test(unit): clear ambient Azure credentials in entra token tests

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/unit/conftest.py

@@ -12,6 +12,14 @@ import litellm.router as litellm_router_module  # noqa: E402  # same import-time
 import litellm.utils as litellm_utils_module  # noqa: E402  # same import-time dependency
 
 LOOPBACK_HOSTS: Final = ["127.0.0.1", "::1"]
+AMBIENT_AZURE_CREDENTIAL_ENV_VARS: Final = (
+    "AZURE_AD_TOKEN",
+    "AZURE_TENANT_ID",
+    "AZURE_CLIENT_ID",
+    "AZURE_CLIENT_SECRET",
+    "AZURE_USERNAME",
+    "AZURE_PASSWORD",
+)
 
 
 def _allow_loopback_only() -> None:
@@ -53,5 +61,11 @@ def local_model_cost_map(monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
     litellm.get_model_info.cache_clear()
 
 
+@pytest.fixture
+def no_ambient_azure_credentials(monkeypatch: pytest.MonkeyPatch) -> None:
+    for name in AMBIENT_AZURE_CREDENTIAL_ENV_VARS:
+        monkeypatch.delenv(name, raising=False)
+
+
 def pytest_sessionfinish() -> None:
     enable_socket()

tests/unit/llms/azure/realtime/test_azure_realtime_handler.py

@@ -707,7 +707,7 @@ async def test_realtime_health_check_uses_bearer_token_when_no_api_key(monkeypat
 
 
 @pytest.mark.asyncio
-async def test_arealtime_forwards_deployment_azure_ad_token(monkeypatch):
+async def test_arealtime_forwards_deployment_azure_ad_token(monkeypatch, no_ambient_azure_credentials):
     """
     The router binds a deployment's `azure_ad_token` to `_arealtime`'s named parameter rather than
     **kwargs, so it must still reach the handler.

tests/unit/llms/azure_ai/image_edit/test_azure_ai_image_edit_transformation.py

@@ -41,7 +41,7 @@ def test_azure_ai_url_generation():
     assert complete_url == expected_url
 
 
-def test_azure_ai_validate_environment_with_entra_token(monkeypatch):
+def test_azure_ai_validate_environment_with_entra_token(monkeypatch, no_ambient_azure_credentials):
     monkeypatch.delenv("AZURE_AI_API_KEY", raising=False)
     monkeypatch.setattr(litellm, "api_key", None)
     config = AzureFoundryFluxImageEditConfig()
@@ -55,7 +55,7 @@ def test_azure_ai_validate_environment_with_entra_token(monkeypatch):
     assert headers == {"Authorization": "Bearer entra-token"}
 
 
-def test_flux2_validate_environment_with_entra_token(monkeypatch):
+def test_flux2_validate_environment_with_entra_token(monkeypatch, no_ambient_azure_credentials):
     monkeypatch.delenv("AZURE_AI_API_KEY", raising=False)
     monkeypatch.setattr(litellm, "api_key", None)
     config = AzureFoundryFlux2ImageEditConfig()

tests/unit/llms/azure_ai/image_edit/test_mai_image_edit_transformation.py

@@ -174,7 +174,7 @@ class TestAzureMAIImageEdit:
         assert image_response.usage.total_tokens == 1024
 
 
-def test_mai_validate_environment_with_entra_token(monkeypatch):
+def test_mai_validate_environment_with_entra_token(monkeypatch, no_ambient_azure_credentials):
     monkeypatch.delenv("AZURE_AI_API_KEY", raising=False)
     monkeypatch.setattr(litellm, "api_key", None)
 

tests/unit/llms/azure_ai/passthrough/test_azure_ai_passthrough_transformation.py

@@ -256,13 +256,13 @@ def test_serverless_host_gets_a_bearer_token():
     assert "api-key" not in headers
 
 
-def test_entra_token_is_used_when_the_deployment_has_no_api_key():
+def test_entra_token_is_used_when_the_deployment_has_no_api_key(no_ambient_azure_credentials):
     headers = _auth_headers(api_key=None, api_base=FOUNDRY_BASE, litellm_params={"azure_ad_token": "entra-token"})
 
     assert headers["Authorization"] == "Bearer entra-token"
 
 
-def test_no_credentials_at_all_raises():
+def test_no_credentials_at_all_raises(no_ambient_azure_credentials):
     with pytest.raises(ValueError, match="Missing Azure AI credentials"):
         _auth_headers(api_key=None, api_base=FOUNDRY_BASE)
 

tests/unit/llms/azure_ai/rerank/test_azure_ai_rerank_transformation.py

@@ -105,7 +105,7 @@ class TestAzureAIRerankConfigValidateEnvironment:
 
         assert headers["Authorization"] == "Bearer my-key"
 
-    def test_falls_back_to_entra_token(self, monkeypatch):
+    def test_falls_back_to_entra_token(self, monkeypatch, no_ambient_azure_credentials):
         monkeypatch.delenv("AZURE_AI_API_KEY", raising=False)
         monkeypatch.setattr(litellm, "azure_key", None)