Repository navigation
[Identity] Make managed identity mTLS PoP opt-in - #63298
Merged
Jonathan Cárdenas (JonathanCrd) merged 4 commits intoSep 23, 2026
Merged
Conversation
Jonathan Cárdenas (JonathanCrd)
requested review from
a team,
Jesse Squire (jsquire) and
m-nash
as code owners
September 23, 2026 02:53
Jonathan Cárdenas (JonathanCrd)
added this pull request to stack #63300
September 23, 2026 02:53
|
Azure Pipelines: 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Jonathan Cárdenas (JonathanCrd)
changed the title
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Azure.Identity API artifacts remain stale, and key tests do not yet reliably exercise the new default and opt-in paths.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Makes Azure.Core managed identity and client-certificate mTLS proof-of-possession explicitly opt-in.
Changes:
- Renames and propagates positive mTLS PoP configuration flags.
- Adds AppContext and environment-variable opt-in controls.
- Updates tests, documentation, schemas, API listings, and compatibility metadata.
| File | Description |
|---|---|
sdk/core/Azure.Core/tests/Identity/MsalManagedIdentityClientReflectionTests.cs |
Tests explicit PoP opt-in decisions. |
sdk/core/Azure.Core/tests/Identity/ManagedIdentityCredentialTests.cs |
Updates managed identity tests; the helper default and request-level default coverage require correction. |
sdk/core/Azure.Core/tests/Identity/DefaultAzureCredentialOptionsTests.cs |
Tests configuration cloning. |
sdk/core/Azure.Core/tests/Identity/ConfigurableCredentials/ConfigurableCredentialTests.cs |
Tests federated credential configuration. |
sdk/core/Azure.Core/tests/Identity/ClientCertificateCredentialTests.cs |
Tests client-certificate opt-in behavior. |
sdk/core/Azure.Core/src/Identity/MsalManagedIdentityClient.cs |
Applies the positive PoP flag. |
sdk/core/Azure.Core/src/Identity/ManagedIdentityClientOptions.cs |
Renames internal option state. |
sdk/core/Azure.Core/src/Identity/ManagedIdentityClient.cs |
Gates capability discovery. |
sdk/core/Azure.Core/src/Identity/DefaultAzureCredentialFactory.cs |
Propagates federated credential opt-in. |
sdk/core/Azure.Core/src/Identity/Credentials/ManagedIdentityCredentialOptions.cs |
Renames the public experimental option. |
sdk/core/Azure.Core/src/Identity/Credentials/ManagedIdentityCredential.cs |
Resolves the positive option. |
sdk/core/Azure.Core/src/Identity/Credentials/DefaultAzureCredentialOptions.cs |
Parses and clones the renamed setting. |
sdk/core/Azure.Core/src/Identity/Credentials/ClientCertificateCredential.cs |
Selects PoP behavior only when enabled. |
sdk/core/Azure.Core/src/Identity/Credentials/ClientAssertionCredentialOptions.cs |
Renames internal assertion option state. |
sdk/core/Azure.Core/src/Identity/Credentials/ClientAssertionCredential.cs |
Gates PoP client creation; existing PoP and failure tests must explicitly opt in. |
sdk/core/Azure.Core/src/Identity/ChainedTokenCredentialFactory.cs |
Propagates opt-in through credential chains. |
sdk/core/Azure.Core/src/Identity/AppContextSwitches.cs |
Defines positive switch and environment names. |
sdk/core/Azure.Core/src/docs/ExperimentalFeatures.md |
Documents explicit opt-in behavior. |
sdk/core/Azure.Core/src/docs/ConfigurationAndDependencyInjection.md |
Updates configuration guidance. |
sdk/core/Azure.Core/schema/ConfigurationSchema.json |
Renames schema properties and defaults. |
sdk/core/Azure.Core/CHANGELOG.md |
Records behavior and API changes. |
sdk/core/Azure.Core/api/Azure.Core.netstandard2.0.cs |
Updates Core’s API listing; forwarded Azure.Identity listings remain stale. |
sdk/core/Azure.Core/api/Azure.Core.net8.0.cs |
Updates Core’s API listing; forwarded Azure.Identity listings remain stale. |
sdk/core/Azure.Core/api/Azure.Core.net472.cs |
Updates the .NET Framework 4.7.2 API listing. |
sdk/core/Azure.Core/api/Azure.Core.net462.cs |
Updates the .NET Framework 4.6.2 API listing. |
sdk/core/Azure.Core/api/Azure.Core.net10.0.cs |
Updates the .NET 10 API listing. |
eng/apicompatbaselines/Azure.Core.xml |
Suppresses the intentional removal; Azure.Identity facade snapshots and compatibility baseline also need updates. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Jonathan Cárdenas (JonathanCrd)
changed the title
Jesse Squire (jsquire)
approved these changes
Sep 23, 2026
Jesse Squire (jsquire)
approved these changes
Sep 23, 2026
Base automatically changed from
JonathanCrd/restore-mtls-experimental
to
main
September 23, 2026 20:17
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jonathan Cárdenas (JonathanCrd)
force-pushed
the
JonathanCrd/enable-mtls-pop
branch
from
September 23, 2026 20:17
4fab366 to
2930e92
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Vinay Gera (g2vinay)
approved these changes
Sep 23, 2026
Jonathan Cárdenas (JonathanCrd)
deleted the
JonathanCrd/enable-mtls-pop
branch
September 23, 2026 23:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes Azure.Core mTLS proof-of-possession from opt-out to opt-in.
ManagedIdentityCredentialOptions.DisableMtlsProofOfPossessionproperty toEnableMtlsProofOfPossession.falseand propagates the positive flag through capability discovery, MSAL client creation, federated identity, and chained credential paths.ClientCertificateCredentialAppContext configuration to the opt-inAzure.Identity.EnableClientCertificateMtlsProofOfPossessionswitch andAZURE_IDENTITY_ENABLE_CLIENT_CERTIFICATE_MTLS_POPenvironment variable.This is layer 2 of a three-PR stack and depends on the experimental-status restoration PR.
Validation
ClientCertificateCredentialtests passed across all four target frameworks: 272 passed.