mTLS PoP: fix misleading region-required error messages + doc comments

src/client/Microsoft.Identity.Client/MsalError.cs

@@ -1185,14 +1185,14 @@ public static class MsalError
         public const string CryptographicError = "cryptographic_error";
 
         /// <summary>
-        /// <para>What happened?</para>mTLS Proof of Possession (mTLS PoP) is configured but a region was not specified.
-        /// <para>Mitigation</para>Ensure that the AzureRegion configuration is set when using mTLS PoP as it requires a regional endpoint.
+        /// <para>What happened?</para> A region is <b>not</b> required for mTLS Proof of Possession. When no region is specified, MSAL uses the global mTLS endpoint, so this error is no longer raised. The constant is retained for backwards compatibility.
+        /// <para>Mitigation</para> No action needed. Optionally set a region via .WithAzureRegion(...) for improved performance.
         /// </summary>
         public const string MtlsPopWithoutRegion = "mtls_pop_without_region";
 
         /// <summary>
-        /// <para>What happened?</para>mTLS Bearer is configured but a region was not specified.
-        /// <para>Mitigation</para>Ensure that the AzureRegion configuration is set when using mTLS Bearer as it requires a regional endpoint.
+        /// <para>What happened?</para> A region is <b>not</b> required for Bearer-over-mTLS. When no region is specified, MSAL uses the global mTLS endpoint, so this error is no longer raised. The constant is retained for backwards compatibility.
+        /// <para>Mitigation</para> No action needed. Optionally set a region via .WithAzureRegion(...) for improved performance.
         /// </summary>
         public const string MtlsBearerWithoutRegion = "mtls_bearer_without_region";
 
@@ -1203,8 +1203,8 @@ public static class MsalError
         public const string MtlsCertificateNotProvided = "mtls_certificate_not_provided";
 
         /// <summary>
-        /// <para>What happened?</para> mTLS Proof of Possession (mTLS PoP) requires a specific Azure region to be specified.
-        /// <para>Mitigation:</para> Ensure that the AzureRegion configuration is set when using mTLS PoP as it requires a regional endpoint.
+        /// <para>What happened?</para> A region is <b>not</b> required for mTLS Proof of Possession (mTLS PoP). When regional auto-detection does not yield a region, MSAL falls back to the global mTLS endpoint, so this error is no longer raised. The constant is retained for backwards compatibility.
+        /// <para>Mitigation:</para> No action needed. Optionally set a region via .WithAzureRegion(...) for improved performance.
         /// </summary>
         public const string RegionRequiredForMtlsPop = "region_required_for_mtls_pop";
 

src/client/Microsoft.Identity.Client/MsalErrorMessage.cs

@@ -437,15 +437,15 @@ public static string InvalidTokenProviderResponseValue(string invalidValueName)
         public const string SetCiamAuthorityAtRequestLevelNotSupported = "Setting the CIAM authority (ex. \"{tenantName}.ciamlogin.com\") at the request level is not supported. The CIAM authority must be set during application creation";
         public const string ClaimsChallenge = "The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see https://aka.ms/msal-conditional-access-claims. If you are using the On-Behalf-Of flow, see https://aka.ms/msal-conditional-access-claims-obo for details.";
         public const string CryptographicError = "A cryptographic exception occurred. Possible cause: the certificate has been disposed. See inner exception for full details.";
-        public const string MtlsPopWithoutRegion = "mTLS Proof of Possession requires a region to be specified. Please set AzureRegion in the configuration at the application level.";
+        public const string MtlsPopWithoutRegion = "mTLS Proof-of-Possession does not require a region. When no region is specified, MSAL uses the global mTLS endpoint. Setting AzureRegion is recommended for performance. See https://aka.ms/msal-net-pop for details.";
         public const string MtlsCertificateNotProvidedMessage = "mTLS Proof‑of‑Possession requires a certificate for this request. Either configure the application with .WithCertificate(...) or pass a certificate‑bound client‑assertion and chain .WithMtlsProofOfPossession() on the request builder. See https://aka.ms/msal-net-pop for details.";
         public const string MtlsNotSupportedWithClientClaimsMessage = "mTLS transport (Proof-of-Possession via .WithMtlsProofOfPossession() or Bearer-over-mTLS via CertificateOptions.SendCertificateOverMtls = true) is not supported when the credential is configured via .WithClientClaims(certificate, claimsToSign, ...). Custom client claims require a signed JWT-bearer client assertion, which is not produced in mTLS mode. To use mTLS, configure the application with .WithCertificate(certificate) without .WithClientClaims(...), or use .WithClientAssertion(...) with a signed assertion that carries the binding certificate. See https://aka.ms/msal-net-pop for details.";
-        public const string MtlsBearerWithoutRegion = "mTLS Bearer requires a region to be specified. Please set AzureRegion in the configuration at the application level.";
+        public const string MtlsBearerWithoutRegion = "Bearer-over-mTLS does not require a region. When no region is specified, MSAL uses the global mTLS endpoint. Setting AzureRegion is recommended for performance. See https://aka.ms/msal-net-pop for details.";
         public const string MtlsInvalidAuthorityTypeMessage = "mTLS PoP is only supported for AAD authority type. See https://aka.ms/msal-net-pop for details.";
         public const string MtlsNonTenantedAuthorityNotAllowedMessage = "mTLS authentication requires a tenanted authority. Using 'common', 'organizations', or similar non-tenanted authorities is not allowed. Please provide an authority with a specific tenant ID (e.g., 'https://login.microsoftonline.com/{tenantId}'). See https://aka.ms/msal-net-pop for details.";
         public const string MtlsNotSupportedForManagedIdentityMessage = "IMDSv2 flow is not supported on .NET Framework 4.6.2. Cryptographic operations required for managed identity authentication are unavailable on this platform.";
         public const string MtlsNotSupportedForNonWindowsMessage = "mTLS PoP with Managed Identity is not supported on this OS. See https://aka.ms/msal-net-pop.";
-        public const string RegionRequiredForMtlsPopMessage = "Regional auto-detect failed. mTLS Proof-of-Possession requires a region to be specified, as there is no global endpoint for mTLS. See https://aka.ms/msal-net-pop for details.";
+        public const string RegionRequiredForMtlsPopMessage = "mTLS Proof-of-Possession does not require a region. When regional auto-detection does not yield a region, MSAL falls back to the global mTLS endpoint. Setting a region via .WithAzureRegion(...) is recommended for performance. See https://aka.ms/msal-net-pop for details.";
         public const string MtlsPopNotSupportedForUsGovCloudApiMessage = "login.usgovcloudapi.net is not supported for mTLS PoP, please use login.microsoftonline.us";
         public const string MtlsPopNotSupportedForChinaCloudApiMessage = "login.chinacloudapi.cn is not supported for mTLS PoP, please use login.partner.microsoftonline.cn";
         public const string MtlsPopNotSupportedForNonLoginHostMessage = "mTLS PoP is only supported for hosts that start with 'login.'. The provided authority host does not meet this requirement. See https://aka.ms/msal-net-pop for details.";