Support the Azure default credential chain for Azure OpenAI authentication

What variant of Codex are you using?

CLI, App

What feature would you like to see?

I would like to see an option for the Codex CLI (and now App) to work with the Azure default credential chain. This would allow users to simply az login, setup their $HOME/.codex/config.toml to something like:

model = "gpt-5.2-codex"
model_reasoning_effort = "medium"
personality = "pragmatic"

model_provider = "azure"

[model_providers.azure]
name = "Azure OpenAI"
base_url = "https://<YOUR-FOUNDRY-RESOURCE>.openai.azure.com/openai/v1"
azure_auth = "default_credential"
wire_api = "responses"

and for Codex to "just work".

Additional information

My primary motivation is that as far as I can tell, Microsoft Foundry only allows you to have one API key. For my engineering team, we don't want to share, and would rather use Entra ID auth per-user with permissions managed like that. Claude Code already supports this and we're using it this way: https://code.claude.com/docs/en/microsoft-foundry#2-configure-azure-credentials

This should also be very straightforward using the Azure identity Rust crate. Happy to contribute this myself -- I understand the domain well (former Azure employee & decent at Rust).