# What changed in azure-identity

> 20 changes in azure-identity 1 from its official release notes, upgrade guides and advisories: 7 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/azure-identity/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## azure-identity 1

### Breaking changes

- The secret parameter was renamed to client_secret. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- prompt_callback is now a keyword argument, and its third argument is a datetime representing device-code expiration. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- The optional tenant keyword argument was renamed to tenant_id. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- The optional tenant keyword argument was renamed to tenant_id. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- The credential no longer accepts positional arguments and accepts only client_id as a keyword argument. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- Transport configuration is now provided through keyword arguments as described in azure-core documentation. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- Credentials with tenant_id and client_id positional parameters now accept them in that order. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)

### Security

- Supports user-assigned managed identities on Azure Arc-enabled servers, selectable by client ID, object ID, or resource ID; rejects token responses that do not confirm the requested identity. (1.26.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.26.0)

### New APIs and options

- DefaultAzureCredential accepts an authority keyword argument, enabling its use in national clouds. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)

### Behavior and default changes

- The default pipeline now includes RequestIdPolicy, ensuring each request sends a unique x-ms-client-request-id header. (1.26.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.26.0)
- Async credentials now default to aiohttp for transport; async use requires installing it or customizing the transport. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- client_id is now an optional keyword argument; when omitted, the Azure CLI's client ID is used. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)
- Authenticating with a single sign-on shared with other Microsoft applications requires a username only when multiple users have signed in. (1.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.0.0)

### Fixes and other changes

- Passes the PEM private key to MSAL as a str rather than bytes, matching MSAL's documented client_credential contract. (1.26.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.26.0)
- Fixes synchronous Service Fabric managed identity authentication with MSAL 1.39.0 and later by using the session from an Azure Core RequestsTransport. (1.26.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.26.0)
- AuthorizationCodeCredential and asynchronous OnBehalfOfCredential no longer return a cached token for another account when credentials share a token cache. (1.26.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.26.0)
- Expired tokens now refresh even when a recent token request would otherwise make the retry delay take precedence. (1.25.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.25.3)
- Several credentials now log access token cache hits at debug level to improve troubleshooting of token cache behavior. (1.25.2) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.25.2)
- Entra ID token requests that return empty responses now raise ClientAuthenticationError with the full response instead of an unhelpful TypeError. (1.25.2) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.25.2)
- Certain credentials now bypass the token cache when claims are provided in get_token or get_token_info calls. (1.25.2) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-identity_1.25.2)