--- title: "Azure Web PubSub Service Python: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/microsoft-azure-messaging-webpubsubservice-py/ description: "Pins the Web PubSub service Python skill, which prefers DefaultAzureCredential and says to limit client tokens with roles." --- # Azure Web PubSub Service Python: review, setup & limitations · Undominated.ai > Pins the Web PubSub service Python skill, which prefers DefaultAzureCredential and says to limit client tokens with roles. [← Explore all skills](/skills/) AZURE WEB PUBSUB / Microsoft # Azure Web PubSub Service Python Pins the Web PubSub service Python skill, which prefers DefaultAzureCredential and says to limit client tokens with roles. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/microsoft/skills/tree/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Microsoft Licence [MIT ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Revision fc164ba1d7a0 [Read what was—and wasn’t—checked ↓](#review) “Azure Web PubSub Service SDK for Python. Use for real-time messaging, WebSocket connections, and pub/sub patterns. Triggers: "azure-messaging-webpubsubservice", "WebPubSubServiceClient", "real-time", "WebSocket", "pub/sub". ” [Microsoft · upstream description ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The authentication block prefers DefaultAzureCredential and says connection strings and account or API keys bypass Entra audit and rotation. - The best-practice list says to use roles to limit client permissions and to generate short-lived tokens. ### A good fit for - Sending from the Web PubSub service client after issuing a client token that includes roles - Grant, revoke and check joinLeaveGroup permission for a specific Web PubSub connection and target group. ### Weigh up before choosing - This review did not execute the resource. - /plugin install azure-sdk-python@skills installs the azure-sdk-python plugin, not this file alone. The same plugin README also shows npx skills add microsoft/skills --skill azure-sdk-python. - The repository README quick start, npx skills add microsoft/skills, asks the operator to select skills and can install more than this file. - The repository README plugin block shows /plugin install azure@skills and links that row to azure-skills. That is not this azure-sdk-python file. - The root README licence line is MIT and the LICENSE file is the MIT License. The plugin README does not state a licence. The skill frontmatter also says MIT. - The first token sample is labeled for an anonymous user and calls get_client_access_token with no roles. The file does not refuse that call. - close_connection and close_all_connections are shown with no confirmation step. Only close_connection passes a reason. - Two best-practice items are both numbered 4. That does not change the role or token sentences. - The sample comment associates DefaultAzureCredential(require_envvar=True) with local development as well as production. The environment note says AZURE_TOKEN_CREDENTIALS is required only when that credential is used in production. This review did not execute the constructor. - references/capabilities.md and references/non-hero-scenarios.md were not opened. - The skill shows pip install azure-messaging-webpubsubservice and pip install azure-messaging-webpubsubclient. Neither line was run. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - .github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md - .github/plugins/azure-sdk-python/README.md - README.md - LICENSE ### Our findings - The authentication block prefers DefaultAzureCredential and says connection strings and account or API keys bypass Entra audit and rotation. - Production is told to set AZURE_TOKEN_CREDENTIALS to prod, or to one specific credential, and the service-client sample constructs DefaultAzureCredential with require_envvar set true. - The best-practice list says to use roles to limit client permissions and to generate short-lived tokens. - The first token sample is an anonymous user with no roles. A following sample passes user_id and a roles list. - Connection management shows close_connection with a reason and close_all_connections for a user id. Neither sample asks for confirmation. ### Not established by this review - The resource was not executed and its tools were not called. - No token was minted and no connection was closed. - references/capabilities.md and references/non-hero-scenarios.md were not opened. - This was source reading only and is not a runtime or security certification. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md) DOCUMENTED COMMAND /plugin install azure-sdk-python@skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The azure-sdk-python README shows /plugin install azure-sdk-python@skills. - That command installs the azure-sdk-python plugin. It does not install this one file by itself. - The same README shows npx skills add microsoft/skills --skill azure-sdk-python, which also targets that plugin rather than this file alone. - The repository README quick start, npx skills add microsoft/skills, asks the operator to select skills and can install more than this file. - The repository README plugin block shows /plugin install azure@skills for the azure plugin, which that README links to azure-skills, not to this file. ### Before you start - Copilot CLI if the plugin command is used - The skill shows pip install lines for azure-messaging-webpubsubservice and azure-messaging-webpubsubclient, which this review did not run - An Azure credential if the service-client samples are followed, which this review did not use ### Compatibility GitHub Copilot · Copilot CLI ### Implementation python ### Local skill text plus optional Web PubSub service permissions - Read the skill - Mint a client token, send, or close connections only if the operator uses an Azure credential to follow the samples, which this review did not do ### Cost model MIT; no Azure call was made 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [azure-messaging-webpubsubservice-py SKILL.md ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md Supports: DefaultAzureCredential preference and role-limited client tokens - [azure-sdk-python plugin README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md Supports: plugin install line for azure-sdk-python, not this file alone - [Repository README ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md Supports: MIT statement and a different azure plugin install line - [Repository LICENSE ↗](https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE) Checked 2026-10-14 https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE Supports: MIT License - [Pinned source sections reviewed in continuation W24 on 2026-10-15 ↗](https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md Supports: upstreamDescription, bestFor, review.reviewedAt, review.notTested KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### API Center management SDK ↗ Pins Microsoft's API Center Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client.](/skills/microsoft-azure-mgmt-apicenter-py/)[### API Management SDK ↗ Pins Microsoft's API Management Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client.](/skills/microsoft-azure-mgmt-apimanagement-py/)[### Azure AI Content Safety for Python ↗ Pins Microsoft's Python Content Safety skill, which keeps new code on Entra credentials and can stop analysis when a blocklist matches.](/skills/microsoft-azure-ai-contentsafety-py/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)