# What changed in @azure/identity

> 8 changes in @azure/identity 4 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@azure/identity/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @azure/identity 4

### Breaking changes

- Node.js v20 is supported, while Node.js v16 is no longer supported. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/HEAD/sdk/identity/identity/CHANGELOG.md)

### Security

- Replaced shell-based execution with safe, structured process execution for developer credential commands. (4.13.2) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/0ba8212af06f58a1ff49eaccdcda2fb147445da1/sdk/identity/identity/CHANGELOG.md#4132-2026-08-12)

### Behavior and default changes

- Brokered authentication on Windows OS, such as WAM, is now generally available. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/HEAD/sdk/identity/identity/CHANGELOG.md)
- Browser customization for success and error messages is now generally available. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/HEAD/sdk/identity/identity/CHANGELOG.md)

### Fixes and other changes

- EnvironmentCredential and DefaultAzureCredential now honor this environment variable; the additionallyAllowedTenants option takes precedence when set. (4.14.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/0ba8212af06f58a1ff49eaccdcda2fb147445da1/sdk/identity/identity/CHANGELOG.md#4140-2026-10-14)
- Error messages and logs include only relevant details when the OIDC token request fails. (4.14.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/0ba8212af06f58a1ff49eaccdcda2fb147445da1/sdk/identity/identity/CHANGELOG.md#4140-2026-10-14)
- Caught errors are preserved as the cause when errors are wrapped. (4.14.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/0ba8212af06f58a1ff49eaccdcda2fb147445da1/sdk/identity/identity/CHANGELOG.md#4140-2026-10-14)
- Authentication works when the user's default browser is already running and permits only a single instance. (4.14.0) — [release notes](https://github.com/Azure/azure-sdk-for-js/blob/0ba8212af06f58a1ff49eaccdcda2fb147445da1/sdk/identity/identity/CHANGELOG.md#4140-2026-10-14)