Allow Azure Arc managed identity requests to forward user-assigned identity selectors

[Copilot]

Azure Arc now previews user-assigned managed identity support. This change aligns MSAL Python with that behavior by removing the Arc-only rejection path and forwarding the selected identity on Arc token requests.

• Azure Arc request flow

  • Remove the Azure Arc guard that rejected UserAssignedManagedIdentity.
  • Thread managed_identity into _obtain_token_on_arc(...).
  • Apply Arc-specific selector mapping on both the challenge request and the authenticated request:
    • client_id
    • mi_res_id
    • object_id

• Parameter mapping

  • Use the existing _adjust_param(...) helper with an explicit Arc/App Service-style mapping so resource IDs are sent as mi_res_id rather than the default resource_id.

• Tests

  • Replace the Arc “user-assigned not supported” expectation with Arc happy-path coverage for:
    • client_id
    • resource_id → mi_res_id
    • object_id
  • Assert the selector is present on both Arc HTTP calls.

params = {"api-version": "2020-06-01", "resource": resource}
_adjust_param(params, managed_identity, types_mapping={
    ManagedIdentity.CLIENT_ID: "client_id",
    ManagedIdentity.RESOURCE_ID: "mi_res_id",
    ManagedIdentity.OBJECT_ID: "object_id",
})

[Copilot]

Pull request overview

This PR updates the Azure Arc managed identity flow in MSAL Python to allow forwarding user-assigned identity selectors (client ID, resource ID, object ID) instead of rejecting user-assigned managed identities on Arc. It threads the managed_identity input into the Arc request path and maps resource_id to Arc/App Service’s expected wire name mi_res_id for both the challenge and authenticated HTTP calls.

Changes:

• Remove the Arc-only rejection of UserAssignedManagedIdentity and pass managed_identity into _obtain_token_on_arc(...).
• Add Arc-specific selector parameter mapping (including resource_id → mi_res_id) on both Arc HTTP requests.
• Update tests to validate selectors are forwarded for Arc user-assigned MI (client_id, mi_res_id, object_id) on both Arc calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
msal/managed_identity.py	Allows Arc MI token acquisition to include user-assigned selector parameters (with Arc-specific mapping) on both Arc HTTP calls.
tests/test_mi.py	Replaces the “user-assigned not supported on Arc” expectation with happy-path tests asserting selector forwarding on both Arc requests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Bogdan Gavril (bgavrilMS)]

Gladwin Johnson (@gladjohn) - is this one review-able now?

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

msal/managed_identity.py:650

• The Arc selector mapping uses msi_res_id for ManagedIdentity.RESOURCE_ID, but the PR description/example says Arc should send resource IDs as mi_res_id. Please confirm which spelling Arc actually honors and align either the code/tests or the PR description/release notes so consumers aren’t misled.

        _adjust_param(params, managed_identity, types_mapping={
            ManagedIdentity.CLIENT_ID: "client_id",
            ManagedIdentity.RESOURCE_ID: "msi_res_id",  # Azure Arc honors the IMDS msi_res_id spelling; mi_res_id is ignored and returns the system-assigned identity
            ManagedIdentity.OBJECT_ID: "object_id",
        })

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

msal/managed_identity.py:650

• PR description says Arc should map user-assigned resource_id to the mi_res_id query param, but the implementation (and tests) use msi_res_id. Please align the PR description and implementation: either update the PR description/snippet to msi_res_id (if this is correct for Arc HIMDS), or switch this mapping (and the tests) to mi_res_id if that was the intended behavior.

    params = {"api-version": "2020-06-01", "resource": resource}
    if managed_identity:
        _adjust_param(params, managed_identity, types_mapping={
            ManagedIdentity.CLIENT_ID: "client_id",
            ManagedIdentity.RESOURCE_ID: "msi_res_id",  # Azure Arc honors the IMDS msi_res_id spelling; mi_res_id is ignored and returns the system-assigned identity
            ManagedIdentity.OBJECT_ID: "object_id",
        })

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

msal/managed_identity.py:676

• The wire name for ResourceId on Azure Arc is set to msi_res_id, but the PR description/example refers to mi_res_id. Please reconcile the naming (either update the PR description/example and test naming to msi_res_id, or switch the Arc mapping to mi_res_id if that is actually the intended/required Arc parameter) to avoid confusing consumers and future maintainers.

    params = {"api-version": "2020-06-01", "resource": resource}
    if managed_identity:
        _adjust_param(params, managed_identity, types_mapping={
            ManagedIdentity.CLIENT_ID: "client_id",
            ManagedIdentity.RESOURCE_ID: "msi_res_id",  # Azure Arc honors the IMDS msi_res_id spelling; mi_res_id is ignored and returns the system-assigned identity
            ManagedIdentity.OBJECT_ID: "object_id",
        })

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

msal/managed_identity.py:676

• The Arc selector mapping passed to _adjust_param duplicates ManagedIdentity._types_mapping (client_id/object_id/msi_res_id). Keeping a second hard-coded mapping here adds drift risk and makes it harder to reason about which mapping is authoritative. Prefer relying on the shared default mapping and keep the Arc-specific note as a comment.

    if managed_identity:
        _adjust_param(params, managed_identity, types_mapping={
            ManagedIdentity.CLIENT_ID: "client_id",
            ManagedIdentity.RESOURCE_ID: "msi_res_id",  # Azure Arc honors the IMDS msi_res_id spelling; mi_res_id is ignored and returns the system-assigned identity
            ManagedIdentity.OBJECT_ID: "object_id",

msal/managed_identity.py:665

• When Azure Arc does not echo back the requested selector, the exception message doesn’t include which selector was requested nor what value was echoed. Including those details would make it much easier to diagnose whether the agent ignored the selector vs. returned a different identity.

    if not echoed or str(echoed).lower() != str(requested).lower():
        raise ManagedIdentityError(
            "Azure Arc did not confirm the requested user-assigned managed identity "
            "in the token response. The agent likely does not support user-assigned "
            "managed identities and returned the system-assigned identity.")