Deprecate UsernamePasswordCredential

sdk/e2e/src/main/java/com/azure/endtoend/identity/MultiTenantTest.java

@@ -23,6 +23,7 @@
 /**
  * Runs Identity tests across multiple tests.
  */
+@SuppressWarnings("deprecation")
 class MultiTenantTest {
     private static final String AZURE_MULTI_TENANT_TEST_MODE = "AZURE_MULTI_TENANT_TEST_MODE";
     private static final String AZURE_USER_NAME = "AZURE_USER_NAME";

sdk/identity/azure-identity-extensions/src/main/java/com/azure/identity/extensions/implementation/credential/provider/DefaultTokenCredentialProvider.java

@@ -15,6 +15,7 @@
 /**
  * Default tokenCredentialProvider implementation that provides tokenCredential instance.
  */
+@SuppressWarnings("deprecation")
 public class DefaultTokenCredentialProvider implements TokenCredentialProvider {
 
     private final TokenCredentialProviderOptions options;

sdk/identity/azure-identity/CHANGELOG.md

@@ -10,6 +10,8 @@
 
 ### Other Changes
 
+ - Marked `UsernamePasswordCredential` and `UsernamePasswordCredentialBuilder` as deprecated. See https://aka.ms/azsdk/identity/mfa for details about MFA enforcement and migration guidance. [#44381](https://github.com/Azure/azure-sdk-for-java/pull/44381)  
+
 ## 1.15.3 (2025-02-20)
 
 ### Other Changes

sdk/identity/azure-identity/README.md

@@ -301,13 +301,12 @@ Not all credentials honor this configuration. Credentials that authenticate thro
 
 ### Authenticate users
 
-|Credential|Usage|Example|Reference|
-|-|-|-|-|
-|[AuthorizationCodeCredential][cred_acc]|Authenticates a user with a previously obtained authorization code as part of an OAuth 2.0 auth code flow||[OAuth 2.0 auth code][cred_acc_ref]|
-|[DeviceCodeCredential][cred_dcc]|Interactively authenticates a user on devices with limited UI|[example][cred_dcc_example]|[device code authentication][cred_dcc_ref]|
-|[InteractiveBrowserCredential][cred_ibc]|Interactively authenticates a user with the default system browser|[example][cred_ibc_example]|[OAuth 2.0 auth code][cred_acc_ref]|
-|[OnBehalfOfCredential][cred_obo]|Propagates the delegated user identity and permissions through the request chain||[On-behalf-of authentication][cred_obo_ref]|
-|[UsernamePasswordCredential][cred_upc]|Authenticates a user with a username and password without multi-factor auth|[example][cred_upc_example]|[Username + password authentication][cred_upc_ref]|
+|Credential| Usage                                                                                                     |Example|Reference|
+|-|-----------------------------------------------------------------------------------------------------------|-|-|
+|[AuthorizationCodeCredential][cred_acc]| Authenticates a user with a previously obtained authorization code as part of an OAuth 2.0 auth code flow ||[OAuth 2.0 auth code][cred_acc_ref]|
+|[DeviceCodeCredential][cred_dcc]| Interactively authenticates a user on devices with limited UI                                             |[example][cred_dcc_example]|[device code authentication][cred_dcc_ref]|
+|[InteractiveBrowserCredential][cred_ibc]| Interactively authenticates a user with the default system browser                                        |[example][cred_ibc_example]|[OAuth 2.0 auth code][cred_acc_ref]|
+|[OnBehalfOfCredential][cred_obo]| Propagates the delegated user identity and permissions through the request chain                          ||[On-behalf-of authentication][cred_obo_ref]|
 
 ### Authenticate via development tools
 
@@ -344,15 +343,6 @@ Credentials can be chained together to be tried in turn until one succeeds using
 |`AZURE_CLIENT_CERTIFICATE_PATH`|path to a PFX or PEM-encoded certificate file including private key|
 |`AZURE_CLIENT_CERTIFICATE_PASSWORD`|(optional) password for certificate. The certificate can't be password-protected unless this value is specified.|
 
-### Username and password
-
-|Variable name|Value|
-|-|-|
-|`AZURE_CLIENT_ID`|ID of a Microsoft Entra application|
-|`AZURE_TENANT_ID`|(optional) ID of the application's Microsoft Entra tenant|
-|`AZURE_USERNAME`|a username (usually an email address)|
-|`AZURE_PASSWORD`|that user's password|
-
 ### Managed identity (`DefaultAzureCredential`)
 
 |Variable name|Value|
@@ -441,9 +431,6 @@ This project has adopted the [Microsoft Open Source Code of Conduct][code_of_con
 [cred_mic_example]: https://github.com/Azure/azure-sdk-for-java/wiki/Azure-Identity-Examples#authenticating-in-azure-with-managed-identity
 [cred_obo]: https://learn.microsoft.com/java/api/com.azure.identity.onbehalfofcredential?view=azure-java-stable
 [cred_obo_ref]: https://learn.microsoft.com/entra/identity-platform/v2-oauth2-on-behalf-of-flow
-[cred_upc]: https://learn.microsoft.com/java/api/com.azure.identity.usernamepasswordcredential?view=azure-java-stable
-[cred_upc_example]: https://github.com/Azure/azure-sdk-for-java/wiki/Azure-Identity-Examples#authenticating-a-user-account-with-username-and-password
-[cred_upc_ref]: https://learn.microsoft.com/entra/identity-platform/v2-oauth-ropc
 [cred_vsc]: https://learn.microsoft.com/java/api/com.azure.identity.visualstudiocodecredential?view=azure-java-stable
 [cred_vsc_example]: https://github.com/Azure/azure-sdk-for-java/wiki/Azure-Identity-Examples#authenticating-a-user-account-with-visual-studio-code
 [cred_vsc_ref]: https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account

sdk/identity/azure-identity/src/main/java/com/azure/identity/EnvironmentCredential.java

@@ -38,6 +38,8 @@
  * </ul>
  *
  * <p>The required environment variables for username password authentication are as follows:</p>
+ * <p><strong>Deprecated</strong>: Username and password authentication doesn't support multifactor authentication (MFA).
+ *       For more details on Microsoft Entra MFA enforcement, see <a href="https://aka.ms/azsdk/identity/mfa">here</a>.</p>
  * <ul>
  *     <li>{@link Configuration#PROPERTY_AZURE_CLIENT_ID AZURE_CLIENT_ID}</li>
  *     <li>{@link Configuration#PROPERTY_AZURE_USERNAME AZURE_USERNAME}</li>
@@ -65,6 +67,7 @@
  * @see EnvironmentCredentialBuilder
  */
 @Immutable
+@SuppressWarnings("deprecation")
 public class EnvironmentCredential implements TokenCredential {
     private static final ClientLogger LOGGER = new ClientLogger(EnvironmentCredential.class);
     private final TokenCredential tokenCredential;

sdk/identity/azure-identity/src/main/java/com/azure/identity/UsernamePasswordCredential.java

@@ -52,8 +52,11 @@
  * @see UsernamePasswordCredentialBuilder
  * @see DeviceCodeCredential
  * @see InteractiveBrowserCredential
+ *
+ * @deprecated This credential is deprecated because it doesn't support multifactor authentication (MFA). See <a href="https://aka.ms/azsdk/identity/mfa">here</a> for details about MFA enforcement for Microsoft Entra ID and migration guidance.
  */
 @Immutable
+@Deprecated
 public class UsernamePasswordCredential implements TokenCredential {
     private static final ClientLogger LOGGER = new ClientLogger(UsernamePasswordCredential.class);
 

sdk/identity/azure-identity/src/main/java/com/azure/identity/UsernamePasswordCredentialBuilder.java

@@ -38,7 +38,11 @@
  * <!-- end com.azure.identity.credential.usernamepasswordcredential.construct -->
  *
  * @see UsernamePasswordCredential
+ *
+ * @deprecated This credential is deprecated because it doesn't support multifactor authentication (MFA). See <a href="https://aka.ms/azsdk/identity/mfa">here</a> for details about MFA enforcement for Microsoft Entra ID and migration guidance.
+ *
  */
+@Deprecated
 public class UsernamePasswordCredentialBuilder extends AadCredentialBuilderBase<UsernamePasswordCredentialBuilder> {
     private static final ClientLogger LOGGER = new ClientLogger(UsernamePasswordCredentialBuilder.class);
     private static final String CLASS_NAME = UsernamePasswordCredentialBuilder.class.getSimpleName();

sdk/identity/azure-identity/src/test/java/com/azure/identity/UsernamePasswordCredentialTest.java

@@ -29,6 +29,7 @@
 import static org.mockito.Mockito.mockConstruction;
 import static org.mockito.Mockito.when;
 
+@SuppressWarnings("deprecation")
 public class UsernamePasswordCredentialTest {
 
     private final String clientId = UUID.randomUUID().toString();

sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/context/AzureTokenCredentialAutoConfiguration.java

@@ -48,6 +48,7 @@
 @Configuration(proxyBeanMethods = false)
 @AutoConfigureAfter(TaskExecutionAutoConfiguration.class)
 @Import(AzureServiceClientBuilderFactoryConfiguration.class)
+@SuppressWarnings("deprecation")
 public class AzureTokenCredentialAutoConfiguration extends AzureServiceConfigurationBase {
     private static final Logger LOGGER = LoggerFactory.getLogger(AzureTokenCredentialAutoConfiguration.class);
 

sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/AbstractAzureServiceConfigurationTests.java

@@ -23,6 +23,7 @@
 import static com.azure.spring.cloud.core.implementation.util.ReflectionUtils.getField;
 import static org.assertj.core.api.Assertions.assertThat;
 
+@SuppressWarnings("deprecation")
 public abstract class AbstractAzureServiceConfigurationTests<T extends AbstractAzureServiceClientBuilderFactory<?>,
         P extends AzureProperties> {
 

sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/context/AzureTokenCredentialAutoConfigurationTests.java

@@ -41,6 +41,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+@SuppressWarnings("deprecation")
 class AzureTokenCredentialAutoConfigurationTests {
 
     private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()

sdk/spring/spring-cloud-azure-core/src/main/java/com/azure/spring/cloud/core/implementation/factory/credential/UsernamePasswordCredentialBuilderFactory.java

@@ -11,6 +11,7 @@
 /**
  * A credential builder factory for the {@link UsernamePasswordCredentialBuilder}.
  */
+@SuppressWarnings("deprecation")
 public class UsernamePasswordCredentialBuilderFactory extends AzureAadCredentialBuilderFactory<UsernamePasswordCredentialBuilder> {
 
     /**

sdk/spring/spring-cloud-azure-core/src/test/java/com/azure/spring/cloud/core/implementation/credential/resolver/AzureTokenCredentialResolverTests.java

@@ -15,6 +15,7 @@
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 
+@SuppressWarnings("deprecation")
 class AzureTokenCredentialResolverTests {
 
 

sdk/spring/spring-cloud-azure-core/src/test/java/com/azure/spring/cloud/core/implementation/factory/credential/UsernamePasswordCredentialBuilderFactoryTest.java

@@ -6,6 +6,7 @@
 import com.azure.identity.UsernamePasswordCredentialBuilder;
 import com.azure.spring.cloud.core.properties.AzureProperties;
 
+@SuppressWarnings("deprecation")
 class UsernamePasswordCredentialBuilderFactoryTest extends AzureAadCredentialBuilderFactoryTest<
     UsernamePasswordCredentialBuilder,
     UsernamePasswordCredentialBuilderFactory> {

sdk/spring/spring-cloud-azure-service/src/test/java/com/azure/spring/cloud/service/implementation/AzureServiceClientBuilderFactoryBaseTests.java

@@ -15,6 +15,7 @@
 
 import static org.mockito.Mockito.times;
 
+@SuppressWarnings("deprecation")
 public abstract class AzureServiceClientBuilderFactoryBaseTests<B, P extends AzureSdkProperties,
                                                                   F extends AzureServiceClientBuilderFactory<B>>
     extends AzureGenericServiceClientBuilderFactoryBaseTests<P, F> {

sdk/spring/spring-cloud-azure-service/src/test/java/com/azure/spring/cloud/service/implementation/servicebus/factory/AbstractServiceBusSubClientBuilderFactoryTests.java

@@ -28,6 +28,7 @@
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 
+@SuppressWarnings("deprecation")
 abstract class AbstractServiceBusSubClientBuilderFactoryTests<B,
     P extends ServiceBusClientCommonTestProperties,
     F extends AbstractServiceBusSubClientBuilderFactory<B, ?>> extends AzureGenericServiceClientBuilderFactoryBaseTests<P, F> {