Skip to content

[Bug] HttpClientTransport setting is not applied after MSAL upgraded #6124

Open

Description

@xula2018

Library version used

4.85.2

.NET version

4.7.2

Scenario

ManagedIdentityClient - managed identity

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

After we upgraded version from 4.84.2 t0 4.85.2, we notice the same issue as
#5286 (comment) happened again.

The regression is most likely caused by changes from 4.85.0.

Relevant code snippets

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

No response

Activity

  1. bgavrilMS commented on Jul 21, 2026

    @bgavrilMS
    Member

    Gladwin Johnson VR (@gladjohn) - can you pls take a look

  2. gladjohn commented on Aug 7, 2026

    @gladjohn
    Contributor

    xula2018 apologies for the delay on this one

    Thanks for the report. I ran a real repro on 4.85.2: a normal IMDS managed-identity acquisition with a custom  HttpClientTransport  (plain IMsalHttpClientFactory ) correctly routes every request through the caller's transport — so I can't reproduce a transport bypass on the IMDS path in 4.85.2. To pin this down, could you confirm:

    1. Which MI host? What does the log say right after "Detecting managed identity sourceâ€Ķ" — Service Fabric, App Service, Azure Arc, or plain IMDS VM?
    2. Does 4.84.2 work and 4.85.0 already break, or only 4.85.2?
    3. Verbose log of the failing token call — the  [HttpManager] Sending request â€Ķ Host: â€Ķ  lines — so we can see whether it went through your client.
    4. Symptom: wrong-tenant/issuer token (transport bypassed), or an outright error?

    Note: the one place MSAL still builds its own  HttpClient  (bypassing a plain custom transport) is Service Fabric, to attach its server-cert validation callback — but that's been the case since 4.62.0 (#4818), so it wouldn't be a 4.84.2→4.85.2 regression. If you're on Service Fabric, the supported path is to supply an IMsalSFHttpClientFactory .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions