroup = new resources.ResourceGroup("resourceGroup");

const storageAccount = new storage_v20240101.storage.StorageAccount("sa", {
 resourceGroupName: resourceGroup.name,
 sku: {
 name: storage_v20240101.storage.SkuName.Standard_LRS,
 },
 kind: storage_v20240101.storage.Kind.StorageV2,
});

import pulumi
from pulumi_azure_native import resources
import pulumi_azure_native_storage_v20240101 as storage_v20240101

resource_group = resources.ResourceGroup("resource_group")

storage_account = storage_v20240101.storage.StorageAccount("sa",
 resource_group_name=resource_group.name,
 sku=storage_v20240101.storage.SkuArgs(
 name=storage_v20240101.storage.SkuName.STANDARD_LRS,
 ),
 kind=storage_v20240101.storage.Kind.STORAGE_V2)

using Pulumi;
using Pulumi.AzureNative.Resources;
using Storage_v20240101 = Pulumi.AzureNative_Storage_v20240101;

class MyStack : Stack
{
 public MyStack()
 {
 var resourceGroup = new ResourceGroup("resourceGroup");

 var storageAccount = new Storage_v20240101.Storage.StorageAccount("sa", new()
 {
 ResourceGroupName = resourceGroup.Name,
 Sku = new Storage_v20240101.Storage.SkuArgs
 {
 Name = Storage_v20240101.Storage.SkuName.Standard_LRS,
 },
 Kind = Storage_v20240101.Storage.Kind.StorageV2,
 });
 }
}

package main

import (
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 "github.com/pulumi/pulumi-azure-native/sdk/go/azure/resources"
 storage_v20240101 "github.com/pulumi-azure-native-storage-v20240101/sdk/go/azure/storage"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {
 resourceGroup, err := resources.NewResourceGroup(ctx, "resourceGroup", nil)
 if err != nil {
 return err
 }

 storageAccount, err := storage_v20240101.NewStorageAccount(ctx, "sa", &storage_v20240101.StorageAccountArgs{
 ResourceGroupName: resourceGroup.Name,
 Sku: &storage_v20240101.SkuArgs{
 Name: storage_v20240101.SkuNameStandard_LRS,
 },
 Kind: storage_v20240101.KindStorageV2,
 })
 if err != nil {
 return err
 }

 return nil
 })
}

name: azure-native-example
runtime: yaml
description: A minimal Azure Native Pulumi YAML program
resources:
 resourceGroup:
 type: azure-native:resources:ResourceGroup
 properties:
 location: westus2

 # Using specific API version package
 storageAccount:
 type: azure-native_storage_v20240101:storage:StorageAccount
 properties:
 resourceGroupName: ${resourceGroup.name}
 sku:
 name: Standard_LRS
 kind: StorageV2

package myproject;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.azurenative.resources.ResourceGroup;
import com.pulumi.azurenative.resources.ResourceGroupArgs;
import com.pulumi.azurenative_storage_v20240101.storage.StorageAccount;
import com.pulumi.azurenative_storage_v20240101.storage.StorageAccountArgs;
import com.pulumi.azurenative_storage_v20240101.storage.enums.Kind;
import com.pulumi.azurenative_storage_v20240101.storage.enums.SkuName;
import com.pulumi.azurenative_storage_v20240101.storage.inputs.SkuArgs;

public class App {
 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }

 private static void stack(Context ctx) {
 var resourceGroup = new ResourceGroup("resourceGroup");

 var storageAccount = new StorageAccount("sa", StorageAccountArgs.builder()
 .resourceGroupName(resourceGroup.name())
 .sku(SkuArgs.builder()
 .name(SkuName.Standard_LRS)
 .build())
 .kind(Kind.StorageV2)
 .build());
 }
}

Option 2: Using the Generic Resource

An alternative approach is to use the generic azure-native.resources.Resource. This special resource allows you to access any Azure resource at any API version, including older versions that might not be available through local packages.

While not as type-safe as the local package approach, the generic resource offers maximum flexibility and is useful when you need to access a resource that is not yet supported by the Pulumi provider or when an issue prevents you from using a specific resource.

In most cases, we recommend using the local packages approach when you need a specific API version, and only falling back to the generic resource for special cases or resources not yet supported by the Pulumi provider.

For more details, see the Azure Native version guide.

Getting Started with Azure Native V3

If You’re Already Using Pulumi Azure Native

Upgrading ensures you benefit from the smaller SDK, refreshed defaults, and the best performance when managing Azure at scale.

Upgrading from v2: Follow the v2 to v3 migration guide.
Upgrading from v1: First move to v2 using our v1 to v2 upgrade guide, the follow the v2 to v3 migration guide. This two-step process resolves deprecation warnings and ensures a smoother migration.

For language-specific installation instructions, see our Azure Native setup guide.

If You’re New to Pulumi

Pulumi makes it easy to define, deploy, and manage Azure infrastructure using your favorite programming languages. To get started:

Sign up for Pulumi Cloud - free for individuals and teams.
Explore the Azure Native installation guide.
Try a quickstart project to provision real Azure resources in minutes.

Conclusion

Pulumi Azure Native V3 is the most complete and efficient solution for managing Azure infrastructure as code. With a dramatically smaller SDK, updated defaults, flexible API versioning, and enhanced developer experience, it offers the best combination of performance, coverage, and control for Microsoft Azure users.

We’d like to thank our community for their valuable feedback throughout the development of V3. Your input helped shape this release, and we’re excited to see what you’ll build with it.

Have questions or suggestions? Open an issue on GitHub, join our Community Slack.