--- title: "Azure AI Document Translation for Python: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-azure-ai-translation-document-py/ description: "Pins Microsoft's Python document-translation skill, which uses Entra for new clients and limits blob SAS permissions on source and target containers." --- # Azure AI Document Translation for Python: review, setup & limitations · Undominated.ai > Pins Microsoft's Python document-translation skill, which uses Entra for new clients and limits blob SAS permissions on source and target containers. [← Explore all skills](/skills/) DOCUMENT TRANSLATION / Microsoft # Azure AI Document Translation for Python Pins Microsoft's Python document-translation skill, which uses Entra for new clients and limits blob SAS permissions on source and target containers. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Azure AI Document Translation SDK for batch translation of documents with format preservation. Use for translating Word, PDF, Excel, PowerPoint, and other document formats at scale. Triggers: "document translation", "batch translation", "translate documents", "DocumentTranslationClient". ” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The file says new code should use DefaultAzureCredential, avoid API keys, and set AZURE_TOKEN_CREDENTIALS in production to constrain the credential chain. - It says blob SAS tokens should carry minimal permissions: source read and list, and target write and list. ### A good fit for - Starting a batch document translation when the translator client uses Entra ID and the blob SAS tokens are limited to the permissions the skill lists ### Weigh up before choosing - This review did not execute the resource. - `/plugin install azure-sdk-python@skills` installs the azure-sdk-python plugin named in the plugin README, not this file alone. - The plugin README also prints `npx skills add microsoft/skills --skill azure-sdk-python` for that same plugin. - The repository README prints `/plugin install azure@skills`, which is a different plugin, and `npx skills add microsoft/skills`, which opens a wizard for the repository. - The repository README says the repository is under active development and says to load skills selectively. - Linked reference files were not opened. - The batch-translation samples require source and target container URLs, including with DefaultAzureCredential, and put SAS tokens in those URLs. The single-document sample instead submits local document bytes and writes the translated response to a local file. - cancel_translation is shown with no confirmation step and no dry-run. - The main sample uses DefaultAzureCredential() without require_envvar=True. The production environment variable is still named separately. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md - README.md - .github/plugins/azure-sdk-python/README.md - LICENSE ### Our findings - The file says to prefer DefaultAzureCredential and to avoid connection strings and API keys because they bypass Entra audit and rotation. - It says production must set AZURE_TOKEN_CREDENTIALS to prod, or to one named credential, to constrain the credential chain. - It says AzureKeyCredential is only for an existing keyed deployment that has not been migrated to Entra ID. - It says source and target containers must be Azure Blob Storage, and SAS permissions are source read and list, target write and list. - It shows cancel_translation for a running operation. ### Not established by this review - The resource was not executed and its tools were not called. - No Azure client was constructed and no credential was used. - The linked reference files were not opened. - The azure-sdk-python plugin was not installed. - No translation job was started and no translation was cancelled. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md) DOCUMENTED COMMAND /plugin install azure-sdk-python@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The plugin README shows `/plugin install azure-sdk-python@skills`. That installs the azure-sdk-python plugin, not this one file. - The same README also shows `npx skills add microsoft/skills --skill azure-sdk-python`. - The repository README shows `npx skills add microsoft/skills`, which starts a wizard for the repository, and `/plugin install azure@skills` for a different plugin. - The skill shows `pip install azure-ai-translation-document` for the SDK package. That line was not run. ### Before you start - Python if the skill's pip line is run; this review did not run it - A document-translation endpoint and source and target container URLs, as the skill's environment block names them - DefaultAzureCredential for new code, or the legacy key only for an unmigrated keyed deployment ### Compatibility GitHub Copilot · GitHub Copilot CLI ### Implementation python ### Local skill text; translation reads and writes blobs only if an operator runs a job - Read the skill text - Authenticate the translator client only if the operator uses a credential the skill names - Read a source container and write a target container only if the operator starts a translation with those SAS URLs - Cancel a running translation only if the operator calls cancel_translation - The single-document example reads document.docx from local disk, sends its bytes to translate, and writes the response to document_es.docx. ### Cost model MIT; no Azure or Python command was run 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-ai-translation-document-py SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md Supports: Entra preference, legacy key limit, and SAS read/list versus write/list - [Azure SDK Python plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md Supports: /plugin install azure-sdk-python@skills installs the plugin, not one file - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: MIT statement, Copilot CLI plugin install, and a different azure plugin command - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License - [Pinned definition rechecked for the 2026-10-15 resource wave ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md Supports: upstreamDescription, access.permissions, review, limitations KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Azure AI Content Safety for Python ↗ Pins Microsoft's Python Content Safety skill, which keeps new code on Entra credentials and can stop analysis when a blocklist matches.](/skills/microsoft-azure-ai-contentsafety-py/)[### Azure AI Language Conversations for Python ↗ Pins Microsoft's Python conversation-analysis skill, which tells new code to use token credentials and reserves API keys for unmigrated keyed deployments.](/skills/microsoft-azure-ai-language-conversations-py/)[### Azure AI Text Analytics for Python ↗ Pins Microsoft's Python text-analytics skill, which keeps new code on DefaultAzureCredential and reserves API keys for unmigrated keyed deployments.](/skills/microsoft-azure-ai-textanalytics-py/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)