Changes

• Added opt-in reduced token-acquisition logging: set MSAL_REDUCED_LOGGING=true (or 1) before application construction to move selected routine Information-level diagnostics to Verbose. Existing logging behavior is unchanged by default; acquisition summaries, warnings, and errors remain unchanged. #6208 #6224

Full Changelog: 4.91.0...4.91.1

New Features

• Made the dynamic certificate provider and confidential-client callbacks (OnMsalServiceFailure, OnCompletion, and OnBackgroundTokenRefreshCompleted) generally available, removing the experimental feature opt-in requirement. #6216

Bug Fixes

• Fixed built-in mTLS HttpClient caching to use certificate object identity, ensuring a new certificate instance with a reacquired private-key handle receives a new handler even when its thumbprint is unchanged. #6217
• Fixed managed identity WithForceRefresh(true) to re-mint the MSI v2 binding certificate before acquiring a new token, while reusing a valid cached attestation token for the current key. #6215
• Fixed system-browser authentication callbacks in Linux containers by adding opt-in IPv4 port-forwarding support through MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING, disabled by default. #6186

New Features

• Added IMsalWsTrustHttpClientFactory, allowing custom HTTP client factories to provide redirect-disabled, credential-policy-aware clients for federation metadata (MEX) and WS-Trust requests. Added MsalError.TooManyRedirects and MsalError.WsTrustCrossOriginRedirectNotSupported for redirect failures. #6165

Bug Fixes

• Hardened federation metadata and WS-Trust requests by requiring HTTPS, securely validating redirects, rejecting credential-bearing cross-origin redirects, and limiting redirect chains. #6165
• Fixed instance discovery so a custom authority port is not forwarded to the global discovery host, while preserving the port when discovery uses the authority host. #6155
• Fixed KeyGuard attestation to send the tenant ID as the MAA client_id metadata value without changing managed-identity client-ID handling or attestation-cache partitioning. #6200

Changes

• Updated Microsoft.Azure.Security.KeyGuardAttestation from version 1.1.7 to 1.1.8. #6202

Changes

• Updated the KeyGuardAttestation package version to 1.1.7. #6189

What's Changed

• Add repository guidance for AI agents by Bogdan Gavril (@bgavrilMS) in #6158
• Add Linux Attested Managed Identity Flow documentation by Gladwin Johnson VR (@gladjohn) in #6149
• Remove internal authority example from API docs by Bogdan Gavril (@bgavrilMS) in #6170
• Update SNI MTLS PoP Token Design documentation by Bogdan Gavril (@bgavrilMS) in #6171
• Add SNI mTLS E2E coverage for a non-exportable VBS-protected certificate by Gladwin Johnson VR (@gladjohn) in #6167
• Revise mTLS PoP acceptance-test matrix structure by Gladwin Johnson VR (@gladjohn) in #6161
• Add ICloudConfiguration for cross-cloud metadata resolution by Avery-Dunn in #6104
• Fix IMDSv2 SCHANNEL failures bypassing certificate re-mint retry by Robbie-Microsoft in #6173
• Always record RawStsErrorCode on MsalFailure metric by Sergei Smelov (@ssmelov) in #6175
• Add MSAL_MI_DISABLE_IMDS_V2 kill switch for managed identity by Robbie-Microsoft in #6178
• Add timeout for managed identity capability discovery by Robbie-Microsoft in #6181
• Pin GitHub Actions to full-length commit SHAs by Dan Fiedler (@danfiedler-msft) in #6182

New Contributors

• Dan Fiedler (@danfiedler-msft) made their first contribution in #6182

Full Changelog: 4.88.0...4.89.0

New Features

• Added user-assigned managed identity support for Azure Arc, including selecting the identity by client ID and validating the identity returned in the token response. #6128
• Added WithRequestOverMtls() to managed identity token requests, enabling attested bearer-token acquisition over the IMDSv2 mTLS transport. #6086

Bug Fixes

• Fixed token-cache key collisions by length-prefixing additional cache-key components before hashing. #6137
• Populated authentication-result telemetry metadata on proactive background-refresh results. #6157
• Fixed mTLS PoP authority validation incorrectly rejecting sovereign-cloud aliases such as login.chinacloudapi.cn and login.usgovcloudapi.net. #6153

What's Changed

• Expose MsalServiceException.ErrorCodesForLogging for diagnostics in #6138
• Expose WithOtelTagsEnricher for managed identity requests in #6144
• Forward OpenTelemetry tags enricher to the client-assertion callback in #6142
• Add client-side opaque-token log scrubber in #6119
• Populate ExecutionResult.Exception for non-MSAL failures in #6139
• Use PSS padding in KeyGuard liveness probe (CodeQL SM03799) in #6141
• Remove managed identity support from WithClaimsFromClient (confidential-client only) in #6113
• Remove experimental features from client setup in #6143
• Update Azure Arc managed identity API version from 2019-11-01 to 2020-06-01 in #6130

Full Changelog: 4.86.1...4.87.0

Bug Fixes

• Fixed the mTLS Proof-of-Possession token cache to key on the certificate's full DER (x5t#S256) instead of only the public key, preventing a stale token (and AADSTS500181) after a same-key certificate renewal. #6123
• Fell back to RS256 when a certificate's PSS signing operation is rejected by RSACryptoServiceProvider, rebuilding the client assertion so authentication can proceed. #6126
• Detect and reject symbolic links in the Unix cache-file write path (lstat pre-check plus O_NOFOLLOW), closing a TOCTOU window. #6115
• Corrected misleading "region required" error messages and doc comments in the mTLS PoP flow. #6127

What's Changed

• Propagate KeyGuard attestation failures and bridge native MAA logs to the MSAL logger by Gladwin Johnson VR (@gladjohn) in #6081
• Token Binding Demo Helper by Gladwin Johnson VR (@gladjohn) in #6097
• Include ManagedIdentitySource in managed identity error messages and request-failure logs by Robbie-Microsoft in #6101
• Remove Mooncake (AzureChinaCloud) lab client from WAM dev apps by Ryan Auld (@RyAuld) in #6103
• Surface token-acquisition failure metadata on MsalException by Neha Bhargava (@neha-bhargava) in #6096
• Skip IMDS lookup for explicit regions by Nilesh Choudhary (@4gust) in #6092
• Fix region failure-metadata test broken by explicit-region IMDS skip by Neha Bhargava (@neha-bhargava) in #6105

Full Changelog: 4.85.2...4.86.0

What's Changed

• Delegate IMDSv2 mTLS-PoP token leg to internal TokenClient exchange (MSIv2 WithClaimsFromClient) by Robbie-Microsoft in #6070
• Enforce mTLS PoP minimum binding strength for Managed Identity (#6049 Phase 2) by Robbie-Microsoft in #6059
• Add refresh token cache partitioning support by Ignacio Inglese (@iNinja) in #6077
• Detach ImdsV2ManagedIdentitySource from AbstractManagedIdentity (refused-bequest cleanup) by Robbie-Microsoft in #6089

Full Changelog: 4.85.1...4.85.2