[Identity] Update AZURE_TOKEN_CREDENTIALS to allow specific creds

[pvaneck]

Now, users of DefaultAzureCredential can specify a specific credential in the DAC chain when using the AZURE_TOKEN_CREDENTIALS environment variable.

• If a user specifies a specific credential in the chain, then that will be the only credential in the chain.
• For credentials excluded by default (e.g. InteractiveBrowserCredential), if that credential is set in the env var, then its inclusion will be prioritized. For example, AZURE_TOKEN_CREDENTIALS=InteractiveBrowserCredential will make DefaultAzureCredential() use InteractiveBrowserCredential.
• If a user explicitly sets an exclusion keyword argument corresponding to the credential set in the env var, then its value will take precedence over the env var. For example:

  AZURE_TOKEN_CREDENTIALS=EnvironmentCredential
  
  # The following will raise a ValueError since no credentials are in the chain.
  credential = DefaultAzureCredential(exclude_environment_credential=True)

Closes: #39784

[Copilot]

Pull Request Overview

This PR enables users to select a specific credential within DefaultAzureCredential by setting the AZURE_TOKEN_CREDENTIALS environment variable, refactors the credential-exclusion logic into a reusable helper, adds comprehensive tests for both async and sync chains, and updates versioning and metadata to reflect the new beta release.

• Introduced process_credential_exclusions in internal utils and wired it into async & sync DefaultAzureCredential constructors.
• Expanded test coverage for async and sync chains to validate specific credential selection, case-insensitivity, invalid values, and user overrides.
• Updated package metadata (setup.py classifier, version, changelog) for the 1.24.0b1 beta release.

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sdk/identity/azure-identity/tests/test_token_credentials_env_async.py	Added async tests covering specific credential selection via env var.
sdk/identity/azure-identity/tests/test_token_credentials_env.py	Added sync tests covering specific credential selection via env var.
sdk/identity/azure-identity/setup.py	Changed development status classifier to Beta.
sdk/identity/azure-identity/azure/identity/aio/_credentials/default.py	Refactored async DefaultAzureCredential to use process_credential_exclusions.
sdk/identity/azure-identity/azure/identity/_credentials/default.py	Refactored sync DefaultAzureCredential to use process_credential_exclusions.
sdk/identity/azure-identity/azure/identity/_internal/utils.py	Introduced process_credential_exclusions helper for managing exclusions.
sdk/identity/azure-identity/azure/identity/_internal/init.py	Exported process_credential_exclusions in internal package init.
sdk/identity/azure-identity/azure/identity/_version.py	Bumped version to 1.24.0b1.
sdk/identity/azure-identity/CHANGELOG.md	Documented new AZURE_TOKEN_CREDENTIALS feature and version update.

Comments suppressed due to low confidence (2)

sdk/identity/azure-identity/azure/identity/aio/_credentials/default.py:128

• The class docstring for DefaultAzureCredential should include a description of the new AZURE_TOKEN_CREDENTIALS environment variable and how it controls which credential is used, ensuring users know how to configure this feature.

        # Define credential configuration mapping (async version)

sdk/identity/azure-identity/azure/identity/_credentials/default.py:136

• Add documentation in the class docstring to explain the supported values of AZURE_TOKEN_CREDENTIALS and how the exclusion flags interact, so the sync DefaultAzureCredential API matches its behavior.

        # Define credential configuration mapping