[authentication] Enable broker based authentication (preview) on macOS (opt-in via enable_broker_on_mac=true) - #33376
Conversation
- Add enable_broker_on_mac config (default: False, opt-in via core.enable_broker_on_mac=true) - Pass enable_broker_on_mac to MSAL Identity and PublicClientApplication - Add EnableBrokerOnMac telemetry property - Install msal[broker] on darwin in addition to win32 - Add requirements.py3.MacOS.txt with msal[broker] and pymsalruntime pinned - Update build script to use MacOS requirements file - Add unit tests for broker_on_mac default and opt-in behavior Supersedes Azure#32773
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
microsoft-github-policy-service
Bot
added
Account
There was a problem hiding this comment.
Pull request overview
This PR adds opt-in macOS broker authentication support for az login, wiring the new setting through Azure CLI Core authentication, telemetry, packaging, and macOS release dependencies.
Changes:
- Adds
core.enable_broker_on_machandling and passes it into MSAL Identity/PublicClientApplication. - Records macOS broker state in telemetry and adds unit coverage for default/opt-in behavior.
- Adds a macOS-specific pinned requirements file and updates the macOS binary packaging script to use it.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
src/azure-cli/requirements.py3.MacOS.txt |
Adds a macOS-specific dependency lockfile with broker MSAL runtime dependencies. |
src/azure-cli-core/setup.py |
Expands MSAL broker extra installation to macOS. |
src/azure-cli-core/azure/cli/core/tests/test_profile.py |
Adds tests for default and enabled macOS broker config behavior. |
src/azure-cli-core/azure/cli/core/telemetry.py |
Adds telemetry property for macOS broker enablement. |
src/azure-cli-core/azure/cli/core/auth/identity.py |
Passes macOS broker enablement into MSAL public client kwargs. |
src/azure-cli-core/azure/cli/core/_profile.py |
Reads macOS broker config and forwards it to telemetry and Identity. |
scripts/release/macos/build_binary_tar_gz.py |
Switches macOS binary packaging to the new macOS requirements file. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| SRC_DIR = PROJECT_ROOT / "src" | ||
| AZURE_CLI_CORE_DIR = SRC_DIR / "azure-cli-core" | ||
| REQUIREMENTS_FILE = SRC_DIR / "azure-cli" / "requirements.py3.Darwin.txt" | ||
| REQUIREMENTS_FILE = SRC_DIR / "azure-cli" / "requirements.py3.MacOS.txt" |
Naga Nandyala (naga-nandyala)
changed the title
| 'msal[broker]==1.35.1; sys_platform == "win32" or sys_platform == "darwin"', | ||
| 'msal==1.35.1; sys_platform != "win32" and sys_platform != "darwin"', |
There was a problem hiding this comment.
This is created only for public preview (parallel path).. the exsting darwin file and homebrew-core and pip flow will still continue
There was a problem hiding this comment.
User who use existing homebew-core should not enable this setting..
we will drive this via documentation during preview phase.
Naga Nandyala (naga-nandyala)
changed the title
|
🔔 Routing this PR to @act-identity-squad. |
|
🔔 Routing this PR to @act-platform-engineering-squad. |
|
Tested this branch against a real Platform SSO–registered macOS device and wanted to share a concrete repro, since this is a pain point for Environment: macOS 26.5 (25F71), Company Portal 5.2604.1, Enterprise SSO extension Client-side plumbing — verified working: Device-level — broker engages but is blocked server-side: driving MSAL with the Azure CLI first-party client id ( So end-to-end SSO additionally needs the macOS broker redirect URI(s) added to the CLI's first-party app registration. Is that server-side registration planned alongside this preview? Happy to re-test against the live PSSO device once it's in. Thanks for pushing this forward. |
|
Curious Yong Zhang (@yonzhan) if there's any forecast when this will ship? |
|
Any progress? Having |
# Conflicts: # scripts/release/standalone/build_binary_tar_gz.py # src/azure-cli-core/setup.py
Naga Nandyala (naga-nandyala)
changed the title
🤖 PR Validation — ️✔️ All clear
Related command
az loginDescription
Enable broker-based authentication on macOS as a preview, opt-in feature.
Changes:
core.enable_broker_on_mac, defaulting tofalse, and pass it through Azure CLI's identity layer to MSAL'sPublicClientApplication.az config set core.enable_broker_on_mac=true.msal[broker]==1.36.0on Windows and macOS for pip and standalone cask installations while retaining plain MSAL on other platforms.msal==1.36.0, withoutpymsalruntime, because the formula flow accepts source-built dependencies only.requirements.py3.Darwin.Broker.txtas the standalone cask overlay that pinsmsal[broker]==1.36.0andpymsalruntime==0.20.6.EnableBrokerOnMactelemetry custom property.false) and opt-in (true) behavior.For architectural support and prerequisites, refer to the Azure CLI macOS documentation.
Supersedes #32773.
Testing Guide
az login. Authentication should work as before with broker disabled by default.az config set core.enable_broker_on_mac=true, thenaz login. Azure CLI should use broker-based authentication.az config unset core.enable_broker_on_macto restore the default non-broker behavior.History Notes
N/A
This checklist is used to make sure that common guidelines for a pull request are followed.