From 0a266349a5f31a6af28cebb8e051d738b2da5275 Mon Sep 17 00:00:00 2001
From: Roger Barreto <19890735+rogerbarreto@users.noreply.github.com>
Date: Thu, 5 Mar 2026 11:06:06 +0000
Subject: [PATCH] Add DefaultAzureCredential production warning comments to all
 HostedAgents samples

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../05-end-to-end/HostedAgents/AgentThreadAndHITL/Program.cs   | 3 +++
 .../05-end-to-end/HostedAgents/AgentWithHostedMCP/Program.cs   | 3 +++
 .../05-end-to-end/HostedAgents/AgentWithLocalTools/Program.cs  | 3 +++
 .../HostedAgents/AgentWithTextSearchRag/Program.cs             | 3 +++
 .../05-end-to-end/HostedAgents/AgentWithTools/Program.cs       | 3 +++
 .../05-end-to-end/HostedAgents/AgentsInWorkflows/Program.cs    | 3 +++
 6 files changed, 18 insertions(+)

diff --git a/dotnet/samples/05-end-to-end/HostedAgents/AgentThreadAndHITL/Program.cs b/dotnet/samples/05-end-to-end/HostedAgents/AgentThreadAndHITL/Program.cs
index 4b9dc9e43e..afeee264c8 100644
--- a/dotnet/samples/05-end-to-end/HostedAgents/AgentThreadAndHITL/Program.cs
+++ b/dotnet/samples/05-end-to-end/HostedAgents/AgentThreadAndHITL/Program.cs
@@ -22,6 +22,9 @@ static string GetWeather([Description("The location to get the weather for.")] s
 // Create the chat client and agent.
 // Note: ApprovalRequiredAIFunction wraps the tool to require user approval before invocation.
 // User should reply with 'approve' or 'reject' when prompted.
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
 #pragma warning disable MEAI001 // Type is for evaluation purposes only
 AIAgent agent = new AzureOpenAIClient(
     new Uri(endpoint),
diff --git a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithHostedMCP/Program.cs b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithHostedMCP/Program.cs
index 0a244bbea5..8bcde40ec0 100644
--- a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithHostedMCP/Program.cs
+++ b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithHostedMCP/Program.cs
@@ -21,6 +21,9 @@ AITool mcpTool = new HostedMcpServerTool(serverName: "microsoft_learn", serverAd
 };
 
 // Create an agent with the MCP tool using Azure OpenAI Responses.
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
 AIAgent agent = new AzureOpenAIClient(
     new Uri(endpoint),
     new DefaultAzureCredential())
diff --git a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithLocalTools/Program.cs b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithLocalTools/Program.cs
index e9094d4b56..481b74bdb3 100644
--- a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithLocalTools/Program.cs
+++ b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithLocalTools/Program.cs
@@ -84,6 +84,9 @@ string GetAvailableHotels(
     }
 }
 
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
 var credential = new DefaultAzureCredential();
 AIProjectClient projectClient = new(new Uri(endpoint), credential);
 
diff --git a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTextSearchRag/Program.cs b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTextSearchRag/Program.cs
index b3f918283b..d31a72beda 100644
--- a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTextSearchRag/Program.cs
+++ b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTextSearchRag/Program.cs
@@ -20,6 +20,9 @@ TextSearchProviderOptions textSearchOptions = new()
     RecentMessageMemoryLimit = 6,
 };
 
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
 AIAgent agent = new AzureOpenAIClient(
     new Uri(endpoint),
     new DefaultAzureCredential())
diff --git a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTools/Program.cs b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTools/Program.cs
index d7330e6cfb..8360f083ea 100644
--- a/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTools/Program.cs
+++ b/dotnet/samples/05-end-to-end/HostedAgents/AgentWithTools/Program.cs
@@ -13,6 +13,9 @@ var openAiEndpoint = Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT")
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT_NAME") ?? "gpt-4o-mini";
 var toolConnectionId = Environment.GetEnvironmentVariable("MCP_TOOL_CONNECTION_ID") ?? throw new InvalidOperationException("MCP_TOOL_CONNECTION_ID is not set.");
 
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
 var credential = new DefaultAzureCredential();
 
 var chatClient = new AzureOpenAIClient(new Uri(openAiEndpoint), credential)
diff --git a/dotnet/samples/05-end-to-end/HostedAgents/AgentsInWorkflows/Program.cs b/dotnet/samples/05-end-to-end/HostedAgents/AgentsInWorkflows/Program.cs
index f959d52ce9..b1647fe81c 100644
--- a/dotnet/samples/05-end-to-end/HostedAgents/AgentsInWorkflows/Program.cs
+++ b/dotnet/samples/05-end-to-end/HostedAgents/AgentsInWorkflows/Program.cs
@@ -15,6 +15,9 @@ using Microsoft.Extensions.AI;
 var endpoint = Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_OPENAI_ENDPOINT is not set.");
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT_NAME") ?? "gpt-4o-mini";
 
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
 IChatClient chatClient = new AzureOpenAIClient(new Uri(endpoint), new DefaultAzureCredential())
     .GetChatClient(deploymentName)
     .AsIChatClient();