diff --git a/changelogs/unreleased/10363-samay43 b/changelogs/unreleased/10363-samay43
new file mode 100644
index 000000000..b562a4cdf
--- /dev/null
+++ b/changelogs/unreleased/10363-samay43
@@ -0,0 +1 @@
+stop routing credential selection on AZURE_USERNAME after username/password removal
diff --git a/pkg/util/azure/credential.go b/pkg/util/azure/credential.go
index f36eb43a6..aeaff74f0 100644
--- a/pkg/util/azure/credential.go
+++ b/pkg/util/azure/credential.go
@@ -37,8 +37,7 @@ func NewCredential(creds map[string]string, options policy.ClientOptions) (azcor
 	// config credential
 	if len(creds[CredentialKeyClientSecret]) > 0 ||
 		len(creds[CredentialKeyClientCertificate]) > 0 ||
-		len(creds[CredentialKeyClientCertificatePath]) > 0 ||
-		len(creds[CredentialKeyUsername]) > 0 {
+		len(creds[CredentialKeyClientCertificatePath]) > 0 {
 		return newConfigCredential(creds, configCredentialOptions{
 			ClientOptions:              options,
 			AdditionallyAllowedTenants: additionalTenants,
diff --git a/pkg/util/azure/credential_test.go b/pkg/util/azure/credential_test.go
index 40dd5e2c6..d92ee6a8f 100644
--- a/pkg/util/azure/credential_test.go
+++ b/pkg/util/azure/credential_test.go
@@ -69,6 +69,28 @@ func TestNewCredential(t *testing.T) {
 	assert.IsType(t, &azidentity.WorkloadIdentityCredential{}, tokenCredential)
 	os.Clearenv()
 
+	// a leftover AZURE_USERNAME must not hijack credential selection. Username/password
+	// handling was removed from newConfigCredential in #9041, so routing on it sends the
+	// caller into a function that cannot serve it and short-circuits the workload
+	// identity and managed identity branches below.
+	os.Setenv(CredentialKeyTenantID, "tenantid")
+	os.Setenv(CredentialKeyClientID, "clientid")
+	os.Setenv("AZURE_FEDERATED_TOKEN_FILE", "/tmp/token")
+	creds = map[string]string{CredentialKeyUsername: "username"}
+	tokenCredential, err = NewCredential(creds, options)
+	require.NoError(t, err)
+	assert.IsType(t, &azidentity.WorkloadIdentityCredential{}, tokenCredential)
+	os.Clearenv()
+
+	// ... and must not short-circuit managed identity either
+	creds = map[string]string{
+		CredentialKeyClientID: "clientid",
+		CredentialKeyUsername: "username",
+	}
+	tokenCredential, err = NewCredential(creds, options)
+	require.NoError(t, err)
+	assert.IsType(t, &azidentity.ManagedIdentityCredential{}, tokenCredential)
+
 	// managed identity credential
 	creds = map[string]string{CredentialKeyClientID: "clientid"}
 	tokenCredential, err = NewCredential(creds, options)