Skip to content

Use tenant ID for KeyGuard attestation client_id metadata - #6200

Merged
Gladwin Johnson VR (gladjohn) merged 3 commits into
mainfrom
gladjohn/issue-6196-tenant-id-attestation-v2
Sep 25, 2026
Merged

Use tenant ID for KeyGuard attestation client_id metadata#6200
Gladwin Johnson VR (gladjohn) merged 3 commits into
mainfrom
gladjohn/issue-6196-tenant-id-attestation-v2

Conversation

@gladjohn

@gladjohn Gladwin Johnson VR (gladjohn) commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

Fixes #6196

Changes proposed in this request

  • Send the tenant ID from IMDS CSR metadata as the MAA client_id telemetry value for KeyGuard attestation.
  • Keep the managed identity client ID unchanged for CSR generation, certificate-cache partitioning, token requests, and access-token caching.
  • Clarify that the attestation delegate's third argument is metadata rather than an attestation cache-key component.
  • Add regression coverage proving tenant-ID forwarding and cache reuse when the metadata value changes.

Testing

  • Complete Microsoft.Identity.Test.Unit suite:
    • .NET 8: 2,373 passed, 22 skipped, 0 failed.
    • .NET Framework 4.8: 2,378 passed, 22 skipped, 0 failed.
  • Azure-backed integration tests require protected lab credentials and cannot be executed locally.

Performance impact

  • None expected. The MAA attestation cache remains keyed by normalized endpoint and KeyGuard key ID.

Documentation

  • All relevant documentation is updated.

assistance: agentic-cli
type: feature
agent-tool: copilot-cli
agent-model: gpt-5.6-sol
work-item: AB#n/a

@gladjohn
Send tenant ID for KeyGuard attestation metadata
0713f8e 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 82296f1c-8567-4bdf-9cd3-f67b168afb77
@gladjohn
Preserve KeyGuard attestor parameter compatibility
2ab954a 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 82296f1c-8567-4bdf-9cd3-f67b168afb77
Copilot AI lite review requested due to automatic review settings September 24, 2026 20:11
@gladjohn Gladwin Johnson VR (gladjohn) added agentic-cli Terminal AI agent drove the bulk of the edits feature labels Sep 24, 2026
Copilot AI reviewed Sep 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Updates IMDSv2 KeyGuard attestation to send the tenant ID as MAA client_id metadata while preserving existing client-ID and cache behavior.

Changes:

  • Forward tenant ID through attestation.
  • Clarify metadata and caching semantics.
  • Add regression tests for forwarding and cache reuse.
File Description
tests/​Microsoft.Identity.Test.Unit/​ManagedIdentityTests/​ImdsV2Tests.cs Adds tenant-forwarding and cache regression tests.
src/​client/​Microsoft.Identity.Client/​ManagedIdentity/​V2/​ImdsV2ManagedIdentitySource.cs Forwards tenant metadata during attestation.
src/​client/​Microsoft.Identity.Client/​ApiConfig/​Parameters/​AcquireTokenForManagedIdentityParameters.cs Updates delegate documentation.
src/​client/​Microsoft.Identity.Client/​ApiConfig/​Parameters/​AcquireTokenCommonParameters.cs Updates delegate documentation.
src/​client/​Microsoft.Identity.Client.KeyAttestation/​PopKeyAttestor.cs Clarifies metadata and cache-key behavior.
src/​client/​Microsoft.Identity.Client.KeyAttestation/​ManagedIdentityAttestationExtensions.cs Passes metadata through the provider delegate.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@gladjohn
Gladwin Johnson VR (gladjohn) marked this pull request as ready for review September 24, 2026 21:44
@gladjohn

Gladwin Johnson VR (gladjohn) commented Sep 25, 2026

Copy link
Copy Markdown
Contributor Author

Copilot merge main into this branch

Merge remote-tracking branch 'origin/main' into gladjohn/issue-6196-t…
b6e2c93 
…enant-id-attestation-v2

Co-authored-by: gladjohn <90415114+gladjohn@users.noreply.github.com>
Copilot AI review requested due to automatic review settings September 25, 2026 10:17

Copilot AI commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Copilot merge main into this branch

Merged main into this branch in merge commit b6e2c93.

Copilot AI reviewed Sep 25, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None

bgavrilMS
Bogdan Gavril (bgavrilMS) approved these changes Sep 25, 2026
View reviewed changes

@bgavrilMS Bogdan Gavril (bgavrilMS) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Are we now porting all fixes to MSAL Go?

@gladjohn
Gladwin Johnson VR (gladjohn) merged commit 42f8d9d into main Sep 25, 2026
19 checks passed
@gladjohn
Gladwin Johnson VR (gladjohn) deleted the gladjohn/issue-6196-tenant-id-attestation-v2 branch September 25, 2026 13:32
Copilot AI mentioned this pull request Sep 25, 2026
Merged
1 task done
This was referenced Sep 26, 2026
Closed
Closed
Merged
Merged
Closed
Closed
Closed
Closed
This was referenced Oct 25, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Open
Open
@Robbie-Microsoft Robbie-Microsoft mentioned this pull request Oct 27, 2026
Open
3 tasks
This was referenced Oct 29, 2026
Open
Open
Steinar Hjellvik (shjellvik) added a commit to equinor/osdu-csharp-client that referenced this pull request Oct 30, 2026
@dependabot @shjellvik
deps: Bump the nuget group with 19 updates (#139)
1dd1d58 
Updated
[Microsoft.Extensions.Configuration](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration.Abstractions](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration.Abstractions's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration.Binder](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration.Binder's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration.EnvironmentVariables](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration.EnvironmentVariables's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration.Json](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration.Json's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Configuration.UserSecrets](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Configuration.UserSecrets's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Extensions.Logging.Abstractions](https://github.com/dotnet/dotnet)
from 10.0.11 to 10.0.13.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Extensions.Logging.Abstractions's
releases](https://github.com/dotnet/dotnet/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/dotnet/dotnet/commits).
</details>

Updated
[Microsoft.Identity.Client](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet)
from 4.88.0 to 4.91.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Client's
releases](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/releases)._

## 4.91.0

### New Features

- Made the dynamic certificate provider and confidential-client
callbacks (`OnMsalServiceFailure`, `OnCompletion`, and
`OnBackgroundTokenRefreshCompleted`) generally available, removing the
experimental feature opt-in requirement.
[#​6216](AzureAD/microsoft-authentication-library-for-dotnet#6216)

### Bug Fixes

- Fixed built-in mTLS `HttpClient` caching to use certificate object
identity, ensuring a new certificate instance with a reacquired
private-key handle receives a new handler even when its thumbprint is
unchanged.
[#​6217](AzureAD/microsoft-authentication-library-for-dotnet#6217)
- Fixed managed identity `WithForceRefresh(true)` to re-mint the MSI v2
binding certificate before acquiring a new token, while reusing a valid
cached attestation token for the current key.
[#​6215](AzureAD/microsoft-authentication-library-for-dotnet#6215)
- Fixed system-browser authentication callbacks in Linux containers by
adding opt-in IPv4 port-forwarding support through
`MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING`, disabled by default.
[#​6186](AzureAD/microsoft-authentication-library-for-dotnet#6186)

## 4.90.1

### New Features
- Added `IMsalWsTrustHttpClientFactory`, allowing custom HTTP client
factories to provide redirect-disabled, credential-policy-aware clients
for federation metadata (MEX) and WS-Trust requests. Added
`MsalError.TooManyRedirects` and
`MsalError.WsTrustCrossOriginRedirectNotSupported` for redirect
failures.
[#​6165](AzureAD/microsoft-authentication-library-for-dotnet#6165)

### Bug Fixes
- Hardened federation metadata and WS-Trust requests by requiring HTTPS,
securely validating redirects, rejecting credential-bearing cross-origin
redirects, and limiting redirect chains.
[#​6165](AzureAD/microsoft-authentication-library-for-dotnet#6165)
- Fixed instance discovery so a custom authority port is not forwarded
to the global discovery host, while preserving the port when discovery
uses the authority host.
[#​6155](AzureAD/microsoft-authentication-library-for-dotnet#6155)
- Fixed KeyGuard attestation to send the tenant ID as the MAA
`client_id` metadata value without changing managed-identity client-ID
handling or attestation-cache partitioning.
[#​6200](AzureAD/microsoft-authentication-library-for-dotnet#6200)

### Changes
- Updated `Microsoft.Azure.Security.KeyGuardAttestation` from version
1.1.7 to 1.1.8.
[#​6202](AzureAD/microsoft-authentication-library-for-dotnet#6202)


## 4.90.0

### Changes
- Updated the KeyGuardAttestation package version to 1.1.7.
[#​6189](AzureAD/microsoft-authentication-library-for-dotnet#6189)

## 4.89.0

## What's Changed
* Add repository guidance for AI agents by @​bgavrilMS in
AzureAD/microsoft-authentication-library-for-dotnet#6158
* Add Linux Attested Managed Identity Flow documentation by @​gladjohn
in
AzureAD/microsoft-authentication-library-for-dotnet#6149
* Remove internal authority example from API docs by @​bgavrilMS in
AzureAD/microsoft-authentication-library-for-dotnet#6170
* Update SNI MTLS PoP Token Design documentation by @​bgavrilMS in
AzureAD/microsoft-authentication-library-for-dotnet#6171
* Add SNI mTLS E2E coverage for a non-exportable VBS-protected
certificate by @​gladjohn in
AzureAD/microsoft-authentication-library-for-dotnet#6167
* Revise mTLS PoP acceptance-test matrix structure by @​gladjohn in
AzureAD/microsoft-authentication-library-for-dotnet#6161
* Add ICloudConfiguration for cross-cloud metadata resolution by
@​Avery-Dunn in
AzureAD/microsoft-authentication-library-for-dotnet#6104
* Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry by
@​Robbie-Microsoft in
AzureAD/microsoft-authentication-library-for-dotnet#6173
* Always record RawStsErrorCode on MsalFailure metric by @​ssmelov in
AzureAD/microsoft-authentication-library-for-dotnet#6175
* Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity by
@​Robbie-Microsoft in
AzureAD/microsoft-authentication-library-for-dotnet#6178
* Add timeout for managed identity capability discovery by
@​Robbie-Microsoft in
AzureAD/microsoft-authentication-library-for-dotnet#6181
* Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in
AzureAD/microsoft-authentication-library-for-dotnet#6182

## New Contributors
* @​danfiedler-msft made their first contribution in
AzureAD/microsoft-authentication-library-for-dotnet#6182

**Full Changelog**:
AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.89.0

Commits viewable in [compare
view](AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.91.0).
</details>

Updated
[Microsoft.Identity.Client.Extensions.Msal](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet)
from 4.88.0 to 4.91.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Client.Extensions.Msal's
releases](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/releases)._

## 4.91.0

### New Features

- Made the dynamic certificate provider and confidential-client
callbacks (`OnMsalServiceFailure`, `OnCompletion`, and
`OnBackgroundTokenRefreshCompleted`) generally available, removing the
experimental feature opt-in requirement.
[#​6216](AzureAD/microsoft-authentication-library-for-dotnet#6216)

### Bug Fixes

- Fixed built-in mTLS `HttpClient` caching to use certificate object
identity, ensuring a new certificate instance with a reacquired
private-key handle receives a new handler even when its thumbprint is
unchanged.
[#​6217](AzureAD/microsoft-authentication-library-for-dotnet#6217)
- Fixed managed identity `WithForceRefresh(true)` to re-mint the MSI v2
binding certificate before acquiring a new token, while reusing a valid
cached attestation token for the current key.
[#​6215](AzureAD/microsoft-authentication-library-for-dotnet#6215)
- Fixed system-browser authentication callbacks in Linux containers by
adding opt-in IPv4 port-forwarding support through
`MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING`, disabled by default.
[#​6186](AzureAD/microsoft-authentication-library-for-dotnet#6186)

## 4.90.1

### New Features
- Added `IMsalWsTrustHttpClientFactory`, allowing custom HTTP client
factories to provide redirect-disabled, credential-policy-aware clients
for federation metadata (MEX) and WS-Trust requests. Added
`MsalError.TooManyRedirects` and
`MsalError.WsTrustCrossOriginRedirectNotSupported` for redirect
failures.
[#​6165](AzureAD/microsoft-authentication-library-for-dotnet#6165)

### Bug Fixes
- Hardened federation metadata and WS-Trust requests by requiring HTTPS,
securely validating redirects, rejecting credential-bearing cross-origin
redirects, and limiting redirect chains.
[#​6165](AzureAD/microsoft-authentication-library-for-dotnet#6165)
- Fixed instance discovery so a custom authority port is not forwarded
to the global discovery host, while preserving the port when discovery
uses the authority host.
[#​6155](AzureAD/microsoft-authentication-library-for-dotnet#6155)
- Fixed KeyGuard attestation to send the tenant ID as the MAA
`client_id` metadata value without changing managed-identity client-ID
handling or attestation-cache partitioning.
[#​6200](AzureAD/microsoft-authentication-library-for-dotnet#6200)

### Changes
- Updated `Microsoft.Azure.Security.KeyGuardAttestation` from version
1.1.7 to 1.1.8.
[#​6202](AzureAD/microsoft-authentication-library-for-dotnet#6202)


## 4.90.0

### Changes
- Updated the KeyGuardAttestation package version to 1.1.7.
[#​6189](AzureAD/microsoft-authentication-library-for-dotnet#6189)

## 4.89.0

## What's Changed
* Add repository guidance for AI agents by @​bgavrilMS in
AzureAD/microsoft-authentication-library-for-dotnet#6158
* Add Linux Attested Managed Identity Flow documentation by @​gladjohn
in
AzureAD/microsoft-authentication-library-for-dotnet#6149
* Remove internal authority example from API docs by @​bgavrilMS in
AzureAD/microsoft-authentication-library-for-dotnet#6170
* Update SNI MTLS PoP Token Design documentation by @​bgavrilMS in
AzureAD/microsoft-authentication-library-for-dotnet#6171
* Add SNI mTLS E2E coverage for a non-exportable VBS-protected
certificate by @​gladjohn in
AzureAD/microsoft-authentication-library-for-dotnet#6167
* Revise mTLS PoP acceptance-test matrix structure by @​gladjohn in
AzureAD/microsoft-authentication-library-for-dotnet#6161
* Add ICloudConfiguration for cross-cloud metadata resolution by
@​Avery-Dunn in
AzureAD/microsoft-authentication-library-for-dotnet#6104
* Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry by
@​Robbie-Microsoft in
AzureAD/microsoft-authentication-library-for-dotnet#6173
* Always record RawStsErrorCode on MsalFailure metric by @​ssmelov in
AzureAD/microsoft-authentication-library-for-dotnet#6175
* Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity by
@​Robbie-Microsoft in
AzureAD/microsoft-authentication-library-for-dotnet#6178
* Add timeout for managed identity capability discovery by
@​Robbie-Microsoft in
AzureAD/microsoft-authentication-library-for-dotnet#6181
* Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in
AzureAD/microsoft-authentication-library-for-dotnet#6182

## New Contributors
* @​danfiedler-msft made their first contribution in
AzureAD/microsoft-authentication-library-for-dotnet#6182

**Full Changelog**:
AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.89.0

Commits viewable in [compare
view](AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.91.0).
</details>

Updated
[Microsoft.Kiota.Abstractions](https://github.com/microsoft/kiota-dotnet)
from 2.1.1 to 2.1.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Kiota.Abstractions's
releases](https://github.com/microsoft/kiota-dotnet/releases)._

## 2.1.2

##
[2.1.2](microsoft/kiota-dotnet@v2.1.1...v2.1.2)
(2026-09-08)


### Bug Fixes

* **serialization-json:** honor custom TimeSpan converters
([#​795](microsoft/kiota-dotnet#795))
([e22c5ba](microsoft/kiota-dotnet@e22c5ba))
* **serialization-json:** honor DateTimeOffset converters
([802e20a](microsoft/kiota-dotnet@802e20a))
* **serialization-json:** honor guid converters before fallback parsing
([#​794](microsoft/kiota-dotnet#794))
([22cc1d3](microsoft/kiota-dotnet@22cc1d3))

Commits viewable in [compare
view](microsoft/kiota-dotnet@v2.1.1...v2.1.2).
</details>

Updated
[Microsoft.Kiota.Http.HttpClientLibrary](https://github.com/microsoft/kiota-dotnet)
from 2.1.1 to 2.1.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Kiota.Http.HttpClientLibrary's
releases](https://github.com/microsoft/kiota-dotnet/releases)._

## 2.1.2

##
[2.1.2](microsoft/kiota-dotnet@v2.1.1...v2.1.2)
(2026-09-08)


### Bug Fixes

* **serialization-json:** honor custom TimeSpan converters
([#​795](microsoft/kiota-dotnet#795))
([e22c5ba](microsoft/kiota-dotnet@e22c5ba))
* **serialization-json:** honor DateTimeOffset converters
([802e20a](microsoft/kiota-dotnet@802e20a))
* **serialization-json:** honor guid converters before fallback parsing
([#​794](microsoft/kiota-dotnet#794))
([22cc1d3](microsoft/kiota-dotnet@22cc1d3))

Commits viewable in [compare
view](microsoft/kiota-dotnet@v2.1.1...v2.1.2).
</details>

Updated
[Microsoft.Kiota.Serialization.Form](https://github.com/microsoft/kiota-dotnet)
from 2.1.1 to 2.1.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Kiota.Serialization.Form's
releases](https://github.com/microsoft/kiota-dotnet/releases)._

## 2.1.2

##
[2.1.2](microsoft/kiota-dotnet@v2.1.1...v2.1.2)
(2026-09-08)


### Bug Fixes

* **serialization-json:** honor custom TimeSpan converters
([#​795](microsoft/kiota-dotnet#795))
([e22c5ba](microsoft/kiota-dotnet@e22c5ba))
* **serialization-json:** honor DateTimeOffset converters
([802e20a](microsoft/kiota-dotnet@802e20a))
* **serialization-json:** honor guid converters before fallback parsing
([#​794](microsoft/kiota-dotnet#794))
([22cc1d3](microsoft/kiota-dotnet@22cc1d3))

Commits viewable in [compare
view](microsoft/kiota-dotnet@v2.1.1...v2.1.2).
</details>

Updated
[Microsoft.Kiota.Serialization.Json](https://github.com/microsoft/kiota-dotnet)
from 2.1.1 to 2.1.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Kiota.Serialization.Json's
releases](https://github.com/microsoft/kiota-dotnet/releases)._

## 2.1.2

##
[2.1.2](microsoft/kiota-dotnet@v2.1.1...v2.1.2)
(2026-09-08)


### Bug Fixes

* **serialization-json:** honor custom TimeSpan converters
([#​795](microsoft/kiota-dotnet#795))
([e22c5ba](microsoft/kiota-dotnet@e22c5ba))
* **serialization-json:** honor DateTimeOffset converters
([802e20a](microsoft/kiota-dotnet@802e20a))
* **serialization-json:** honor guid converters before fallback parsing
([#​794](microsoft/kiota-dotnet#794))
([22cc1d3](microsoft/kiota-dotnet@22cc1d3))

Commits viewable in [compare
view](microsoft/kiota-dotnet@v2.1.1...v2.1.2).
</details>

Updated
[Microsoft.Kiota.Serialization.Multipart](https://github.com/microsoft/kiota-dotnet)
from 2.1.1 to 2.1.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Kiota.Serialization.Multipart's
releases](https://github.com/microsoft/kiota-dotnet/releases)._

## 2.1.2

##
[2.1.2](microsoft/kiota-dotnet@v2.1.1...v2.1.2)
(2026-09-08)


### Bug Fixes

* **serialization-json:** honor custom TimeSpan converters
([#​795](microsoft/kiota-dotnet#795))
([e22c5ba](microsoft/kiota-dotnet@e22c5ba))
* **serialization-json:** honor DateTimeOffset converters
([802e20a](microsoft/kiota-dotnet@802e20a))
* **serialization-json:** honor guid converters before fallback parsing
([#​794](microsoft/kiota-dotnet#794))
([22cc1d3](microsoft/kiota-dotnet@22cc1d3))

Commits viewable in [compare
view](microsoft/kiota-dotnet@v2.1.1...v2.1.2).
</details>

Updated
[Microsoft.Kiota.Serialization.Text](https://github.com/microsoft/kiota-dotnet)
from 2.1.1 to 2.1.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Kiota.Serialization.Text's
releases](https://github.com/microsoft/kiota-dotnet/releases)._

## 2.1.2

##
[2.1.2](microsoft/kiota-dotnet@v2.1.1...v2.1.2)
(2026-09-08)


### Bug Fixes

* **serialization-json:** honor custom TimeSpan converters
([#​795](microsoft/kiota-dotnet#795))
([e22c5ba](microsoft/kiota-dotnet@e22c5ba))
* **serialization-json:** honor DateTimeOffset converters
([802e20a](microsoft/kiota-dotnet@802e20a))
* **serialization-json:** honor guid converters before fallback parsing
([#​794](microsoft/kiota-dotnet#794))
([22cc1d3](microsoft/kiota-dotnet@22cc1d3))

Commits viewable in [compare
view](microsoft/kiota-dotnet@v2.1.1...v2.1.2).
</details>

Updated [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest)
from 18.9.0 to 18.11.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.NET.Test.Sdk's
releases](https://github.com/microsoft/vstest/releases)._

## 18.11.0

<!-- Release notes generated using configuration in .github/release.yml
at rel/18.11 -->

## What's Changed
* Fix TRX logger mangling astral-plane (non-BMP) characters by
@​azat-msft in microsoft/vstest#16318
* Disable the MTP testhost by default by @​nohwnd in
microsoft/vstest#16337
* Fix OS-blind apphost probe in MTP bridge on Unix (regression from
#​16201) by @​azat-msft in
microsoft/vstest#16336
* Retarget the MTP client onto
Microsoft.Testing.Platform.ServerMode.Client.Sources by @​nohwnd in
microsoft/vstest#16300
* Pass arguments to PowerShell with -File instead of -command by
@​nohwnd in microsoft/vstest#16363
* Respect console logger verbosity from a settings file by @​nohwnd in
microsoft/vstest#16044
* Fix backslash normalization in VSTestCLIRunSettings on Unix by
@​nohwnd in microsoft/vstest#15795
* Docs: fix typo explicitely -> explicitly by @​vaibhav8a in
microsoft/vstest#16397
* Copy acceptance test diagnostic logs into the test results directory
by @​nohwnd in microsoft/vstest#16403

## New Contributors
* @​vaibhav8a made their first contribution in
microsoft/vstest#16397

**Full Changelog**:
microsoft/vstest@v18.10.1...v18.11.0

## 18.10.1


## What's Changed
* Isolate code coverage files in published output by @​azat-msft in
microsoft/vstest#16476


**Full Changelog**:
microsoft/vstest@v18.10.0...v18.10.1

## 18.10.0


## What's Changed
* Drop Mono fallback, run .NET Framework tests on Windows only by
@​nohwnd in microsoft/vstest#16158
* Run Microsoft.Testing.Platform test apps under `vstest.console` and
datacollector by @​nohwnd in
microsoft/vstest#16201
* Fix test output eaten by MSBuild terminal logger by @​nohwnd in
microsoft/vstest#16223
* Remove the experimental test session feature by @​nohwnd in
microsoft/vstest#16231
* Skip a single bad executor instead of failing all executor loading by
@​nohwnd in microsoft/vstest#16239
* Assert apartment state instead of using Clipboard in UI tests by
@​nohwnd in microsoft/vstest#16270
* Surface test host crashes during protocol negotiation by @​nohwnd in
microsoft/vstest#16285
* Pass the inferred target platform to the host in run settings by
@​nohwnd in microsoft/vstest#16271
* Report raw invalid IsTargetPlatformInferred value, cover host x64
forcing by @​nohwnd in microsoft/vstest#16295
* Disable the MTP testhost by default (#​16337) by @​nohwnd in
microsoft/vstest#16341


**Full Changelog**:
microsoft/vstest@v18.9.0...v18.10.0

Commits viewable in [compare
view](microsoft/vstest@v18.9.0...v18.11.0).
</details>

Updated [microsoft.openapi.kiota](https://github.com/microsoft/kiota)
from 1.35.0 to 1.36.1.

<details>
<summary>Release notes</summary>

_Sourced from [microsoft.openapi.kiota's
releases](https://github.com/microsoft/kiota/releases)._

## 1.36.1

## Added

### Changed

- Fixed small issues with release pipelines


## 1.36.0

## Added

- Ruby: an error's `message` returns the property the description marks
with `x-ms-primary-error-message`, as the other languages do. An error
property named `message` is renamed `message_escaped`, like
`MessageEscaped` in C#; when it is a string, `message` still returns it.
[kiota-ruby#​63](microsoft/kiota-ruby#63)

### Changed

- Fixed relative description paths when opening or selecting clients in
the VS Code Kiota workspace.
- Removed the retired lock-search command from the VS Code command
palette. Lock-file migration remains available.

- Preserve inherited properties when a single `oneOf` or `anyOf` member
defines its properties only through `allOf`. Fixes
[#​6778](microsoft/kiota#6778).
- Python: preserve false, zero, empty strings, and empty collections
when parsing and serializing union type wrappers.

- All language refiners accept a generation logger consistently,
retaining configuration-only compatibility constructors hidden from
IntelliSense.
- Reject plugin-manifest file references whose path components become
parent-directory traversal after Windows trims trailing spaces or dots.
- Fixed a stack overflow when generating API plugins from descriptions
with cyclic `allOf` schemas.
- Dart: omit unsupported schema defaults with a generation warning,
preserve supported literal and enum property and parameter defaults
(including empty strings), initialize query parameters from schema
defaults, and keep constructor initialization valid with or without
backing stores.
- Dart: preserve nullable optional request-builder constructor
parameters, including UUIDs and collections, so cloning accepts null
arguments without overwriting existing path parameters.
- Dart: escape URL templates once at final emission to preserve literal
dollar signs and backslashes in constructor defaults and method
overrides.
- Dart: preserve schema string defaults named `null`, including enum
wire values, without treating them as JSON-null sentinels.
- Dart: preserve query-parameter defaults inside single-member `allOf`
wrappers, retaining outer-default precedence and explicit JSON-null
defaults.
- Dart: validate parser-backed date, time, and UUID defaults before
emission, omitting unsupported values with a generation warning.
- Ruby: a union of object types that no discriminator decides, such as a
oneOf without a discriminator, now reads the payload into every object
member, as TypeScript does, instead of returning an empty wrapper. A
union whose discriminator matched no member does the same, and its array
member is only read when no other member was picked. Requires the
runtime gems at 0.24.0.
- Ruby: enum members hold their wire value, so a value such as
`incoming-payment` or `read` is sent and read as the description
declares it instead of as `IncomingPayment` or `Read`. `Enum[:Name]` now
returns the wire value as a string. Requires the runtime gems at 0.24.0.
- Go: keep escaped namespace segments lowercase so imports match
generated package directories on case-sensitive filesystems. Fixes
[#​7828](microsoft/kiota#7828).
- TypeScript: import response enum objects for request builders reached
through path parameters.
[#​6884](microsoft/kiota#6884)
- Resolve enum query parameters wrapped in single-member `allOf`
schemas, including enum array items.
- Go: cast scalar enum values in union factories and avoid reading an
empty discriminator name for undiscriminated unions. Addresses
[#​7808](microsoft/kiota#7808).
- Preserve models for multipart properties with default content types
when other properties specify an encoding.
[#​7342](microsoft/kiota#7342)
- Dart: escape enum options named value or values to avoid conflicts
with generated and built-in enum members.
[#​7807](microsoft/kiota#7807)
- Ruby: the client's root module has an `eager_load!` method that loads
every autoloaded model, for servers that preload before forking.
- Ruby: generated files start with `# frozen_string_literal: true`, so
string default values handed to user code are frozen.
- Ruby: generated string literals are double quoted, the StandardRB
convention.
- Ruby: namespaces with nothing to autoload no longer get an empty
barrel file, and generated files no longer require them (561 fewer files
in a GitHub client).
- Ruby: a client generated with a multi-segment `--namespace-name`, such
as `integration_test.client`, failed to load because its root file was
written one directory too deep.
- Ruby: namespace barrels register their models and enums with
`autoload` instead of requiring them, so a subclass no longer fails to
load when its base class file is required first. Other files require the
barrel rather than an individual model file, and models now load on
first use. A type no barrel autoloads, such as a model named after its
namespace, is now required directly: 1,315 constants referenced by a
Meraki client never loaded, and a client generated from the current
GitHub description failed to load because it required a file that is
never written. [#​7956](microsoft/kiota#7956)
- Ruby: model properties are declared with `attr_accessor`, which
removes the thousands of "possibly useless use of a variable" warnings
`ruby -w` printed while loading a client.
- Ruby: enum hashes are frozen.
[kiota-ruby#​68](microsoft/kiota-ruby#68)
- C#: escape Unicode line and paragraph separators in generated string
literals so generated clients remain valid C# source.
- External reference allowlist wildcards no longer cross the URI
authority boundary, so a wildcard in the scheme or host cannot match
text in the path, the user information or the port.
- Initialize inherited Dart model fields in constructor initializer
lists.
- Replace only unresolved binary types with a native stream type, and
translate a resolved model by its definition rather than its name, so a
model whose schema is named `binary`, `base64` or `base64url` keeps its
own name across every language instead of being rendered as the native
binary type. Generation no longer fails for C# and Java.
- Avoid redundant parsing branches for equivalent binary alternatives in
Dart and PHP composed models.
- Preserve imports for distinct types from the same namespace when
inlining error model inheritance.
- Dart: qualify model fields named `node` or `deserializerMap` during
deserialization so local variables do not shadow them; escape `override`
model members to preserve Dart annotations. Fixes
[#​7822](microsoft/kiota#7822).
- PHP: disambiguate enum constants that normalize to the same name while
preserving wire values and existing constant names.
- Java: omit unused discriminator-mapping imports for union/intersection
wrappers, avoiding imports of nonexistent models while retaining member
and inherited-factory imports.
- Dart: omit unused discriminator-mapping imports for composed wrappers
while preserving member and inherited-factory imports. Addresses
[#​7821](microsoft/kiota#7821).
- Preserve endpoints whose static path segments collide after name
sanitization, such as /v1.1 and /v11.
[#​7143](microsoft/kiota#7143)

- Ruby: a path with an escaped suffix, such as
`/domains/{domainName}!quote`, generated a request builder method that
passed the raw path parameter name where the signature had snake cased
it, and referenced the builder class without its namespace. Both raised
`NameError` on first use.
[#​7956](microsoft/kiota#7956)
 ... (truncated)

Commits viewable in [compare
view](microsoft/kiota@v1.35.0...v1.36.1).
</details>

Updated
[xunit.runner.visualstudio](https://github.com/xunit/visualstudio.xunit)
from 4.0.0 to 4.0.1.

<details>
<summary>Release notes</summary>

_Sourced from [xunit.runner.visualstudio's
releases](https://github.com/xunit/visualstudio.xunit/releases)._

## 4.0.1

Release notes: https://xunit.net/releases/visualstudio/4.0.1

Commits viewable in [compare
view](xunit/visualstudio.xunit@4.0.0...4.0.1).
</details>

Updated [xunit.v3](https://github.com/xunit/xunit) from 4.0.0 to 4.0.2.

<details>
<summary>Release notes</summary>

_Sourced from [xunit.v3's
releases](https://github.com/xunit/xunit/releases)._

No release notes found for this version range.

Commits viewable in [compare
view](https://github.com/xunit/xunit/commits).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Steinar Hjellvik <38071413+shjellvik@users.noreply.github.com>
@gladjohn Gladwin Johnson VR (gladjohn) mentioned this pull request Nov 1, 2026
Open
This was referenced Nov 1, 2026
Open
Open
Open
Open
Closed
Open
Closed
Open
Merged
Merged
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@bgavrilMS Bogdan Gavril (bgavrilMS) bgavrilMS approved these changes
@4gust Nilesh Choudhary (4gust) 4gust approved these changes

Assignees

No one assigned

Labels

agentic-cli Terminal AI agent drove the bulk of the edits feature

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature Request] Send tenant id as client_id in PopKeyAttestor.AttestCredentialGuardAsync

5 participants

@gladjohn @bgavrilMS @4gust