如何通过配置选项在私有DbContext包中设置Azure默认TenantId

方法1：通过环境变量指定默认租户ID #

DefaultAzureCredential会自动读取环境变量AZURE_TENANT_ID，无需修改私有DbContext代码，只需配置环境变量即可强制使用指定租户获取Token：

• 本地Visual Studio调试：打开项目属性 → 调试 → 环境变量，添加AZURE_TENANT_ID，值为目标租户ID（xxxx-xxxx-xxxx-xxxx）。
• 配置文件辅助：若项目中需手动初始化凭据，可在appsettings.json中添加配置，后续通过代码读取：

{
  "Azure": {
    "TenantId": "xxxx-xxxx-xxxx-xxxx"
  }
}

方法2：使用EF Core连接拦截器注入Token逻辑 #

通过EF Core的DbConnectionInterceptor，在连接打开前自动设置指定租户的AccessToken，完全无需修改私有DbContext代码：

1. 创建拦截器类 #

using Microsoft.EntityFrameworkCore.Diagnostics;
using Microsoft.Data.SqlClient;
using Azure.Identity;

public class AzureSqlTenantTokenInterceptor : DbConnectionInterceptor
{
    private readonly string _targetTenantId;
    private readonly DefaultAzureCredential _credential;

    public AzureSqlTenantTokenInterceptor(string tenantId)
    {
        _targetTenantId = tenantId;
        _credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions
        {
            TenantId = tenantId
        });
    }

    public override async ValueTask<InterceptionResult> ConnectionOpeningAsync(
        DbConnection connection, 
        ConnectionEventData eventData, 
        InterceptionResult result, 
        CancellationToken cancellationToken = default)
    {
        await SetAccessTokenIfNeededAsync(connection, cancellationToken);
        return await base.ConnectionOpeningAsync(connection, eventData, result, cancellationToken);
    }

    public override InterceptionResult ConnectionOpening(
        DbConnection connection, 
        ConnectionEventData eventData, 
        InterceptionResult result)
    {
        SetAccessTokenIfNeeded(connection);
        return base.ConnectionOpening(connection, eventData, result);
    }

    private async Task SetAccessTokenIfNeededAsync(DbConnection connection, CancellationToken cancellationToken)
    {
        if (connection is SqlConnection sqlConn && string.IsNullOrEmpty(sqlConn.AccessToken))
        {
            var tokenContext = new TokenRequestContext(new[] { "https://database.windows.net/" })
            {
                TenantId = _targetTenantId
            };
            var token = await _credential.GetTokenAsync(tokenContext, cancellationToken);
            sqlConn.AccessToken = token.Token;
        }
    }

    private void SetAccessTokenIfNeeded(DbConnection connection)
    {
        if (connection is SqlConnection sqlConn && string.IsNullOrEmpty(sqlConn.AccessToken))
        {
            var tokenContext = new TokenRequestContext(new[] { "https://database.windows.net/" })
            {
                TenantId = _targetTenantId
            };
            var token = _credential.GetToken(tokenContext);
            sqlConn.AccessToken = token.Token;
        }
    }
}

2. 注册拦截器到DbContext #

在Program.cs（或Startup.cs）中注册DbContext时添加拦截器：

builder.Services.AddDbContext<CompanyServicesDbContext>(options =>
{
    options.UseSqlServer(builder.Configuration.GetConnectionString("YourDbConnection"))
           .AddInterceptors(new AzureSqlTenantTokenInterceptor("xxxx-xxxx-xxxx-xxxx"));
});

方法3：本地调试临时方案——手动指定AccessToken（不推荐生产） #

本地调试时可手动获取目标租户的Token，直接添加到连接字符串中：

{
  "ConnectionStrings": {
    "YourDbConnection": "Server=tcp:your-db-server.database.windows.net,1433;Database=your-db;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;AccessToken=your-manually-obtained-token"
  }
}

注意：Token有过期时间，需定期更新，仅适合临时测试。

内容的提问来源于stack exchange，提问作者iarunpaul