Add timeout for managed identity capability discovery

[Robbie-Microsoft]

Fixes #6180

Summary

Adds ManagedIdentityCapabilitiesOptions.CapabilityDiscoveryTimeout and a corresponding capability-discovery overload.

• Applies one cooperative deadline across lock contention, IMDSv2/IMDSv1 probes and retry delays, fallback, compute metadata, and binding-strength detection.
• Reports deadline expiration as MsalServiceException with request_timeout and a discovery-specific message.
• Preserves caller cancellation as OperationCanceledException.
• Prevents timed-out discovery from publishing to the process-wide cache.
• Validates timeout values synchronously and updates all applicable public API baselines.

Compatibility

• Existing and null-timeout calls preserve their prior cancellation ordering and retry-delay behavior.
• Cached results remain available to pre-canceled callers.
• Only explicitly configured capability discovery observes pre-cancellation before uncached environment detection.
• STS, normal managed identity, ordinary IMDS token, and region-discovery retry delays are unchanged.
• The unrelated null-response retry behavior is excluded from this PR.
• The expected D:\source\microsoft-identity-web checkout was unavailable, so the downstream source-usage search could not be run.

Testing

Coverage includes legacy cancellation behavior, diminishing v2-to-v1 budget, retry-delay timeout, compute-metadata timeout/cache recovery, key-work cache safety, and the discovery-specific message.

• Focused timeout/compatibility tests: 20 passed on net8 and 20 passed on net48
• Related managed-identity/HTTP tests: 410 passed on net8 and 410 passed on net48
• Full net8 unit suite: 2,338 passed, 22 skipped
• Product builds: net462, net472, netstandard2.0, and net8.0
• net48 unit-test project and public API checks passed

Documentation

• XML documentation updated
• Managed-identity capability-discovery documentation updated
• Applicable PublicAPI.Unshipped.txt baselines updated

assistance: agentic-cli
type: feature
agent-tool: copilot-cli
agent-model: gpt-5.6-sol
work-item: AB#n/a

[Copilot]

🔵 Needs a closer look

It introduces a new public API plus cross-cutting HTTP retry/cancellation contract changes, which warrants careful human review despite strong test coverage.

Pull request overview

Adds a caller-configurable total time budget for uncached managed identity capability discovery (including IMDSv2 probing/retries, IMDSv1 fallback, lock contention, compute metadata retrieval, and key/binding-strength work), while preserving existing behavior when no timeout is provided.

Changes:

• Introduces ManagedIdentityCapabilitiesOptions.ImdsProbeTimeout and a new ManagedIdentityApplication.GetManagedIdentityCapabilitiesAsync(options, cancellationToken) overload that translates budget expiration to MsalServiceException with MsalError.RequestTimeout.
• Threads cancellation through internal HTTP retry delays (and makes IMDS/region-discovery exception-only failures without an HTTP response non-retryable).
• Adds focused unit tests, updates managed identity mTLS PoP documentation, and updates Public API baselines across TFMs.

File summaries

File	Description
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ManagedIdentityCapabilitiesTimeoutTests.cs	New unit tests covering timeout budget behavior, retry-delay cancellation, lock contention, and caching semantics.
tests/Microsoft.Identity.Test.Unit/ManagedIdentityTests/ImdsV2Tests.cs	Updates pre-canceled discovery behavior assertion to match new cancellation checks.
tests/Microsoft.Identity.Test.Unit/Helpers/TestRetryPolicies.cs	Updates test retry policies to the new delay signature including CancellationToken.
src/client/Microsoft.Identity.Client/PublicApi/netstandard2.0/PublicAPI.Unshipped.txt	Adds new public API entries for options + overload.
src/client/Microsoft.Identity.Client/PublicApi/net8.0/PublicAPI.Unshipped.txt	Adds new public API entries for options + overload.
src/client/Microsoft.Identity.Client/PublicApi/net8.0-ios/PublicAPI.Unshipped.txt	Adds new public API entries for options + overload.
src/client/Microsoft.Identity.Client/PublicApi/net8.0-android/PublicAPI.Unshipped.txt	Adds new public API entries for options + overload.
src/client/Microsoft.Identity.Client/PublicApi/net472/PublicAPI.Unshipped.txt	Adds new public API entries for options + overload.
src/client/Microsoft.Identity.Client/PublicApi/net462/PublicAPI.Unshipped.txt	Adds new public API entries for options + overload.
src/client/Microsoft.Identity.Client/ManagedIdentityApplication.cs	Adds new options overload + shared core implementation that applies the discovery budget and maps budget expiration to request_timeout.
src/client/Microsoft.Identity.Client/ManagedIdentity/ManagedIdentityClient.cs	Ensures cancellation is checked immediately before publishing to the process-wide discovery cache (prevents caching after budget expiry).
src/client/Microsoft.Identity.Client/ManagedIdentity/ManagedIdentityCapabilitiesOptions.cs	New public options type to configure discovery timeout budget.
src/client/Microsoft.Identity.Client/ManagedIdentity/ManagedIdentityCapabilities.cs	Updates XML remarks for returned-type docs (needs small correction per PR comment).
src/client/Microsoft.Identity.Client/Instance/Discovery/NetworkMetadataProvider.cs	Updates retry policy implementation to new IRetryPolicy signature with CancellationToken.
src/client/Microsoft.Identity.Client/Http/Retry/RegionDiscoveryRetryPolicy.cs	Makes retry delay observe cancellation token.
src/client/Microsoft.Identity.Client/Http/Retry/IRetryPolicy.cs	Adds CancellationToken parameter to PauseForRetryAsync contract.
src/client/Microsoft.Identity.Client/Http/Retry/ImdsRetryPolicy.cs	Makes retry delay observe cancellation; keeps “no HTTP response” failures non-retryable.
src/client/Microsoft.Identity.Client/Http/Retry/HttpRetryConditions.cs	Adds null-safety for retry-condition helpers that are now invoked with response: null scenarios.
src/client/Microsoft.Identity.Client/Http/Retry/DefaultRetryPolicy.cs	Makes retry delay observe cancellation token.
src/client/Microsoft.Identity.Client/Http/HttpManager.cs	Passes request cancellation token into retry policies so delay is cancelable.
docs/mtlspop_managed_identity.md	Documents how to bound capability discovery via ImdsProbeTimeout and how timeout vs caller cancellation is surfaced.

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It introduces a new public API and makes cross-cutting changes to cancellation/retry behavior, which warrants final human review despite strong test coverage.

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

A null HttpResponse can still reach ImdsRetryPolicy.PauseForRetryAsync on timeout paths, causing a NullReferenceException instead of the intended timeout behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 26/26 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It introduces a new public API and makes cross-cutting contract changes in core HTTP retry plumbing, which warrants a final human review for downstream/behavioral impact.

Review details

• Files reviewed: 26/26 changed files
• Comments generated: 0 new
• Review effort level: Lite