[Robbie-Microsoft]

Fixes #6172

What broke

#6070 (3680c2fe2) moved the IMDSv2 mTLS-PoP token leg to the shared TokenClient → OAuth2Client → HttpManager path. The retry logic survived that move — it was re-implemented in ManagedIdentityAuthRequest. What did not survive was AbstractManagedIdentity.HandleException, which normalized raw transport failures into MsalServiceException(ManagedIdentityUnreachableNetwork).

That method manufactured both halves of the catch filter the retry depends on — the exception type and the error code. Once it left the path, the filter could never match:

	Exception reaching the filter
Before #6070	MsalServiceException → HttpRequestException → AuthenticationException — matched
After #6070	HttpRequestException → AuthenticationException → Win32Exception — type mismatch

Net effect: a KeyGuard/CNG-bound cert Schannel can no longer use (SEC_E_UNKNOWN_CREDENTIALS, 0x8009030D) surfaced as a bare HttpRequestException instead of triggering the re-mint-and-retry that exists precisely for it. No packet leaves the machine — this is not a transient network condition, it's a stale binding cert that only a re-mint fixes.

Unintended exception-contract change, not a behavior change anyone signed off on.

Fix

DelegateImdsV2TokenLegAsync — restore normalization. Wrap tokenClient.SendTokenRequestAsync and re-normalize failures MSAL doesn't already own into MsalServiceException, mirroring HandleException. Scoped to the token call only — the mint step already throws MSAL-shaped exceptions, so wrapping it would double-wrap. The error-code mapping mirrors HandleException: HttpRequestException → managed_identity_unreachable_network, FormatException → invalid_managed_identity_endpoint (reachable because the token endpoint is built from binding.Endpoint, an IMDS-supplied value), everything else → managed_identity_request_failed. Guard is ex is not MsalException, stricter than the old MsalServiceException check, so MsalClientException is preserved rather than masked. OperationCanceledException passes through untouched.

ShouldRemintImdsV2Binding — defense in depth. Widen the catch from catch (MsalServiceException ex) to catch (Exception ex) when (...). Being explicit: this layer is not required to fix the bug — the normalization change alone makes every new test pass, and I isolated the layers to confirm that. It's here because the original filter only worked by accident of a wrapper three call-frames away. That coupling is what let this regress silently. Cancellation is explicitly excluded.

IsSchanelFailure → IsSchannelFailure(Exception). Typo fix, parameter generalized from MsalServiceException. internal static — no public API surface change, no PublicAPI.Unshipped.txt entry. Detection logic byte-for-byte unchanged: it still keys on AuthenticationException broadly, which also catches server-cert validation failures. That over-trigger is bounded (one wasted re-mint, then the real error propagates) and narrowing it to SEC_E_UNKNOWN_CREDENTIALS / SEC_E_NO_CREDENTIALS is a semantic change I'm keeping out of a regression fix. Happy to pull it forward if a reviewer wants it here.

Compatibility

The regression shipped in 4.85.2 through 4.88.0. On those versions this failure surfaces as a raw HttpRequestException; after this fix it surfaces as MsalServiceException again, with the original exception preserved as InnerException. That restores the documented managed identity contract, but anyone who added a catch (HttpRequestException) workaround on 4.85.2+ will find it no longer fires and should revert it. No public API added, removed, or annotated.

Tests

Eight end-to-end regression tests in ImdsV2Tests.cs. Attempt counts are asserted via MockHttpManager.QueueSize, so "retries exactly once" is proven rather than inferred from a successful return.

Test	Covers
mTLSPop_TokenLeg_RawSchannelFailure_...	Re-mint + retry on a raw Schannel failure
mTLSPop_TokenLeg_RepeatedSchannelFailure_...	Retries once, then propagates
mTLSPop_TokenLeg_UnrelatedNetworkFailure_...	Unrelated failures neither retried nor swallowed
mTLSPop_TokenLeg_NonHttpFailure_...	Non-HttpRequestException normalized onto managed_identity_request_failed
mTLSPop_TokenLeg_FormatFailure_...	FormatException keeps invalid_managed_identity_endpoint, not the generic code
BearerOverMtls_TokenLeg_SchannelFailure_...	Same behavior for WithRequestOverMtls as for PoP
mTLSPop_Unattested_TokenLeg_SchannelFailure_...	Same behavior without WithAttestationSupport
mTLSPop_TokenLeg_Cancellation_...	Cancellation still propagates un-wrapped, consumes no re-mint

WithRequestOverMtls had zero coverage in Test.Unit before this.

Three detector tests in PersistentCertificateStoreUnitTests.cs. These also drop a reflection-based lookup of the old method name — the rename would have broken it, and reflection-coupled tests are how a rename becomes a silent hole.

Reverted the fix in place and re-ran. All six Schannel/normalization tests fail against the pre-fix behavior with exactly the reported symptom (Actual exception type:<System.Net.Http.HttpRequestException>) and pass against the new. mTLSPop_TokenLeg_FormatFailure_... was likewise verified to fail against the pre-fix error-code mapping. The cancellation test passes both before and after by design — it guards the fix against over-reaching, it does not reproduce the bug. Calling that out rather than claiming eight regression tests.

Full ManagedIdentity suite on both target frameworks — net8.0 and net48 each report 462 passed, 1 skipped, 0 failed. Clean build under TreatWarningsAsErrors.

Acceptance criteria (#6172)

All five criteria are verbatim from the issue. Unit evidence is from ImdsV2Tests.cs; E2E evidence is from CI run 20260901.8 on the MI-enabled Azure VM pool (20/20 passed), which exercises real IMDSv2 with Credential Guard.

#	Criterion	Status	Evidence
1	Raw Schannel HttpRequestException failures trigger one certificate re-mint and retry	Met	mTLSPop_TokenLeg_RawSchannelFailure_... (re-mints + retries) and ..._RepeatedSchannelFailure_... (retries once, then propagates). Attempt counts asserted via QueueSize; both fail against pre-fix code
2	Retry behavior is identical for mTLS PoP and bearer-over-mTLS	Met	BearerOverMtls_TokenLeg_SchannelFailure_... mirrors the PoP test — both paths share SendDelegatedImdsV2TokenRequestAsync. E2E: AcquireToken_OnImdsV2_WithRequestOverMtls_ReturnsBearer passed for SAMI + UAMI
3	Both attested and unattested IMDSv2 E2E tests pass	Met	Attested: AcquireToken_OnImdsV2_MtlsPoP_WithAttestation_Succeeds (SAMI + UAMI-ClientId) and AcquireTokenAndCallAKV_.... Unattested: AcquireToken_OnImdsV2_MtlsPoP_GracefulDegradation_WhenCredentialGuardUnavailable
4	Microsoft.Identity.Web MI FIC two-leg mTLS PoP tests pass	Met by equivalent coverage	ManagedIdentityImdsV2FicTests.FicTwoLeg_MtlsPop_SAMI / _UAMI-ClientId passed E2E (plus both FicTwoLeg_Bearer_*). This is the same code path Identity.Web's ManagedIdentityClientAssertion drives. Identity.Web's own suite was not run against this branch — its test is [OnlyOnAzureDevopsFact]; static review found no risk (below)
5	Cancellation and unrelated network failures are not retried	Met	mTLSPop_TokenLeg_Cancellation_... (propagates un-wrapped, consumes no re-mint) and ..._UnrelatedNetworkFailure_... (neither retried nor swallowed). Both assert QueueSize

Being precise on #4: MSAL's own FIC two-leg mTLS PoP E2E tests pass against live Azure MI, which covers the underlying behavior. Executing Identity.Web's suite against an unreleased MSAL build is the one gap, and it's called out rather than papered over.

Downstream: Microsoft.Identity.Web

Checked against a local microsoft-identity-web checkout. No risk found:

• MsiFic_TwoLeg_FinalMtlsPop_SystemAssignedManagedIdentityAsync exists (tests/E2E Tests/TokenAcquirerTests/ManagedIdentityFicTests.cs). It is [OnlyOnAzureDevopsFact] and needs live Azure MI + Credential Guard, so it can only be validated in their CI.
• Identity.Web pins MSAL 4.88.0 (Directory.Build.props) — inside the affected range.
• Its managed identity path catches Exception, logs, and rethrows unfiltered; it does not discriminate on exception type. ManagedIdentityClientAssertion already documents that bind failures "surface as an MsalServiceException from ExecuteAsync", which is the contract this PR restores.
• Its certificate-retry filter keys on invalid_client + specific AADSTS codes, so managed_identity_* error codes cannot trigger a spurious retry.
• The HttpRequestException filters in DownstreamApi.HttpMethods.cs are on downstream API calls, not token acquisition.

<!-- BEGIN pr-telemetry -->
assistance: agentic-cli
type: bug
agent-tool: copilot-cli
agent-model: claude-opus-5
work-item: AB#n/a
<!-- END pr-telemetry -->

[Copilot]

Pull request overview

This PR fixes a regression in IMDSv2 mTLS-PoP token acquisition where SCHANNEL/transport failures in the delegated TokenClient path were no longer normalized into MSAL exceptions, causing the existing “re-mint binding cert and retry once” recovery logic to never trigger.

Changes:

• Restores transport-failure normalization in the delegated IMDSv2 token-leg call so callers see MsalServiceException (with original exception preserved as InnerException).
• Hardens the re-mint-and-retry filter to handle both MSAL-shaped and raw transport exception chains (while excluding cancellation).
• Adds regression/unit tests covering raw SCHANNEL transport chains, bounded single retry behavior, and non-SCHANNEL failure classification.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/PersistentCertificateStoreUnitTests.cs	Updates SCHANNEL detector tests to call the internal helper directly (no reflection) and adds coverage for raw transport exception chains.
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ImdsV2Tests.cs	Adds end-to-end regression tests proving re-mint+retry behavior for raw SCHANNEL failures and ensuring unrelated failures are not retried and are normalized.
src/client/Microsoft.Identity.Client/ManagedIdentity/V2/ImdsV2ManagedIdentitySource.cs	Renames/generalizes SCHANNEL detection helper to accept any Exception chain, supporting both wrapped and raw transport failures.
src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs	Wraps unowned delegated token-leg exceptions into managed identity MsalServiceException and broadens the retry filter to operate on any exception chain.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs:285

• The comment says SCHANNEL-shaped failures from the mint step are "recoverable by re-minting", but the mint flow (/getplatformmetadata + /issuecredential) does not present the binding certificate in a client mTLS handshake. A SCHANNEL/AuthenticationException during mint is more likely a generic TLS/transport issue, so the rationale here is misleading. Consider rewording to reflect that this is a bounded retry rather than a cert-specific recovery.

        // Failures from the mint step itself are intentionally in scope: minting talks to the IMDS endpoint over
        // TLS, so a handshake failure there is just as recoverable by re-minting. The retry is bounded to a
        // single additional attempt either way. Cancellation is never retried.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Gladwin Johnson VR (gladjohn)]

looks good Robbie-Microsoft, just two minor comments

[Copilot]

🟢 Approval recommended

The change restores a prior exception contract and retry behavior with targeted, deterministic regression tests covering the reported failure mode and key non-regression cases (cancellation/unrelated failures).

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite