@azure/identity

[Identity] Azure Arc Support (#39927)

#39713

Adds Azure Arc user-assigned managed identity support by updating MSAL
Node to v6.

* Enables  `skipLibCheck` for other Identity library because MSAL Common
references the DOM-only global `JsonWebKey`. This is a quick fix for
release the Identity library and will not release these libraries
* Fixes DAC to forward managed identity selector options when
 `AZURE_TOKEN_CREDENTIALS=ManagedIdentityCredential`
* Adds unit and manual tests for attached and unattached Azure Arc
identities.

---------

Co-authored-by: Karishma Ghiya <kaghiya@microsoft.com>
Copilot-Session: 10d8cfbc-0f37-4e28-8511-fa2764cccdd1
Copilot-Session: b58273ab-71fa-406a-9f13-a4e4dfad21b7
Copilot-Session: ba7ce25f-f387-4a16-946a-c4c87e2d078d

Other Changes

• Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39569
• Replaced shell-based developer credential commands with safe, structured process execution. #39279
• Migrated platform-specific module resolution to #platform/* imports. #38309

Other Changes

• Upgraded @azure/msal-node from ^3.5.0 to ^5.1.0 and @azure/msal-browser from ^4.2.0 to ^5.5.0 following the MSAL Node v5 migration guide and the MSAL Browser v5 migration guide. #37685
  • Removed usage of deprecated storeAuthStateInCookie option in browser cache configuration
  • Replaced deprecated createPublicClientApplication() with createStandardPublicClientApplication()
  • Updated handleRedirectPromise to use options object instead of string parameter
  • Replaced deprecated tokenQueryParameters with extraQueryParameters in MSAL node flows

Features Added

• When AZURE_TOKEN_CREDENTIALS is set to only ManagedIdentityCredential, DefaultAzureCredential does not issue a probe request and performs retries with exponential backoff. #36047

Bugs Fixed

• Fixed an issue where ManagedIdentityCredential will make an additional probe request in the getToken call. #36047

Features Added

• Added a new requiredEnvVars option to DefaultAzureCredential that can accept a single environment variable or an array of environment variables. All specified variables must be set (and non-empty) before credential instantiation. If any variable is missing or empty, an error is thrown listing all missing variables. #35832
• Introduced a new DefaultAzureCredentialEnvVars union type that represents the environment variables supported in DefaultAzureCredential. This type is used to specify the required environment variable(s) in the option bag for DefaultAzureCredential via requiredEnvVars. #35832

Bugs Fixed

• Fixed an issue where AzureDeveloperCliCredential would time out during token requests when azd prompts for user interaction. This issue commonly occurred in environments where the AZD_DEBUG environment variable was set, causing the Azure Developer CLI to display additional prompts that interfered with automated token acquisition. #35637
• Fixed an issue where VisualStudioCodeCredential will show interactive authentication when the plugin is set but the broker is not available. #35837

Other Changes

• AzureCliCredential, AzurePowerShellCredential, and AzureDeveloperCliCredential now raise CredentialUnavailableError when claims are provided to getToken, as these credentials do not support claims challenges. The error message includes instructions for handling claims authentication scenarios. #35493 & #35855

Code | Docs

Support: Active

Language Text

@azure/ai-language-text

Bugs Fixed

• Fixed an issue in which AzurePowerShellCredential command is not parsed correctly. #35469

• All the features shipped as part of 4.11.0-beta.1 will be GA with this version. The most important features include single credential selection in DefaultAzureCredential via AZURE_TOKEN_CREDENTIALS environment variable, broker authentication support through VisualStudioCodeCredential, and signed-in Windows account support in DefaultAzureCredential.

Bugs Fixed

• Fixed deprecation warnings in AzureCliCredential and AzureDeveloperCliCredential. #34878
• Fixed an issue where InteractiveBrowserCredential did not resolve correctly on Mac OS. #35406

Features Added

• VisualStudioCodeCredential has been restored and now supports broker authentication using the Azure account signed in via Visual Studio Code. The credential has been added to DefaultAzureCredential #35150
• DefaultAzureCredential now supports authentication with the currently signed-in Windows account when the @azure/identity-broker package is installed and configured with useIdentityPlugin. This auth mechanism is added at the end of the DefaultAzureCredential credential chain. #35213
• Added support for more AZURE_TOKEN_CREDENTIALS environment variable values to specify a single credential type to use in DefaultAzureCredential. In addition to dev and prod, possible values now include VisualStudioCodeCredential, EnvironmentCredential, WorkloadIdentityCredential, ManagedIdentityCredential, AzureDeveloperCliCredential, AzurePowershellCredential and AzureCliCredential - each for the corresponding credential type. #34966

Other Changes

• Added HTTP 410 status code handling to ManagedIdentityCredential retry policy with minimum 70-second total retry duration to meet Azure IMDS service requirements. #34981