[Identity] Bypass cache when claims provided in Managed Identity

[pvaneck]

Ensure the claims are propagated to the MSAL ManagedIdentityClient or, for those credentials not using MSAL, the cache is bypassed when claims are provided so that a new token request is made.

MSAL MI started accepting claims challenges in 1.31.0, so the minimum msal version was bumped. In MSAL, if a claims challenge is passed in, it ensures that a token from the cache isn't returned. Similar logic is adopted for non-MSAL credentials.

[Copilot]

Pull request overview

This pull request implements support for claims challenges in Managed Identity credentials by ensuring that when claims are provided, the token cache is bypassed and claims are properly propagated to the underlying authentication mechanism.

Changes:

• Bumped minimum msal version from >=1.30.0 to >=1.31.0 to support claims challenges in MSAL's ManagedIdentityClient
• Updated cache bypass logic in non-MSAL managed identity clients to return None when claims are provided
• Modified get_cached_token methods to accept and check for claims parameter across sync and async implementations
• Updated docstrings to reflect that claims are now supported (previously stated they would be ignored)

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pyproject.toml	Bumped minimum msal dependency to version 1.31.0 to support claims challenges
azure/identity/_internal/managed_identity_client.py	Added cache bypass logic when claims are provided in get_cached_token
azure/identity/_internal/msal_managed_identity_client.py	Modified _request_token to pass claims to MSAL's acquire_token_for_client as claims_challenge
azure/identity/_internal/managed_identity_base.py	Updated to pass kwargs to get_cached_token for cache bypass support
azure/identity/_credentials/managed_identity.py	Updated docstring to document claims parameter support
azure/identity/_credentials/imds.py	Modified to pass kwargs through to parent's _request_token
azure/identity/aio/_internal/managed_identity_base.py	Updated async version to pass kwargs to get_cached_token
azure/identity/aio/_credentials/managed_identity.py	Updated async docstring to document claims parameter support
azure/identity/aio/_credentials/imds.py	Updated async version to pass kwargs to get_cached_token
tests/test_managed_identity.py	Added test_claims_propagated to verify claims are passed to MSAL's acquire_token_for_client
tests/test_managed_identity_async.py	Added test_claims_force_token_refresh to verify cache bypass when claims provided, and test_access_tokens_cached to verify normal caching behavior
CHANGELOG.md	Updated bug fix entry and documented msal version bump

[pvaneck]

/check-enforcer override