Update proposal document for GetManagedIdentityCapabilitiesAsync by gladjohn · Pull Request #6040 · AzureAD/microsoft-authentication-library-for-dotnet

gladjohn · 2026-05-28T20:47:27Z

Update proposal document for GetManagedIdentityCapabilitiesAsync

Copilot

Pull request overview

This PR adds a new proposal document describing a planned API rename/expansion for managed identity “capability discovery” and a new request-level enforcement knob (WithMinStrength) for mTLS PoP binding strength.

Changes:

Introduces a proposal for GetManagedIdentityCapabilitiesAsync and a new ManagedIdentityCapabilities return type.
Proposes WithMinStrength(MtlsBindingStrength) for managed identity and confidential client token builders, with “floor assertion” semantics.
Documents API surface impact, acceptance criteria, and open design questions.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

- Fix namespace: ManagedIdentityApplication lives in Microsoft.Identity.Client (not .ManagedIdentity) (Copilot) - Drop `build/` from `fail at build/request time`; no analyzer is planned (Copilot) - Rename `EphemeralSoftware` -> `Software`: software path uses persisted CNG keys on Windows (CreateWindowsPersistedRsa), not in-memory (Copilot) - Collapse ImdsV1FailureReason + ImdsV2FailureReason into single `ErrorReason` to avoid coupling the public surface to v1/v2 (Bogdan) - Remove the [Obsolete] shim section; no external callers, just delete the old API (Bogdan) - Replace `IReadOnlyList<MtlsBindingStrength> SupportedBindingStrengths` with scalar `MaxSupportedBindingStrength`: MSAL always picks the host max, list adds no value to consumers (Bogdan) - Add `Alternatives considered` section for WithMinStrength shape (chained vs overload vs PoPOptions) (Bogdan) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Resolve open question #1: keep the boolean alongside MaxSupportedBindingStrength. The bool is the single, callable check the Azure SDK chain already wants (can this host do PoP at all?); MaxSupportedBindingStrength is the finer-grained signal for callers that care about the strength tier. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Shared by managed identity and confidential client, so the enum belongs in AppConfig rather than the MI sub-namespace. Resolves open question #3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace WithMinStrength chained builder with an overload of the existing WithMtlsProofOfPossession that takes a PoPOptions { MinStrength } bag. Keeps the builder surface stable and lets future PoP knobs (custom binding key, attestation level, etc.) land on PoPOptions rather than growing the builder. - PoPOptions class added in Microsoft.Identity.Client.AppConfig (alongside MtlsBindingStrength) - MinStrength defaults to Bearer (no floor); same behavior as the parameterless overload - Semantics table updated to key off PoPOptions.MinStrength - Sample usage shows the single-call form - Acceptance criteria updated (PoPOptions class + test for default behavior) - Alternatives section marked with the chosen shape Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

- Phase 1 (discovery) vs Phase 2 (PoPOptions floor) split; Phase 1 unblocks AKV. - Build on PR #6026 (compute-metadata host check, already VM-validated). - IsMtlsPopSupportedByHost is derived (> Bearer) and is NOT attestation. - Fold ManagedIdentitySource.ImdsV2 into Imds; note AKS + bearer-over-v2. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

…gelog link - Serialize GetManagedIdentityCapabilitiesAsync with a static SemaphoreSlim so concurrent first calls don't issue redundant IMDS probes or provision the binding key more than once (non-blocking fast-path acquire preserves the existing HTTP-probe cancellation point). - Remove 'MSAL' from the IMDS-unavailable error message. - Enrich the mtls_pop_requires_keyguard message with actionable VBS/KeyGuard guidance (error code unchanged). - Fix CHANGELOG entry to link this PR (#6049) instead of the proposal (#6040). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bgavrilMS

Agreed with the API proposals, but not with this document. The document should only capture the API proposals, the devex, the "why". Not the nitty gritty implementation detail, history of who build what, what was there before etc. The code + version history has all that

…endix Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update proposal document for GetManagedIdentityCapabilitiesAsync

525eaf3

Copilot AI review requested due to automatic review settings May 28, 2026 20:47

gladjohn requested a review from a team as a code owner May 28, 2026 20:47

Copilot started reviewing on behalf of gladjohn May 28, 2026 20:47 View session

Copilot AI reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

Update proposal-capabilities-and-minstrength.md

b184f3d

Copilot AI review requested due to automatic review settings May 28, 2026 20:58

Copilot started reviewing on behalf of gladjohn May 28, 2026 20:58 View session

Copilot AI reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS approved these changes May 28, 2026

View reviewed changes

Robbie-Microsoft mentioned this pull request May 28, 2026

Fix #6024: probe IMDSv2 first and remove preview latch #6041

Merged

gladjohn and others added 2 commits May 28, 2026 14:52

Copilot AI review requested due to automatic review settings May 28, 2026 22:19

Copilot started reviewing on behalf of gladjohn May 28, 2026 22:20 View session

gladjohn and others added 2 commits May 28, 2026 15:21

Copilot AI reviewed May 28, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

Robbie-Microsoft and others added 2 commits June 2, 2026 14:30

Merge branch 'main' into gladjohn-patch-17

8204c71

Copilot AI review requested due to automatic review settings June 2, 2026 18:57

Robbie-Microsoft approved these changes Jun 2, 2026

View reviewed changes

Copilot started reviewing on behalf of Robbie-Microsoft June 2, 2026 18:57 View session

Merge branch 'main' into gladjohn-patch-17

2d16e4b

Robbie-Microsoft enabled auto-merge (squash) June 2, 2026 18:58

Copilot AI reviewed Jun 2, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

Robbie-Microsoft mentioned this pull request Jun 2, 2026

Add GetManagedIdentityCapabilitiesAsync host capability discovery API (Phase 1) #6049

Merged

Potential fix for pull request finding

baf878b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 3, 2026 15:25

Copilot started reviewing on behalf of gladjohn June 3, 2026 15:25 View session

Merge branch 'main' into gladjohn-patch-17

a33cac6

Copilot AI reviewed Jun 3, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md

bgavrilMS reviewed Jun 3, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS reviewed Jun 3, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS reviewed Jun 3, 2026

View reviewed changes

Comment thread docs/msi_v2/proposal-capabilities-and-minstrength.md Outdated

bgavrilMS requested changes Jun 3, 2026

View reviewed changes

Address Bogdan review: drop history/phasing, add superseded-names app…

0aa0902

…endix Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

gladjohn requested a review from bgavrilMS June 3, 2026 22:18

bgavrilMS approved these changes Jun 3, 2026

View reviewed changes

Robbie-Microsoft merged commit 9ebadda into main Jun 3, 2026
15 checks passed

Robbie-Microsoft deleted the gladjohn-patch-17 branch June 3, 2026 22:51

Conversation

gladjohn commented May 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bgavrilMS left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants