[identity] Enable user-assigned managed identity for AzureArcCredential

[jenny (JennyPng)]

closes #48708

changes

Shared

• Bump msal min version to 1.38.0, which allows user-assigned managed identity (UAMI) for Azure Arc.
  • This automatically enables the sync path for Identity SDK to allow UAMI for Arc
• update CHANGELOG
• some formatting changes from azpysdk black

Service Fabric

• MSAL 1.38.0 breaks our Service Fabric implementation here fix(security): pin Service Fabric managed identity TLS AzureAD/microsoft-authentication-library-for-python#952 because it no longer accepts custom http clients and requires a requests.Session . We need to reach out to msal about this
• As a short-term fix, we update the sync Service Fabric path to pass in a requests.Session to MSAL.
  • updated the msal_managed_identity_client.py constructor to set self._client to _create_http_client() which ServiceFabric overrides
  • warn that custom transport / customizations won't be passed along
  • Updated unit tests to account for this and mock the network calls

Azure Arc (async)

• map resource_id to msi_res_id param name expected by MSAL
• validate that the Azure Arc response is the requested UAMI token - match MSAL behavior in accepting mi_res_id spelling as a safety net

Validation

todo

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Async response parity, silently ignored Service Fabric options, and contradictory release notes remain unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Enables Azure Arc user-assigned managed identities while adapting Service Fabric to MSAL 1.38.

Changes:

• Raises the minimum MSAL version.
• Adds async Azure Arc UAMI request and response handling.
• Uses requests.Session for synchronous Service Fabric authentication.

File summaries

File	Description
azure/identity/_credentials/azure_arc.py	Builds and validates Arc UAMI requests.
azure/identity/aio/_credentials/azure_arc.py	Enables async Arc UAMI.
azure/identity/_internal/msal_managed_identity_client.py	Adds overridable HTTP-client creation.
azure/identity/_credentials/service_fabric.py	Adds MSAL-compatible Service Fabric transport.
tests/test_managed_identity.py	Updates synchronous and Service Fabric tests.
tests/test_managed_identity_async.py	Tests async Arc UAMI selectors and validation.
pyproject.toml	Requires MSAL 1.38+.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The Service Fabric workaround silently ignores documented pipeline options and drops the Azure Identity user-agent.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

sdk/identity/azure-identity/azure/identity/_credentials/service_fabric.py:44

• A bare requests.Session no longer sends azure-identity's USER_AGENT; the previous Service Fabric path used build_pipeline, which installs UserAgentPolicy(base_user_agent=USER_AGENT), and the replaced test explicitly asserted that header. MSAL clones this session's headers for its pinned Service Fabric session, so initialize the session's User-Agent header before returning it to preserve SDK telemetry.

sdk/identity/azure-identity/azure/identity/_credentials/service_fabric.py:35

• This allowlist silently drops several pipeline customizations that this release explicitly advertises, including headers_policy, logging_policy, http_logging_policy, user_agent_policy, custom_hook_policy, per_retry_policies, and per_call_policies. In this override every remaining kwargs entry is discarded, so derive the warning list from the supplied keyword arguments rather than maintaining a partial list.

        ignored_options = [
            name
            for name in ("transport", "raw_request_hook", "raw_response_hook", "retry_policy", "proxy_policy")
            if kwargs.get(name) is not None
        ]

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Balanced