[dreadnode-renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
azure-identity	1.25.3 → 1.27.0

---

Release Notes

Azure/azure-sdk-for-python (azure-identity)

v1.27.0

Compare Source

1.27.0 (2026-10-26)

Features Added

• Added support for WorkloadIdentityCredential identity binding mode in AKS environments. This feature uses an AKS proxy to handle FIC exchanges on behalf of pods, addressing Entra's limit on federated identity credentials per managed identity. Enable it by constructing WorkloadIdentityCredential directly with enable_azure_proxy=True. Identity binding mode isn't supported through DefaultAzureCredential. (#​43287, #​44147)

Bugs Fixed

• Fixed AzureDeveloperCliCredential to correctly parse error messages from Azure Developer CLI v1.23.7 and later, which previously caused raw JSON to surface in ClientAuthenticationError instead of the underlying error text. (#​46711)
• Fixed persistent token cache isolation on macOS when using custom cache names or CAE-enabled caches. (#​49314)
• Fixed a regression in 1.26.0 where asynchronous OnBehalfOfCredential instances could not reuse access or refresh tokens cached by another instance with the same user assertion. Cache entries are now isolated by user assertion, allowing safe reuse across instances, including with TokenCachePersistenceOptions. Existing cache entries without assertion binding require a fresh token exchange. (#​49533)

v1.26.0

Compare Source

1.26.0 (2026-09-30)

Features Added

• ManagedIdentityCredential now supports user-assigned managed identities on Azure Arc-enabled servers. An identity can be selected by client ID, object ID, or resource ID. Token responses that do not confirm the requested identity are rejected. (#​48967)

Bugs Fixed

• Fixed synchronous Service Fabric managed identity authentication with MSAL 1.39.0 and later. Service Fabric now uses the session from an Azure Core RequestsTransport. (#​48967)
• Fixed an issue where AuthorizationCodeCredential and the asynchronous OnBehalfOfCredential could return a cached token for another account when multiple credentials shared a token cache. (#​49001)

Other Changes

• Added RequestIdPolicy to the default pipeline policies to ensure a unique x-ms-client-request-id header is sent with each request. (#​46070)
• CertificateCredential now passes the PEM private key to MSAL as a str rather than bytes, matching MSAL's documented client_credential contract. (#​46801)
• Bumped the minimum dependency on msal to >=1.39.0.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.