[DO NOT MERGE] Allow Azure Arc managed identity requests to forward user-assigned identity selectors by Copilot · Pull Request #944 · AzureAD/microsoft-authentication-library-for-python

Copilot · 2026-07-15T23:45:29Z

Azure Arc now previews user-assigned managed identity support. This change aligns MSAL Python with that behavior by removing the Arc-only rejection path and forwarding the selected identity on Arc token requests.

Will be released as preview: version = "1.38.0rc2"

Azure Arc request flow
- Remove the Azure Arc guard that rejected UserAssignedManagedIdentity.
- Thread managed_identity into _obtain_token_on_arc(...).
- Apply Arc-specific selector mapping on both the challenge request and the authenticated request:
  - client_id
  - mi_res_id
  - object_id
Parameter mapping
- Use the existing _adjust_param(...) helper with an explicit Arc/App Service-style mapping so resource IDs are sent as mi_res_id rather than the default resource_id.
Tests
- Replace the Arc “user-assigned not supported” expectation with Arc happy-path coverage for:
  - client_id
  - resource_id → mi_res_id
  - object_id
- Assert the selector is present on both Arc HTTP calls.

params = {"api-version": "2020-06-01", "resource": resource}
_adjust_param(params, managed_identity, types_mapping={
    ManagedIdentity.CLIENT_ID: "client_id",
    ManagedIdentity.RESOURCE_ID: "mi_res_id",
    ManagedIdentity.OBJECT_ID: "object_id",
})

Copilot

Pull request overview

This PR updates the Azure Arc managed identity flow in MSAL Python to allow forwarding user-assigned identity selectors (client ID, resource ID, object ID) instead of rejecting user-assigned managed identities on Arc. It threads the managed_identity input into the Arc request path and maps resource_id to Arc/App Service’s expected wire name mi_res_id for both the challenge and authenticated HTTP calls.

Changes:

Remove the Arc-only rejection of UserAssignedManagedIdentity and pass managed_identity into _obtain_token_on_arc(...).
Add Arc-specific selector parameter mapping (including resource_id → mi_res_id) on both Arc HTTP requests.
Update tests to validate selectors are forwarded for Arc user-assigned MI (client_id, mi_res_id, object_id) on both Arc calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`msal/managed_identity.py`	Allows Arc MI token acquisition to include user-assigned selector parameters (with Arc-specific mapping) on both Arc HTTP calls.
`tests/test_mi.py`	Replaces the “user-assigned not supported on Arc” expectation with happy-path tests asserting selector forwarding on both Arc requests.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 593fce2a-8559-422e-92e2-46fb29c251a4

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

+        - script: |
+            apt-get update && apt-get install -y python3 python3-pip python3-venv
+          displayName: 'Install Python 3'


Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

+        - script: python --version
+          displayName: 'Check Python version'

-        - script: |
-            python -m pip install --upgrade pip build twine
+        - script: python -m pip install --upgrade pip build twine
          displayName: 'Install build toolchain'

-        - script: |
-            python -m build
+        - script: python -m build
          displayName: 'Build sdist and wheel'


Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

+        - script: python --version
+          displayName: 'Check Python version'

-        - script: |
-            python -m pip install --upgrade pip build twine
+        - script: python -m pip install --upgrade pip build
          displayName: 'Install build toolchain'


+            buildType: 'current'
+            artifactName: 'drop_Build_BuildDist'
+            targetPath: $(Pipeline.Workspace)\python-dist



Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

        - task: DownloadPipelineArtifact@2
          displayName: 'Download build artifact'
          inputs:
-            artifactName: drop_Build_BuildDist
-            targetPath: $(Pipeline.Workspace)/python-dist
+            buildType: 'current'
+            artifactName: 'drop_Build_BuildDist'
+            targetPath: $(Pipeline.Workspace)\python-dist



+        - script: python --version
+          displayName: 'Check Python version'

-        - script: |
-            python -m pip install --upgrade pip build twine
-          displayName: 'Install build toolchain'
-
-        - script: |
-            python -m build
+        - script: python setup.py sdist bdist_wheel
          displayName: 'Build sdist and wheel'


    - stage: Build
      displayName: 'Build package'
      dependsOn: E2ETests
      condition: eq(dependencies.E2ETests.result, 'Succeeded')
      jobs:
      - job: BuildDist
-        displayName: 'Build sdist + wheel (Python 3.12)'
+        displayName: 'Build sdist + wheel'
        pool:
-          type: linux
-          isCustom: true
-          vmImage: 'ubuntu-22.04'
+          type: windows
        variables:
          ob_outputDirectory: '$(Build.ArtifactStagingDirectory)'
        steps:
-        - task: UsePythonVersion@0
-          inputs:
-            versionSpec: '3.12'
-          displayName: 'Use Python 3.12'
+        - script: python --version
+          displayName: 'Check Python version'

-        - script: |
-            python -m pip install --upgrade pip build twine
-          displayName: 'Install build toolchain'
-
-        - script: |
-            python -m build
+        - script: python setup.py sdist bdist_wheel
          displayName: 'Build sdist and wheel'


Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

+        - script: python setup.py sdist bdist_wheel
          displayName: 'Build sdist and wheel'


        - task: DownloadPipelineArtifact@2
          displayName: 'Download build artifact'
          inputs:
-            artifactName: drop_Build_BuildDist
-            targetPath: $(Pipeline.Workspace)/python-dist
+            buildType: 'current'
+            artifactName: 'drop_Build_BuildDist'
+            targetPath: $(Pipeline.Workspace)\python-dist



Initial plan

1c008b8

Copilot AI assigned Copilot and gladjohn Jul 15, 2026

Copilot AI requested review from Copilot and removed request for Copilot July 15, 2026 23:45

Copilot started work on behalf of gladjohn July 15, 2026 23:45 View session

Allow Azure Arc managed identity selectors

aa2bfbd

Copilot AI requested review from Copilot and removed request for Copilot July 15, 2026 23:47

gladjohn added the do not merge label Jul 15, 2026

Copilot AI changed the title ~~[WIP] [DO NOT MERGE] Add support for user-assigned managed identity in MSAL Python~~ [DO NOT MERGE] Allow Azure Arc managed identity requests to forward user-assigned identity selectors Jul 15, 2026

Copilot finished work on behalf of gladjohn July 15, 2026 23:48

Copilot AI requested a review from gladjohn July 15, 2026 23:48

gladjohn marked this pull request as ready for review July 16, 2026 02:24

gladjohn requested a review from a team as a code owner July 16, 2026 02:24

Copilot AI review requested due to automatic review settings July 16, 2026 02:24

Copilot started reviewing on behalf of gladjohn July 16, 2026 02:25 View session