Stop IMDS Throttling: Azure Managed Identity Token Caching Best Practices in Python

Intro: What is Azure Managed Identity (and why you should care about token caching)

Azure Managed Identity is a built-in authentication method that lets your apps securely access Azure resources without storing credentials. Instead of hard-coding secrets or connection strings, Azure issues your app a short-lived Azure Active Directory (AAD) access token on demand. This token can be used to call services like Azure SQL, Key Vault, or Azure Storage — and it automatically rotates before it expires.

In Python, this is typically handled with the ManagedIdentityCredential from azure.identity.

• In production (Azure Functions, Container Apps, VMs, etc.), ManagedIdentityCredential() talks directly to the Instance Metadata Service (IMDS) to get your token.
• In local development, it usually falls back to AzureCliCredential or DefaultAzureCredential() if you’ve signed in via az login — meaning no IMDS calls happen locally.

This dual behavior is handy: the same code runs in both dev and prod without changing credentials. But in production, IMDS has throttling limits, and if many threads, Functions, or container revisions request new tokens at the same time, you…