When neither ANTHROPIC_FOUNDRY_API_KEY nor ANTHROPIC_FOUNDRY_AUTH_TOKEN is set, Claude Code automatically uses the Azure SDK default credential chain.
This supports a variety of methods for authenticating local and remote workloads.
On local environments, you commonly may use the Azure CLI:
az login
Option C: Bearer token authentication
{/* min-version: 2.1.203 */}Claude Code sends the value of ANTHROPIC_FOUNDRY_AUTH_TOKEN on every request as the Authorization: Bearer header. Use this option when another process, such as a host application or a sign-in script, has already obtained an access token for you. Requires Claude Code v2.1.203 or later.
Set the variable to a bearer token that Microsoft Entra ID issued for your resource:
ANTHROPIC_FOUNDRY_AUTH_TOKEN takes precedence over ANTHROPIC_FOUNDRY_API_KEY and over the default credential chain.
3. Configure Claude Code
Set the following environment variables to enable Microsoft Foundry:
# Enable Microsoft Foundry integrationexport CLAUDE_CODE_USE_FOUNDRY=1# Azure resource name (replace {resource} with your resource name)export ANTHROPIC_FOUNDRY_RESOURCE={resource}
# Or provide the full base URL:# export ANTHROPIC_FOUNDRY_BASE_URL=https://{resource}.services.ai.azure.com/anthropic
4. Pin model versions
Set the model variables to match the deployment names you created in step 1.
Without ANTHROPIC_DEFAULT_OPUS_MODEL, the opus alias on Microsoft Foundry resolves to Opus 4.6. Set it to the Opus 4.8 ID to use the latest model:
Background tasks such as session title generation use the small/fast model, normally a Haiku-class model. On Microsoft Foundry, Claude Code defaults this to the primary model because not every account has a Haiku deployment. To use Haiku for background tasks, set ANTHROPIC_DEFAULT_HAIKU_MODEL to a Haiku deployment that is available in your account, as shown above.
Prompt caching is enabled automatically. To request a 1-hour cache TTL instead of the 5-minute default, set the following variable; cache writes with a 1-hour TTL are billed at a higher rate:
export ENABLE_PROMPT_CACHING_1H=1
5. Run Claude Code
With the environment variables set, start Claude Code from your project directory:
claude
Claude Code reads CLAUDE_CODE_USE_FOUNDRY and the other Microsoft Foundry variables from the environment and connects to your Azure resource on the first prompt. Unlike Amazon Bedrock and Google Cloud's Agent Platform, Microsoft Foundry has no interactive setup wizard, so the environment variables in steps 3 and 4 are the only configuration path.
Azure RBAC configuration
The Azure AI User and Cognitive Services User default roles include all required permissions for invoking Claude models.
For more restrictive permissions, create a custom role with the following:
108Claude Code supports two authentication methods for Microsoft Foundry. Choose the method that best fits your security requirements.108Claude Code supports three authentication methods for Microsoft Foundry. Choose the method that best fits your security requirements.
109109
110**Option A: API key authentication**110**Option A: API key authentication**
111111
120120
121**Option B: Microsoft Entra ID authentication**121**Option B: Microsoft Entra ID authentication**
122122
123When `ANTHROPIC_FOUNDRY_API_KEY` isnot set, Claude Code automatically uses the Azure SDK [default credential chain](https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#defaultazurecredential-overview).123When neither `ANTHROPIC_FOUNDRY_API_KEY` nor`ANTHROPIC_FOUNDRY_AUTH_TOKEN`is set, Claude Code automatically uses the Azure SDK [default credential chain](https://learn.microsoft.com/en-us/azure/developer/javascript/sdk/authentication/credential-chains#defaultazurecredential-overview).
124This supports a variety of methods for authenticating local and remote workloads.124This supports a variety of methods for authenticating local and remote workloads.
125125
126On local environments, you commonly may use the Azure CLI:126On local environments, you commonly may use the Azure CLI:
129az login129az login
130```130```
131131
132**Option C: Bearer token authentication**
133
134{/* min-version: 2.1.203 */}Claude Code sends the value of `ANTHROPIC_FOUNDRY_AUTH_TOKEN` on every request as the `Authorization: Bearer` header. Use this option when another process, such as a host application or a sign-in script, has already obtained an access token for you. Requires Claude Code v2.1.203 or later.
135
136Set the variable to a bearer token that Microsoft Entra ID issued for your resource:
142`ANTHROPIC_FOUNDRY_AUTH_TOKEN` takes precedence over `ANTHROPIC_FOUNDRY_API_KEY` and over the default credential chain.
143
132<Note>144<Note>
133 When using Microsoft Foundry, the `/logout` command is unavailable since authentication is handled through Azure credentials.145 When using Microsoft Foundry, the `/logout` command is unavailable since authentication is handled through Azure credentials.
