RuleAzureSandboxesProxyAzureWorkloadIdentityConfig()ClientID is the application (client) ID, a GUID, of the app registration or user-assigned managed identity whose federated identity credential trusts LangSmith's issuer. Required with tenant_id.
TenantID is the Entra tenant (directory) ID, a GUID.
Setting it selects workload identity: LangSmith signs an OIDC token for this workspace and exchanges it at Entra ID for access tokens of client_id, so no secret is stored. Cannot be changed after creation.
Resources narrows the Entra resources access tokens are obtained for, from https://storage.azure.com, https://vault.azure.net, https://management.azure.com and https://cognitiveservices.azure.com. Defaults to all of them. Only valid with tenant_id.
SubjectScope picks the token subject the federated credential trusts:
"workspace" (the default) or "tag: