@azure/identity

Bug Fixes

• Fixed a bug in WorkloadIdentity Credential, to incorporate the case where the options can be undefined in a conditional check. Related issue #25827 with the fix #25829.

Breaking Changes

• Renamed developerCredentialTimeOutInMs to processTimeoutInMs in DefaultAzureCredentialOptions.
• Renamed federatedTokenFilePath to tokenFilePath under WorkloadIdentityOptions.

Features Added

• Added configurable process timeout for dev-time credentials - AzureCLI Credential, AzurePowershell Credential and AzureDeveloperCLI Credential.

Bugs Fixed

• Fixed a bug in WorkloadIdentity Credential, to incorporate the case where the options can be undefined in a conditional check. Related issue #25089 with the fix #25119.
• Exported WorkloadIdentityDefaultCredentialOptions which was previously not publicly exported in index.ts.

Features Added

• Added support to disable instance discovery on Microsoft Entra credentials.
• Added AzureDeveloperCliCredential #24180 and added it to the DefaultAzureCredential #24826 auth flow
• Added support for WokloadIdentityCredential#24830, added it to DefaultAzureCredential auth flow and replaced the in-house implementation of Token Exchange MSI in ManagedIdentity with WorkloadIdentityCredential.

Bugs Fixed

• Added a workaround of fetching all accounts from token cache to fix the issue of silent authentication not taking place when authenticationRecord is passed. For reference, see issue.

Other Changes

• Upgraded versions of @azure/msal-node, @azure/msal-common and @azure/msal-browser to remove any dependency versions that were depending on old version of jsonwebtoken which had a security issue

Bugs Fixed

• Fixed bug in ManagedIdentity Credential where "expiresInSeconds" was taking the absolute timestamp instead of relative expiration time period in seconds.

Other Changes

• Enable msal logging based on log level specified by user for Azure SDK.
• Upgraded version dependencies on msal libraries, since they have additional logging added.

Bugs Fixed

• Fixed bug to update "expiresOnTimestamp" field in Managed Identity to be in seconds and not milliseconds.

Other Changes

• Docs improvements for cross-language alignment

Features Added

• Added Token Caching support to Managed Identity Credential

Bugs Fixed

• Fixed bug to enable additionallyAllowedTenants to pass through to MSAL Flow.

Features Added

• Added additionallyAllowedTenants to the following credential options to force explicit opt-in behavior for multi-tenant authentication via the options property bag to the following:
  • AuthorizationCodeCredentialOptions
  • AzureApplicationCredentialOptions
  • AzureCliCredentialOptions
  • AzurePowerShellCredentialOptions
  • ClientAssertionCredentialOptions
  • ClientCertificateCredentialOptions
  • ClientSecretCredentialOptions
  • DefaultAzureCredentialOptions
  • DeviceCodeCredentialOptions
  • EnvironmentCredentialOptions
  • InteractiveCredentialOptions
  • OnBehalfOfCredentialOptions
  • UsernamePasswordCredentialOptions
  • VisualStudioCodeCredentialOptions

Breaking Changes

• Credential types supporting multi-tenant authentication will now throw an error if the requested tenant ID doesn't match the credential's tenant ID, and is not included in the additionallyAllowedTenants option. Applications must now explicitly add additional tenants to the additionallyAllowedTenants list, or add "*" to list, to enable acquiring tokens from tenants other than the originally specified tenant ID. See BREAKING_CHANGES.md.

Bugs Fixed

• Changed the way token expiration for managed identity tokens is calculated to handle different server formats. See PR #23232

3.0.0-beta.1 (2026-08-05)

Compared with version 2.0.0

Features Added

• Added operation group PaymentHsmClusterPrivateEndpointConnectionsOperations
• Added operation group PaymentHsmClusterPrivateLinkResourcesOperations
• Added operation group PaymentHsmClustersOperations
• Added Interface PaymentHsmCluster
• Added Interface PaymentHsmClusterPatchParameters
• Added Interface PaymentHsmClusterPrivateEndpointConnection
• Added Interface PaymentHsmClusterPrivateEndpointConnectionsCreateOptionalParams
• Added Interface PaymentHsmClusterPrivateEndpointConnectionsDeleteOptionalParams
• Added Interface PaymentHsmClusterPrivateEndpointConnectionsGetOptionalParams
• Added Interface PaymentHsmClusterPrivateEndpointConnectionsListByPaymentHsmClusterOptionalParams
• Added Interface PaymentHsmClusterPrivateLinkResourcesListByPaymentHsmClusterOptionalParams
• Added Interface PaymentHsmClusterProperties
• Added Interface PaymentHsmClustersCreateOrUpdateOptionalParams
• Added Interface PaymentHsmClustersDeleteOptionalParams
• Added Interface PaymentHsmClustersGetOptionalParams
• Added Interface PaymentHsmClusterSku
• Added Interface PaymentHsmClustersListByResourceGroupOptionalParams
• Added Interface PaymentHsmClustersListBySubscriptionOptionalParams
• Added Interface PaymentHsmClustersUpdateOptionalParams
• Added Interface PaymentHsmProperties
• Interface AzureDedicatedHSMResourceProviderOptionalParams has a new optional parameter cloudSetting
• Added Type Alias AzureSupportedClouds
• Added Type Alias HsmState
• Added Type Alias PaymentHsmClusterSkuFamily
• Added Type Alias PaymentHsmClusterSkuName
• Added Enum AzureClouds
• Added Enum KnownCloudHsmClusterSkuName
• Added Enum KnownHsmState
• Added Enum KnownPaymentHsmClusterSkuFamily
• Added Enum KnownPaymentHsmClusterSkuName
• Enum KnownVersions has a new value V20251201Preview

Breaking Changes

• Operation CloudHsmClustersOperations.createOrUpdate has a new signature
• Operation CloudHsmClustersOperations.get has a new signature
• Operation CloudHsmClustersOperations.listByResourceGroup has a new signature
• Operation CloudHsmClustersOperations.listBySubscription has a new signature
• Interface CloudHsmClusterBackupStatusGetOptionalParams no longer has parameter updateIntervalInMs
• Interface CloudHsmClusterRestoreStatusGetOptionalParams no longer has parameter updateIntervalInMs
• Type alias "CloudHsmClusterSkuName" has been changed