mTLS PoP: fix misleading region-required error messages + doc comments#6127
Merged
Conversation
…omments A region is optional for mTLS Proof-of-Possession: when none is set, MSAL uses the cloud's global mtlsauth endpoint. Rewords the RegionRequiredForMtlsPop / MtlsPopWithoutRegion / MtlsBearerWithoutRegion error strings and XML doc comments (also fixes garbled redaction text). Public constants are unchanged and no longer raised, so there is no API or behavior change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Robbie-Microsoft
force-pushed
the
rginsburg/mtls-region-msg-fix
branch
from
July 15, 2026 17:08
9e8c5b1 to
52629d0
Compare
gladjohn
reviewed
Jul 15, 2026
gladjohn
approved these changes
Jul 15, 2026
neha-bhargava
approved these changes
Jul 15, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR corrects MSAL.NET mTLS PoP “region required” messaging by updating the affected error-message strings, XML doc comments, and the changelog to reflect that Azure region configuration is optional (MSAL falls back to the cloud’s global mTLS endpoint when no region is set).
Changes:
- Updated
MsalErrorMessagestrings (MtlsPopWithoutRegion,MtlsBearerWithoutRegion,RegionRequiredForMtlsPopMessage) to remove the incorrect “region required” claim and clarify the global-endpoint fallback. - Updated
MsalErrorXML doc comments for the corresponding public error-code constants to reflect that these errors are no longer raised and the constants remain for backward compatibility. - Added a 4.86.0 changelog entry describing the correction and reaffirming that the public constants are unchanged.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| src/client/Microsoft.Identity.Client/MsalErrorMessage.cs | Corrects user-facing error-message text about region requirements for mTLS PoP / Bearer-over-mTLS. |
| src/client/Microsoft.Identity.Client/MsalError.cs | Updates XML docs for the related public error-code constants to reflect correct behavior and backward-compat retention. |
| CHANGELOG.md | Documents the messaging/doc correction in the 4.86.0 release notes. |
Robbie-Microsoft
added a commit
that referenced
this pull request
Jul 15, 2026
Revert MsalError.cs and MsalErrorMessage.cs to baseline so this PR carries only the SNI / S2S-FIC tests and docs. The misleading region-required message + doc-comment fix now ships separately in #6127. Drop the message-fix clause from the CHANGELOG (docs + tests entries retained). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
… spacing Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
gladjohn
approved these changes
Jul 15, 2026
….WithAzureRegion(...) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Robbie-Microsoft
enabled auto-merge (squash)
July 15, 2026 17:28
neha-bhargava
approved these changes
Jul 15, 2026
This was referenced Jul 16, 2026
Open
Merged
Closed
Closed
fix: Bump Microsoft.Identity.Client from 4.86.0 to 4.86.1
Halceyon/open-telemetry-trace-listener#239
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splits the message-accuracy fix out of #6100 so it can ship in 4.86.0 on its own.
The
RegionRequiredForMtlsPop,MtlsPopWithoutRegion, andMtlsBearerWithoutRegionerror strings and XML doc comments claimed mTLS PoP requires an Azure region. It doesn't — when no region is set, MSAL falls back to the cloud's globalmtlsauthendpoint. Also fixes garbled******redaction text in two of the strings.No public API or behavior change: the constants are unchanged and are no longer raised. The broader SNI / S2S-FIC tests + docs stay in #6100.