# IAzureRadiusProviderBuilder

- Kind: `interface`
- Package: [Aspire.Hosting.Radius](/reference/api/csharp/aspire.hosting.radius.md)
- Version: `13.5.3-preview.1.26425.3`
- Namespace: `Aspire.Hosting.Radius.CloudProviders`
- Target framework: `net10.0`
- Source: [GitHub](https://github.com/microsoft/aspire/blob/b5f143315ffb6968ea939a9978797a5b20e4c688/src/Aspire.Hosting.Radius/CloudProviders/IAzureRadiusProviderBuilder.cs)

Builder surface exposed inside the `WithAzureProvider` callback for selecting an Azure credential mode. Exactly one `With*` method must be called; a repeat call replaces the previous selection.

## Definition

```csharp
namespace Aspire.Hosting.Radius.CloudProviders;

public interface IAzureRadiusProviderBuilder
{
    // ...
}
```

## Methods

- [WithServicePrincipal(string, string, IResourceBuilder<ParameterResource>)](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder/methods.md#withserviceprincipal-string-string-iresourcebuilder-parameterresource) : [IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md) `abstract` -- Configures a Service Principal credential. The client secret value is provided via a `ApplicationModel.ParameterResource` so its plaintext never appears in the publish artifact. Reference it with `builder.AddParameter("azureClientSecret", secret: true)`.
- [WithWorkloadIdentity(string, string)](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder/methods.md#withworkloadidentity-string-string) : [IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md) `abstract` -- Configures a Workload Identity (federated identity) credential. No long-lived secret is materialized; the identity is bound at deploy time by the hosting Kubernetes cluster's OIDC issuer.