{
  "schema_version": 2,
  "id": "develop/clients/redis-py/amr",
  "title": "Connect to Azure Managed Redis",
  "url": "https://redis.io/docs/latest/develop/clients/redis-py/amr/",
  "summary": "Learn how to authenticate to an Azure Managed Redis (AMR) database",
  "tags": [
    "docs",
    "develop",
    "stack",
    "oss",
    "rs",
    "rc",
    "oss",
    "kubernetes",
    "clients"
  ],
  "last_updated": "2026-08-27T15:55:18+01:00",
  "page_type": "content",
  "content_hash": "59e12b2f5b0241c2d6cd81a10505e378bfbede42cac1c5f3d16c2c56df9f1fad",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "The [`redis-entra-id`](https://github.com/redis/redis-py-entraid) package\nlets you authenticate your app to\n[Azure Managed Redis (AMR)](https://azure.microsoft.com/en-us/products/managed-redis)\nusing [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/).\nYou can authenticate using a system-assigned or user-assigned\n[managed identity](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)\nor a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals),\nletting `redis-entra-id` fetch and renew the authentication tokens for you automatically."
    },
    {
      "id": "install",
      "title": "Install",
      "role": "setup",
      "text": "Install [`redis-py`](https://redis.io/docs/latest/develop/clients/redis-py#install) first,\nif you have not already done so. Then, install `redis-entra-id` with the\nfollowing command:\n\n[code example]"
    },
    {
      "id": "create-a-credentialprovider-instance",
      "title": "Create a `CredentialProvider` instance",
      "role": "content",
      "text": "A `CredentialProvider` object obtains the authentication credentials you\nneed when you connect to Redis. See the sections below to learn how\nto create the `CredentialProvider` instances for AMR\nusing the factory functions that `redis-entra-id` provides."
    },
    {
      "id": "credentialprovider-for-a-service-principal",
      "title": "`CredentialProvider` for a service principal",
      "role": "content",
      "text": "Use the `create_from_service_principal()` factory function to create a\n`CredentialProvider` that authenticates to AMR using a\nservice principal (see the\n[Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals) to learn more about service principals).\n\nYou will need the following details of your service principal to make the connection:\n\n- Client ID\n- Client secret\n- Tenant ID\n\nThe example below shows how to import the required modules and call\n`create_from_service_principal()`:\n\n[code example]\n\nThis uses a default configuration but you can also provide a custom\nconfiguration using the `token_manager_config` parameter:\n\n[code example]"
    },
    {
      "id": "credentialprovider-for-a-managed-identity",
      "title": "`CredentialProvider` for a managed identity",
      "role": "content",
      "text": "Use the `create_from_managed_identity()` factory function to create a\n`CredentialProvider` that authenticates to AMR using a\nmanaged identity (see the\n[Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) to learn more about managed identities).\n\nThe example below shows how to import the required modules and call\n`create_from_managed_identity()`.\nPass `ManagedIdentityType.USER_ASSIGNED` or `ManagedIdentityType.SYSTEM_ASSIGNED`\nas the `identity_type` parameter.\n\n[code example]\n\nThis uses a default configuration but you can also provide a custom\nconfiguration using the `token_manager_config` parameter:\n\n[code example]"
    },
    {
      "id": "connect",
      "title": "Connect",
      "role": "content",
      "text": "When you have created your `CredentialProvider` instance, you are ready to\nconnect to AMR.\nThe example below shows how to pass the instance as a parameter to the standard\n`RedisCluster()` connection method.\n> [!NOTE]\n> Azure requires you to use\n> [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security)\n> when you connect (see\n> [Connect with TLS](https://redis.io/docs/latest/develop/clients/redis-py/connect#connect-to-your-production-redis-with-tls) for more information).\n\n[code example]"
    }
  ],
  "examples": [
    {
      "id": "install-ex0",
      "language": "bash",
      "code": "pip install redis-entraid",
      "section_id": "install"
    },
    {
      "id": "credentialprovider-for-a-service-principal-ex0",
      "language": "python",
      "code": "from redis_entraid.cred_provider import *\n\ncredential_provider = create_from_service_principal(\n    <CLIENT_ID>,\n    <CLIENT_SECRET>,\n    <TENANT_ID>\n)",
      "section_id": "credentialprovider-for-a-service-principal"
    },
    {
      "id": "credentialprovider-for-a-service-principal-ex1",
      "language": "python",
      "code": "credential_provider = create_from_service_principal(\n    <CLIENT_ID>, \n    <CLIENT_SECRET>, \n    <TENANT_ID>,\n    token_manager_config=TokenManagerConfig(\n        expiration_refresh_ratio=0.9,\n        lower_refresh_bound_millis=DEFAULT_LOWER_REFRESH_BOUND_MILLIS,\n        token_request_execution_timeout_in_ms=DEFAULT_TOKEN_REQUEST_EXECUTION_TIMEOUT_IN_MS,\n        retry_policy=RetryPolicy(\n            max_attempts=5,\n            delay_in_ms=50\n        )\n    )\n)",
      "section_id": "credentialprovider-for-a-service-principal"
    },
    {
      "id": "credentialprovider-for-a-managed-identity-ex0",
      "language": "python",
      "code": "from redis_entraid.cred_provider import *\n\ncredential_provider = create_from_managed_identity(\n    identity_type=ManagedIdentityType.SYSTEM_ASSIGNED,\n)",
      "section_id": "credentialprovider-for-a-managed-identity"
    },
    {
      "id": "credentialprovider-for-a-managed-identity-ex1",
      "language": "python",
      "code": "credential_provider = create_from_managed_identity(\n    identity_type=ManagedIdentityType.SYSTEM_ASSIGNED, \n    ...\n\n    token_manager_config=TokenManagerConfig(\n        expiration_refresh_ratio=0.9,\n        lower_refresh_bound_millis=DEFAULT_LOWER_REFRESH_BOUND_MILLIS,\n        token_request_execution_timeout_in_ms=DEFAULT_TOKEN_REQUEST_EXECUTION_TIMEOUT_IN_MS,\n        retry_policy=RetryPolicy(\n            max_attempts=5,\n            delay_in_ms=50\n        )\n    )\n)",
      "section_id": "credentialprovider-for-a-managed-identity"
    },
    {
      "id": "connect-ex0",
      "language": "python",
      "code": "from redis import RedisCluster\n# ...\n\n# AMR databases have clustering enabled by default.\nr = RedisCluster(\n    host=<HOST>, port=<PORT>,\n    credential_provider=credential_provider,\n    ssl=True,\n    ssl_certfile=\"./redis_user.crt\",\n    ssl_keyfile=\"./redis_user_private.key\",\n    ssl_ca_certs=\"./redis_ca.pem\"\n)\n\n// Test the connection.\nprint(\"The database size is: {}\".format(client.dbsize()))",
      "section_id": "connect"
    }
  ]
}