Dependencies updates

• Bump the Microsoft.IdentityModel.* (Wilson) version to 8.22.0. See #3986.
• Fix the net8.0 crypto floor to use the patched System.Security.Cryptography.Xml 8.0.4 (and its System.Security.Cryptography.Pkcs 8.0.1 dependency) instead of over-bumping to the 9.0.18 servicing line (CVE-2026-47302, -47304, -50525, -50648). net9.0 (9.0.18) and net10.0 (10.0.10) are unchanged. See #3989.

New features

• Add MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience to partition the app token cache by resource/audience. See #3979.
• Expose MSAL's background token-refresh callback through Id.Web via TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted. See #3973.
• Add MicrosoftIdentityOptions.UseFastUnboundedCache; stop short-circuiting the in-memory token cache serialization provider. See #3970.
• OIDC FIC (Microsoft.Identity.Web.OidcFIC) now supports mTLS token binding. See #3851.

Bug fixes

• Token binding: the CCA cache key now distinguishes a bound credential (UseBoundCredential = true) from its unbound equivalent; the certificate-error retry path invalidates the cache entry for the actual request mode (bearer vs mTLS PoP).
• Forward the OpenTelemetry tags enricher onto the inner FIC client-assertion leg. See #3968.

Dependencies updates

• Microsoft.Identity.Client → 4.87.0 (#3975)
• Microsoft.Identity.Abstractions → 12.6.0 (#3976)
• System.Security.Cryptography.Xml / System.Security.Cryptography.Pkcs → patched (CVE-2026-47302, -47304, -50525, -50648) (#3964)
• notsecurity group: 1 update (#3965)

Full changelog: 4.13.2...4.14.0

What's Changed

• Apply reserved-header handling on the request-clone path and cover all X-MS-TOKEN- headers by @iNinja in #3915
• Restore independent PR pipeline + pool-aware MI identity + net462/472 unit tests by @iarekk in #3935
• Post-release 4.13.0: changelog and public API shipped move by @neha-bhargava in #3937
• Remove redundant 'Run unit tests' GitHub Action by @iarekk in #3939
• Apply consistent redirect-URI validation on AccountController.SignIn by @iNinja in #3940
• Fix duplicate logging of MsalUiRequiredException (in-repo copy of #3910) by @iarekk in #3941
• Use MSAL's recent UserFIC API for agentic flows by @Avery-Dunn in #3842
• Restore CustomizeHttpRequestMessage to run after the authorization header by @neha-bhargava in #3943
• Bump Microsoft.IdentityModel.Tokens.Saml from 5.7.0 to 8.19.1 by @dependabot[bot] in #3909
• Revert #3909: keep OWIN Saml/WsFederation on 5.7.0 by @iarekk in #3944
• Bump Microsoft.Identity.Abstractions from 12.4.0 to 12.5.0 by @neha-bhargava in #3947
• Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to DownstreamApi by @neha-bhargava in #3942
• Update IdentityModelV5Version and SamlPackageVersion to 5.7.1 in proj… by @trwalke in #3950
• Rename retired MSALMSIV2 agent pool to MISEManagedIdentity by @gladjohn with @Copilot in #3949
• Improve IDW10109 error handling for credential loading failures by @Avery-Dunn in #3946
• Bump MSAL dependencies to 4.86.1 in central props by @gladjohn with @Copilot in #3953
• Bump the notsecurity group with 3 updates by @dependabot[bot] in #3954

Full Changelog: 4.13.0...4.13.2

What's Changed

• Categorize managed-identity E2E tests and exclude them from the PR build by @iarekk in #3923
• Add more tests for TokenAcquisitionMetadata.ExpiresOn from AuthenticationResult by @neha-bhargava in #3904
• Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI by @RyAuld in #3926
• docs: Credential architecture internals documentation by @gladjohn in #3886
• Potential fix for code scanning alert no. 35: Missing cross-site request forgery token validation by @gladjohn in #3929
• Register IAuthorizationHeaderProvider2 in DI by @neha-bhargava in #3927
• Bump Microsoft.Identity.Client to 4.86.0 by @neha-bhargava in #3931
• Split PR pipeline into independent net8 stages; add MI E2E stage on MSALMSIV2 by @iarekk in #3933
• Run missing unit test projects in the ADO PR build by @iarekk in #3934
• Revert PRs #3933 and #3934: restore single-job PR pipeline by @gladjohn with @Copilot in #3936

Full Changelog: 4.12.2...4.13.0

Bug fixes

• Make the Microsoft.Identity.Client.KeyAttestation dependency conditional on modern .NET (.NETCoreApp) targets. It transitively pulls the native-only Microsoft.Azure.Security.KeyGuardAttestation package, which ships no .NET Framework/netstandard-compatible assets and broke NuGet restore for .NET Framework (packages.config) projects. Microsoft.Identity.Web.Certificateless now multi-targets, and .NET Framework consumers use the netstandard2.0 asset without this dependency. See #3894.

Bug fixes

• Preserve ManagedIdentity when converting AcquireTokenOptions to TokenAcquisitionOptions in TokenAcquirer. Previously the ITokenAcquirer.GetTokenForAppAsync / GetTokenForUserAsync paths silently dropped ManagedIdentity and fell back to the confidential-client path, breaking managed-identity mTLS PoP (e.g. MISE Native). See #3914.

Behavior changes

• Sidecar: outbound HTTP redirects suppressed by default. The sidecar no longer follows outbound HTTP redirects; a new opt-in Sidecar:AllowOutboundRedirects flag (default false) restores the previous behavior. See #3906.
• Sidecar: per-request isolation of downstream API options. Downstream API options resolved from the singleton IOptionsMonitor are now cloned per request (including fresh ExtraParameters / ExtraHeaderParameters / ExtraQueryParameters dictionaries), preventing request-scoped values from leaking across requests or racing under concurrency. See #3919.

Fundamentals

• Build the solution in the PR pipeline before running tests. See #3911.
• Restore OWIN 5.7.1 packages from the internal IDDP feed in the PR pipeline. See #3912.
• Run the PR pipeline on the Wilson pool so integration/E2E tests can access the lab KeyVault. See #3913.

New features

• Implement IAuthorizationHeaderProvider2 (from Microsoft.Identity.Abstractions 12.3.0) on DefaultAuthorizationHeaderProvider and the public BaseAuthorizationHeaderProvider, exposing the metadata-rich CreateAuthorizationHeaderInformation* surface (returning OperationResult<AuthorizationHeaderInformation, AuthorizationHeaderError>) with binding-certificate propagation. DownstreamApi and MicrosoftIdentityMessageHandler now prefer IAuthorizationHeaderProvider2 for mTLS PoP and soft-deprecate the bound-only IBoundAuthorizationHeaderProvider path (kept as a fallback for source/binary compatibility). See #3899.
• Populate TokenAcquisitionMetadata.ExpiresOn on AcquireTokenResult from the MSAL AuthenticationResult.ExpiresOn value. See #3905.

Bug fixes

• Finalize the DownstreamApi request (headers, query parameters, content, and customizations) before creating the authorization header, adding Authorization only after signing so request-binding providers do not include it in their signed material. See #3902.

Dependencies updates

• Update Microsoft.Identity.Abstractions to 12.4.0. See #3899, #3905.
• Update MSAL.NET (Microsoft.Identity.Client / Microsoft.Identity.Client.KeyAttestation) to 4.85.2. See #3896.
• Update Microsoft.IdentityModel.Protocols.WsFederation (Microsoft.Identity.Web.OWIN) to 5.7.1. See #3900.

What's Changed

• Bump vitest from 3.2.4 to 4.1.0 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in #3836
• Bump MSAL.NET to 4.84.2 and align OWIN binding redirects by @gladjohn with @Copilot in #3844
• docs(design): devex proposal for mTLS PoP on Managed Identity and FIC by @gladjohn in #3832
• Prevent OpenIdConnectMiddlewareDiagnostics from logging sensitive values by @iarekk in #3850
• Add MSI mTLS PoP support: pure MI + FIC-with-MI (impl for devex #3832) by @gladjohn in #3839
• docs(design): devex proposal for Bearer tokens with bound credentials by @gladjohn in #3833
• Add bound-credential support for Bearer tokens (cert + mTLS) by @gladjohn in #3835
• Upgrade IdWeb Sidecar to .NET 10 (LTS) by @soodt in #3841
• MTLS Without Tokens Support - MicrosoftIdentityMessageHandler Support by @tlupes in #3815
• fix: include isTokenBinding in CCA cache key to prevent bearer/PoP collision by @gladjohn in #3867
• Test + doc: x-ms-tokenboundauth header for AKV mTLS PoP via ExtraHeaderParameters by @gladjohn in #3864
• Add mTLS PoP Copilot skill (certificate, MSI, FIC) by @gladjohn in #3872
• Fix CVE-2026-48109: Pin MessagePack to patched version 2.5.301 by @soodt in #3865
• Sidecar: gate agent identity parameters behind AllowOverrides by @iNinja in #3871
• Bump System.Formats.Asn1 base version to 10.0.2 by @iarekk in #3875
• Bump Microsoft.IdentityModel.* from 8.18.0 to 8.19.1 by @iarekk in #3879
• Use IIdentityLogger for MSAL logging in TokenAcquisition and ManagedIdentityClientAssertion (#3820) by @neha-bhargava in #3880
• Update Microsoft.Identity.Abstractions to 12.2.0 and MSAL to 4.85.0 by @neha-bhargava in #3881
• Surface MSAL AuthenticationResultMetadata + exception details on AcquireTokenResult by @neha-bhargava in #3856
• Flow outgoing request to header providers via AcquireTokenOptions by @neha-bhargava in #3876
• Throw on Authority vs Instance/TenantId conflict (OIDC + MSAL parity) by @iarekk in #3873
• Delete .github/workflows/evergreen.yml by @bgavrilMS in #3803
• Add comprehensive authority configuration and precedence documentation by @jmprieur with @Copilot in #3617
• Bump js-yaml from 4.1.1 to 4.2.0 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in #3862
• Move authority docs into docs/authority-configuration/ subfolder by @iarekk in #3885
• Revert "Throw on Authority vs Instance/TenantId conflict (#3873)" by @iarekk in #3888
• Update Microsoft.Identity.Client to 4.85.1 by @neha-bhargava in #3889
• Enable E2E test coverage on internal Azure DevOps pipelines by @gladjohn in #3883
• Bump esbuild and tsx in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in #3859
• Skip AcquireTokenWithMtlsPop test: AAD westus3 test slice returns Bearer by @neha-bhargava in #3892

New Contributors

• @iarekk made their first contribution in #3850
• @soodt made their first contribution in #3841

Full Changelog: 4.10.0...4.11.0

Bug fixes

• Improve User Agent processing in cookie policy extensions. See PR #3824 for details.
• Use LRU cache for issuer address in B2C OpenID Connect event handler to improve performance. See PR #3823 for details.

Dependencies updates

• Pin Microsoft.Kiota.Abstractions to 1.22.0 for GraphServiceClient, fixing NU1903 build break caused by the GHSA-7j59-v9qr-6fq9 advisory. See PR #3818 for details.
• Pin Microsoft.Kiota.Abstractions to 1.22.0 for GraphServiceClientBeta, fixing the same advisory. See PR #3827 for details.

Fundamentals

• Migrate tests to Lab.API 2.x. See PR #3837 for details.
• Fix web UI tests. See PR #3838 for details.

New features

• Add WithExtraBodyParameters fluent API for attaching extra body parameters to token acquisition requests. See #3819.
• Add IConfidentialClientApplicationProvider extensibility interface and CachePartitionKey support for silent token acquisition. See #3822.

Bug fixes

• Redirect URI sanitization in authorization scenarios; centralize redirect URI validation in a shared helper. See #3825.
• Reject dSTS-shaped Authority values with a clearer exception, steering users to use Instance + TenantId instead. See #3805.
• Improve regex handling and adding length/timeout safeguards for SameSite User Agent. See #3811.

Behavior changes

• B2C OpenID Connect event handler: LRU cache for issuer address. Issuer address lookups in the B2C OIDC event handler are now cached with an LRU cache, improving performance for repeated lookups. See #3821.

Dependencies updates

• Update MSAL.NET to 4.84.1. See #3822.
• Pin Microsoft.Kiota.Abstractions to 1.22.0 for GraphServiceClient. See #3817.
• Bump uuid and @azure/msal-node in SidecarAdapter TypeScript test app. See #3826.
• Bump qs in SidecarAdapter TypeScript test app. See #3829.