[dependabot]

Updated Microsoft.Identity.Client from 4.87.0 to 4.91.1.

Release notes

Sourced from Microsoft.Identity.Client's releases.

4.91.1

Changes

• Added opt-in reduced token-acquisition logging: set MSAL_REDUCED_LOGGING=true (or 1) before application construction to move selected routine Information-level diagnostics to Verbose. Existing logging behavior is unchanged by default; acquisition summaries, warnings, and errors remain unchanged. #​6208 #​6224

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.91.0...4.91.1

4.91.0

New Features

• Made the dynamic certificate provider and confidential-client callbacks (OnMsalServiceFailure, OnCompletion, and OnBackgroundTokenRefreshCompleted) generally available, removing the experimental feature opt-in requirement. #​6216

Bug Fixes

• Fixed built-in mTLS HttpClient caching to use certificate object identity, ensuring a new certificate instance with a reacquired private-key handle receives a new handler even when its thumbprint is unchanged. #​6217
• Fixed managed identity WithForceRefresh(true) to re-mint the MSI v2 binding certificate before acquiring a new token, while reusing a valid cached attestation token for the current key. #​6215
• Fixed system-browser authentication callbacks in Linux containers by adding opt-in IPv4 port-forwarding support through MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING, disabled by default. #​6186

4.90.1

New Features

• Added IMsalWsTrustHttpClientFactory, allowing custom HTTP client factories to provide redirect-disabled, credential-policy-aware clients for federation metadata (MEX) and WS-Trust requests. Added MsalError.TooManyRedirects and MsalError.WsTrustCrossOriginRedirectNotSupported for redirect failures. #​6165

Bug Fixes

• Hardened federation metadata and WS-Trust requests by requiring HTTPS, securely validating redirects, rejecting credential-bearing cross-origin redirects, and limiting redirect chains. #​6165
• Fixed instance discovery so a custom authority port is not forwarded to the global discovery host, while preserving the port when discovery uses the authority host. #​6155
• Fixed KeyGuard attestation to send the tenant ID as the MAA client_id metadata value without changing managed-identity client-ID handling or attestation-cache partitioning. #​6200

Changes

• Updated Microsoft.Azure.Security.KeyGuardAttestation from version 1.1.7 to 1.1.8. #​6202

4.90.0

Changes

• Updated the KeyGuardAttestation package version to 1.1.7. #​6189

4.89.0

What's Changed

• Add repository guidance for AI agents by @​bgavrilMS in Add repository guidance for AI agents AzureAD/microsoft-authentication-library-for-dotnet#6158
• Add Linux Attested Managed Identity Flow documentation by @​gladjohn in Add Linux Attested Managed Identity Flow documentation AzureAD/microsoft-authentication-library-for-dotnet#6149
• Remove internal authority example from API docs by @​bgavrilMS in Remove internal authority example from API docs AzureAD/microsoft-authentication-library-for-dotnet#6170
• Update SNI MTLS PoP Token Design documentation by @​bgavrilMS in Update SNI MTLS PoP Token Design documentation AzureAD/microsoft-authentication-library-for-dotnet#6171
• Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate by @​gladjohn in Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate AzureAD/microsoft-authentication-library-for-dotnet#6167
• Revise mTLS PoP acceptance-test matrix structure by @​gladjohn in Revise mTLS PoP acceptance-test matrix structure AzureAD/microsoft-authentication-library-for-dotnet#6161
• Add ICloudConfiguration for cross-cloud metadata resolution by @​Avery-Dunn in Add ICloudConfiguration for cross-cloud metadata resolution AzureAD/microsoft-authentication-library-for-dotnet#6104
• Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry by @​Robbie-Microsoft in Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry AzureAD/microsoft-authentication-library-for-dotnet#6173
• Always record RawStsErrorCode on MsalFailure metric by @​ssmelov in Always record RawStsErrorCode on MsalFailure metric AzureAD/microsoft-authentication-library-for-dotnet#6175
• Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity by @​Robbie-Microsoft in Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity AzureAD/microsoft-authentication-library-for-dotnet#6178
• Add timeout for managed identity capability discovery by @​Robbie-Microsoft in Add timeout for managed identity capability discovery AzureAD/microsoft-authentication-library-for-dotnet#6181
• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in Pin GitHub Actions to full-length commit SHAs AzureAD/microsoft-authentication-library-for-dotnet#6182

New Contributors

• @​danfiedler-msft made their first contribution in Pin GitHub Actions to full-length commit SHAs AzureAD/microsoft-authentication-library-for-dotnet#6182

Full Changelog: AzureAD/microsoft-authentication-library-for-dotnet@4.88.0...4.89.0

4.88.0

New Features

• Added user-assigned managed identity support for Azure Arc, including selecting the identity by client ID and validating the identity returned in the token response. #​6128
• Added WithRequestOverMtls() to managed identity token requests, enabling attested bearer-token acquisition over the IMDSv2 mTLS transport. #​6086

Bug Fixes

• Fixed token-cache key collisions by length-prefixing additional cache-key components before hashing. #​6137
• Populated authentication-result telemetry metadata on proactive background-refresh results. #​6157
• Fixed mTLS PoP authority validation incorrectly rejecting sovereign-cloud aliases such as login.chinacloudapi.cn and login.usgovcloudapi.net. #​6153

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #43.