pypi / azure-identity
azure-identity
What changed in azure-identity 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
7 breaking1 security1 new APIs and options4 behavior and defaults7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initazure-identity 120 changes
Breaking changes 7
The secret parameter was renamed to client_secret.
prompt_callback is now a keyword argument, and its third argument is a datetime representing device-code expiration.
The optional tenant keyword argument was renamed to tenant_id.
The optional tenant keyword argument was renamed to tenant_id.
The credential no longer accepts positional arguments and accepts only client_id as a keyword argument.
Transport configuration is now provided through keyword arguments as described in azure-core documentation.
Credentials with tenant_id and client_id positional parameters now accept them in that order.
Security 1
Supports user-assigned managed identities on Azure Arc-enabled servers, selectable by client ID, object ID, or resource ID; rejects token responses that do not confirm the requested identity.
New APIs and options 1
DefaultAzureCredential accepts an authority keyword argument, enabling its use in national clouds.
Behavior and default changes 4
The default pipeline now includes RequestIdPolicy, ensuring each request sends a unique x-ms-client-request-id header.
Async credentials now default to aiohttp for transport; async use requires installing it or customizing the transport.
client_id is now an optional keyword argument; when omitted, the Azure CLI's client ID is used.
Authenticating with a single sign-on shared with other Microsoft applications requires a username only when multiple users have signed in.
Fixes and other changes 7
Passes the PEM private key to MSAL as a str rather than bytes, matching MSAL's documented client_credential contract.
Fixes synchronous Service Fabric managed identity authentication with MSAL 1.39.0 and later by using the session from an Azure Core RequestsTransport.
AuthorizationCodeCredential and asynchronous OnBehalfOfCredential no longer return a cached token for another account when credentials share a token cache.
Expired tokens now refresh even when a recent token request would otherwise make the retry delay take precedence.
Several credentials now log access token cache hits at debug level to improve troubleshooting of token cache behavior.
Entra ID token requests that return empty responses now raise ClientAuthenticationError with the full response instead of an unhelpful TypeError.
Certain credentials now bypass the token cache when claims are provided in get_token or get_token_info calls.