@azure/identity

Bugs Fixed

• Initialize Public Client Application in the Interactive Browser Credential, as required by @azure/msal-browser v3 fixed in #28292.

Features Added

• All the features shipped as part of 4.0.0-beta.1 will be GA with this version. The most important features being the browser customization for success/ error messages and the support of brokered authentication on Windows OS, such as WAM.

Breaking Changes

• Starting with v4.0.0 of @azure/identity, Node.js v20 will be supported and Node.js v16 will no longer be supported.

Features Added

• Added brokerOptions in InteractiveBrowserCredential for authentication broker support such as WAM. This feature works along with the new @azure/identity-broker plugin package. Note that this feature is only available in node.
• Added support for MSA passthrough in the brokerOptions of InteractiveBrowserCredential. Note this is only available for legacy 1st party applications.
• Added BrowserCustomizationOptions for success and error messages in the InteractiveBrowserCredential.

Breaking Changes

• The redirectUri is no longer a required option for InteractiveBrowserCredential on Node.js. There's no API change, but this is a behavior change.

Bugs Fixed

• Fixed regressions introduced by 3.4.0 #27761

Code | Docs

Support: Active

Core - Client - Rest

@azure-rest/core-client

Bugs Fixed

• Ensure AzurePowershellCredential calls PowerShell with the -NoProfile and "-NonInteractive" flag to avoid loading user profiles for more consistent behavior. (#27023)
• Fixed browser bundling for Azure Developer CLI credential. ([Identity] update mapping for browser for azd (#27097))
• ManagedIdentityCredential will fall through to the next credential in the chain in the case that Docker Desktop returns a 403 response when attempting to access the IMDS endpoint.(#27050)

Other Changes

• The default IMDS probe request timeout in ManagedIdentityCredential has been increased to 1 second from 0.3 seconds to reduce the likelihood of false negatives.
• Fixed links to documentation.
• Further improvements to tenant and scope validation.

Bug Fixes

• Bug fixes for developer credentials

Features Added

• Enabled support for logging personally identifiable information, required for customer support through the enableUnsafeSupportLogging option on loggingOptions under TokenCredentialOptions.
• Continuous Access Evaluation (CAE) is now configurable per-request by setting the enable_cae keyword argument to True in get_token. This applies to user credentials and service principal credentials. (#26614)

Breaking Changes

• CP1 client capabilities for CAE is no longer always-on by default for user credentials. This capability will now be configured as-needed in each getToken request by each SDK. (#26614)
  • Suffixes are now appended to persistent cache names to indicate whether CAE or non-CAE tokens are stored in the cache. This is to prevent CAE and non-CAE tokens from being mixed/overwritten in the same cache. This could potentially cause issues if you are trying to share the same cache between applications that are using different versions of the Azure Identity library as each application would be reading from a different cache file.
  • Since CAE is no longer always enabled for user-credentials, the AZURE_IDENTITY_DISABLE_CP1 environment variable is no longer supported.

Bug Fixes

• Fixed a bug related to Managed Identity Credential intermixing wrong scopes for successive getToken() calls.

Bug Fixes

• Dependency Upgrades of MSAL libraries to the latest versions for incorporating underlying bug fix to resolve this issue.

Other Changes

Behavioral breaking change

• Moved AzureDeveloperCliCredential to the end of the DefaultAzureCredential chain.