Starting with Aspire 13.0, when deploying to Azure Container Apps (ACA) or Azure App Service, DefaultAzureCredential no longer uses the full chain of identity providers by default. Instead, it is configured to only use ManagedIdentityCredential.
This is achieved by Aspire automatically setting the AZURE_TOKEN_CREDENTIALS environment variable during deployment. This change enforces deterministic credential resolution, which improves security, reliability, and performance in production environments by following Azure SDK best practices.
Previous Behavior: DefaultAzureCredential would attempt multiple providers (e.g., EnvironmentCredential, WorkloadIdentityCredential) before reaching ManagedIdentityCredential.
New Behavior: DefaultAzureCredential only uses ManagedIdentityCredential because the presence of AZURE_TOKEN_CREDENTIALS restricts the credential chain.