# IAzureRadiusProviderBuilder Methods

- Package: [Aspire.Hosting.Radius](/reference/api/csharp/aspire.hosting.radius.md)
- Type: [IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md)
- Kind: `Methods`
- Members: `2`

Builder surface exposed inside the `WithAzureProvider` callback for selecting an Azure credential mode. Exactly one `With*` method must be called; a repeat call replaces the previous selection.

<a id="withserviceprincipal"></a>
<a id="withserviceprincipal-string-string-iresourcebuilder-parameterresource"></a>

## WithServicePrincipal(string, string, IResourceBuilder<ParameterResource>)

- Name: `WithServicePrincipal(string, string, IResourceBuilder<ParameterResource>)`
- Modifiers: `abstract`
- Returns: [IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md)

Configures a Service Principal credential. The client secret value is provided via a `ApplicationModel.ParameterResource` so its plaintext never appears in the publish artifact. Reference it with `builder.AddParameter("azureClientSecret", secret: true)`.

```csharp
public interface IAzureRadiusProviderBuilder
{
    public abstract IAzureRadiusProviderBuilder WithServicePrincipal(
        string tenantId,
        string clientId,
        IResourceBuilder<ParameterResource> clientSecret)
    {
        // ...
    }
}
```

## Parameters

- `tenantId` (`string`)
  Azure tenant GUID.
- `clientId` (`string`)
  Service principal client (application) GUID.
- `clientSecret` (`IResourceBuilder<ParameterResource>`)
  Parameter carrying the client secret.

## Returns

[IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md) -- This builder for chaining.

<a id="withworkloadidentity"></a>
<a id="withworkloadidentity-string-string"></a>

## WithWorkloadIdentity(string, string)

- Name: `WithWorkloadIdentity(string, string)`
- Modifiers: `abstract`
- Returns: [IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md)

Configures a Workload Identity (federated identity) credential. No long-lived secret is materialized; the identity is bound at deploy time by the hosting Kubernetes cluster's OIDC issuer.

```csharp
public interface IAzureRadiusProviderBuilder
{
    public abstract IAzureRadiusProviderBuilder WithWorkloadIdentity(
        string tenantId,
        string clientId)
    {
        // ...
    }
}
```

## Parameters

- `tenantId` (`string`)
  Azure tenant GUID.
- `clientId` (`string`)
  Workload identity client (application) GUID.

## Returns

[IAzureRadiusProviderBuilder](/reference/api/csharp/aspire.hosting.radius/iazureradiusproviderbuilder.md) -- This builder for chaining.