Support Azure Arc user-assigned managed identity - #50371
Open
vcolin7 wants to merge 2 commits into
Open
Conversation
Upgrade MSAL4J to 1.26.0 and allow Arc UAMI requests to reach MSAL in both identity implementations. Preserve the existing Cloud Shell and Service Fabric restrictions, and cover direct and DefaultAzureCredential selector paths.
vcolin7
requested review from
a team,
Jonathan Giles (JonathanGiles),
Josue Gomez (SwayGom),
Alan Zimmer (alzimmermsft),
Ashish Chhabria (axisc),
Vinay Gera (g2vinay),
Eric Lam (MSFT) (hmlam),
Johnathan W (j7nw4r),
Josh Free (joshfree),
Moary Chen (moarychan),
Sagar Patel (sagar0207),
Xiaolu Dai (saragluna) and
SJ (sjkwak)
as code owners
September 5, 2026 08:58
github-project-automation
Bot
moved this to Untriaged
in Azure Identity SDK Improvements
|
Azure Pipelines: Successfully started running 1 pipeline(s). 35 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new DefaultAzureCredential Arc UAMI regression test doesn’t currently assert that the configured selector (clientId vs resourceId) is actually propagated, so it may not reliably catch regressions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR enables Azure Arc user-assigned managed identity (UAMI) support in the Java Identity libraries by removing legacy Arc-specific UAMI preflight rejection now that MSAL4J 1.26.0 can correctly handle Arc UAMI selection, and by adding regression coverage and documentation updates.
Changes:
- Upgraded
com.microsoft.azure:msal4jto 1.26.0 across the repo’s tagged consumers and version tracking. - Removed the Arc UAMI preflight restriction (while keeping Cloud Shell and Service Fabric restrictions) and removed the legacy Arc-only UAMI guard.
- Added/expanded tests and docs/CHANGELOG entries for Arc UAMI selection (client/resource/object ID where applicable) and fixed v2 chained-credential success-path logging.
File summaries
| File | Description |
|---|---|
| sdk/identity/azure-identity/src/test/java/com/azure/identity/ManagedIdentityCredentialTest.java | Adds Arc UAMI selector regression tests (client/resource/object ID) and keeps Cloud Shell/Service Fabric restriction coverage. |
| sdk/identity/azure-identity/src/test/java/com/azure/identity/DefaultAzureCredentialTest.java | Adds DefaultAzureCredential Arc UAMI tests (client/resource ID). |
| sdk/identity/azure-identity/src/main/java/com/azure/identity/ManagedIdentityCredentialBuilder.java | Documents Arc UAMI selector support. |
| sdk/identity/azure-identity/src/main/java/com/azure/identity/ManagedIdentityCredential.java | Removes Arc from the UAMI preflight rejection; retains Cloud Shell and Service Fabric rejections. |
| sdk/identity/azure-identity/src/main/java/com/azure/identity/ArcIdentityCredential.java | Removes legacy Arc UAMI rejection so MSAL can handle Arc UAMI selection. |
| sdk/identity/azure-identity/README.md | Documents Arc UAMI support and selector options for ManagedIdentityCredential/DefaultAzureCredential. |
| sdk/identity/azure-identity/pom.xml | Updates msal4j dependency to 1.26.0 (and associated tracking entries). |
| sdk/identity/azure-identity/CHANGELOG.md | Adds feature note for Arc UAMI and dependency update entry for msal4j 1.26.0. |
| sdk/identity/azure-identity-broker/pom.xml | Updates msal4j dependency to 1.26.0 (and associated tracking entries). |
| sdk/identity-v2/azure-identity/src/test/java/com/azure/v2/identity/ManagedIdentityCredentialTest.java | Adds v2 Arc UAMI selector regression tests and Cloud Shell restriction coverage. |
| sdk/identity-v2/azure-identity/src/test/java/com/azure/v2/identity/DefaultAzureCredentialTest.java | Adds v2 DefaultAzureCredential Arc UAMI selector tests and verifies credential caching behavior. |
| sdk/identity-v2/azure-identity/src/main/java/com/azure/v2/identity/ManagedIdentityCredentialBuilder.java | Documents Arc UAMI selector support in v2 builder. |
| sdk/identity-v2/azure-identity/src/main/java/com/azure/v2/identity/ManagedIdentityCredential.java | Removes Arc from the v2 UAMI preflight rejection; retains Cloud Shell rejection. |
| sdk/identity-v2/azure-identity/src/main/java/com/azure/v2/identity/ChainedTokenCredential.java | Fixes v2 success-path logging to reference the correct credential instance. |
| sdk/identity-v2/azure-identity/pom.xml | Updates msal4j dependency to 1.26.0 (and associated tracking entries). |
| sdk/identity-v2/azure-identity/CHANGELOG.md | Adds feature note for Arc UAMI, bug fix note, and dependency update entry for msal4j 1.26.0. |
| sdk/eventhubs/microsoft-azure-eventhubs/pom.xml | Updates test-scope msal4j to 1.26.0 for compatibility validation. |
| eng/versioning/external_dependencies.txt | Updates recorded msal4j external dependency version to 1.26.0. |
Review details
- Files reviewed: 18/18 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Verify that DefaultAzureCredential forwards configured client and resource IDs to the managed identity client. Rename the reused credential result so the test does not imply access token caching.
| <groupId>com.microsoft.azure</groupId> | ||
| <artifactId>msal4j</artifactId> | ||
| <version>1.23.1</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} --> | ||
| <version>1.26.0</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} --> |
Member
There was a problem hiding this comment.
Please add a changelog entry for this msal4j upgrade. azure-identity-broker ships this runtime dependency, so its unreleased changelog should mention the update from 1.23.1 to 1.26.0.
| when(miClient.authenticate(request)).thenReturn(TestUtils.getMockAccessToken(token, expiresAt)); | ||
| })) { | ||
| applicationMock.when(ManagedIdentityApplication::getManagedIdentitySource) | ||
| .thenReturn(ManagedIdentitySourceType.AZURE_ARC); |
Member
There was a problem hiding this comment.
The PR says the Service Fabric restriction is preserved, but v2 has no matching regression test. Please add a v2 Service Fabric test or clarify that MSAL handles this restriction.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Azure Identity routed Azure Arc token requests through MSAL, but both Java identity implementations rejected user-assigned identities before MSAL could handle them. MSAL4J 1.26.0 adds Arc UAMI selector forwarding and fail-closed identity confirmation, so this change removes the obsolete Arc preflight restriction.
msal4jdependency to 1.26.0 for all tagged consumers.azure-identityandazure-identity-v2, while preserving the Cloud Shell and Service Fabric restrictions.ArcIdentityCredential.DefaultAzureCredentialcoverage.DefaultAzureCredentialclient/resource ID regression coverage, plus related documentation and changelog entries.Validation
azure-identity,azure-identity-broker, andazure-identity-v2.msal4j:1.26.0.oid.identity_not_foundinstead of falling back to the system identity.Fixes: #50233
All SDK Contribution checklist:
General Guidelines and Best Practices
Testing Guidelines
Written with the help of vcolin7-copilot.