* Fix PoP flow in the test app

Currently the test app sends both PoP parameters (see placeholder_auth_scheme definition)
and also passes req_cnf and token type. There parameters are not
compatible. If application passes PoP parameters, then MSAL (or the
broker) owns the key and does the signing of the SHR. If application
passes req_cnf, then application owns the key and creates and signs the
SHR, so in this case it should not pass PoP parameters.

The main flow is the first one - application passes only PoP parameters
and either MSAL or the broker owns the key and generates the SHR.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Petar Dimov <petard@ntdev.microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Add ADO CI/release pipelines with SDL, e2e tests, and ESRP publish support

* Use Python runpy to read __version__ in Validate stage instead of grep/sed

* Remove duplicate _clean_env in test_e2e.py; import from lab_config instead

* Pass LabAuth secret via env var to avoid bash command substitution on undefined variable

* Skip Key Vault and cert steps on forked PRs; e2e tests self-skip when cert is absent

* Fix header comment: production path uses EsrpRelease@9 not Twine SC

* Fix CredScan suppression paths: prefix with tests/

* Add daily scheduled trigger to azure-pipelines.yml (11:45 PM Pacific, dev only)

* Fix dead doc reference: ADO-PUBLISH-SETUP.md -> CI-AND-RELEASE-PIPELINES.md

* Address review comments: rename _clean_env to clean_env, fix __all__, fix doc diagram, drop redundant import os

* Clarify cron comment: 07:45 UTC = 11:45 PM PST / 12:45 AM PDT

* Add documentation for Managed Identity v2 Hackathon

Document the results and outcomes of the Managed Identity v2 Multi-Language Implementation Hackathon, highlighting the achievements and deliverables.

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update spikes/prototype/2026_MS_SecurityHackathon_MSIV2.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…in permissions (#884)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Added withFmi method for cca app

* Added Cache support for fmi keys

* updated the cache key ext

* updated cache key excluded

* Update msal/token_cache.py

Co-authored-by: Bogdan Gavril <bogavril@microsoft.com>

* updated API for fmi

---------

Co-authored-by: Bogdan Gavril <bogavril@microsoft.com>

…neration (#894)

* Use cryptographically secure randomness for PKCE, state, and nonce generation

* Update tests/test_oidc.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update tests/test_oidc.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update msal/oauth2cli/oidc.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Address PR review feedback: remove unused imports, simplify loop, add response_mode

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-for-python/sessions/20f5cbfd-04ca-45f5-8c71-f8df1d00a01e

Co-authored-by: ashok672 <83938949+ashok672@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* added a additional check for domain checking in b2c

* updated comment

updated to latest version