Switch to using OAuth tokens (Azure Repos) and the MS auth broker by default

README.md

@@ -37,8 +37,8 @@ how to set up SSH: [Azure DevOps][azure-devops-ssh], [GitHub][github-ssh],
 Feature|Windows|macOS|Linux
 -|:-:|:-:|:-:
 Installer/uninstaller|✓|✓|✓
-Secure platform credential storage [(see more)][gcm-credstores]|✓|✓|✓
-Entra authentication with broker support|[opt-in][gcm-windows-broker]|✗|✗
+Secure platform [credential storage][gcm-credstores]|✓|✓|✓
+Entra authentication with [broker support][gcm-broker]|✓|✓|✓
 Azure DevOps authentication|✓|✓|✓
 GitHub & GHES authentication|✓|✓|✓
 Bitbucket Cloud & DC authentication|✓|✓|✓
@@ -172,7 +172,7 @@ When using GitHub logos, please be sure to follow the
 [gcm-license]: LICENSE
 [gcm-usage]: docs/usage.md
 [gcm-wsl]: docs/wsl.md
-[gcm-windows-broker]: docs/windows-broker.md
+[gcm-broker]: docs/msauth-broker.md
 [git-tools-credential-storage]: https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage
 [github]: https://github.com
 [github-ssh]: https://help.github.com/en/articles/connecting-to-github-with-ssh

docs/azrepos-users-and-tokens.md

@@ -27,8 +27,8 @@ resulted in a new authentication prompt.
 ### Microsoft identity OAuth tokens
 
 "Microsoft identity OAuth token" is the generic term for OAuth-based access
-tokens issued by Azure Active Directory for either Work and School Accounts
-(AAD tokens) or Personal Accounts (Microsoft Account/MSA tokens).
+tokens issued by Entra ID for either Work and School Accounts
+(Entra ID/AAD tokens) or Personal Accounts (Microsoft Account/MSA tokens).
 
 Azure DevOps supports Git authentication using Microsoft identity OAuth tokens
 as well as PATs. Microsoft identity OAuth tokens created by Git Credential

docs/configuration.md

@@ -699,28 +699,24 @@ git config --global credential.msauthFlow devicecode
 
 ---
 
-### credential.msauthUseBroker _(experimental)_
+### credential.msauthUseBroker
 
 Use the operating system account manager where available.
 
-Defaults to `false`. In certain cloud hosted environments when using a work or
-school account, such as [Microsoft DevBox][devbox], the default is `true`.
-
-These defaults are subject to change in the future.
+Defaults to `true`.
 
-_**Note:** before you enable this option on Windows, please review the
-[Windows Broker][wam] details for what this means to your local Windows user
-account._
+_**Note:** for more information about the authentication broker, please review
+the [Microsoft authentication broker][msauth-broker] information._
 
 Value|Description
 -|-
-`true`|Use the operating system account manager as an authentication broker.
-`false` _(default)_|Do not use the broker.
+`true` _(default)_|Use the operating system account manager as an authentication broker.
+`false`|Do not use the broker.
 
 #### Example
 
 ```shell
-git config --global credential.msauthUseBroker true
+git config --global credential.msauthUseBroker false
 ```
 
 **Also see: [GCM_MSAUTH_USEBROKER][gcm-msauth-usebroker]**
@@ -880,14 +876,12 @@ git -c credential.azreposUseLegacyClientId=true fetch
 
 Specify the type of credential the Azure Repos host provider should return.
 
-Defaults to the value `pat`. In certain cloud hosted environments when using a
-work or school account, such as [Microsoft DevBox][devbox], the default value is
-`oauth`.
+Defaults to the value `oauth`.
 
 Value|Description
 -|-
 `pat`|Azure DevOps personal access tokens
-`oauth`|Microsoft identity OAuth tokens (AAD or MSA tokens)
+`oauth`|Microsoft identity OAuth tokens (Entra ID or MSA tokens)
 
 Here is more information about [Azure Access tokens][azure-tokens].
 
@@ -1277,7 +1271,7 @@ Defaults to disabled.
 [trace2-event-env]: environment.md#GIT_TRACE2_EVENT
 [trace2-performance-docs]: https://git-scm.com/docs/api-trace2#_the_performance_format_target
 [trace2-performance-env]: environment.md#GIT_TRACE2_PERF
-[wam]: windows-broker.md
+[msauth-broker]: msauth-broker.md
 [service-principal]: https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
 [azrepos-sp-mid]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity
 [azrepos-wif-doc]: azrepos-wif.md

docs/environment.md

@@ -856,28 +856,24 @@ export GCM_MSAUTH_FLOW="devicecode"
 
 ---
 
-### GCM_MSAUTH_USEBROKER _(experimental)_
+### GCM_MSAUTH_USEBROKER
 
 Use the operating system account manager where available.
 
-Defaults to `false`. In certain cloud hosted environments when using a work or
-school account, such as [Microsoft DevBox][devbox], the default is `true`.
-
-These defaults are subject to change in the future.
+Defaults to `true`.
 
-_**Note:** before you enable this option on Windows, please
-[review the details][windows-broker] about what this means to your local Windows
-user account._
+_**Note:** for more information about the authentication broker, please review
+the [Microsoft authentication broker][msauth-broker] information._
 
 Value|Description
 -|-
-`true`|Use the operating system account manager as an authentication broker.
-`false` _(default)_|Do not use the broker.
+`true` _(default)_|Use the operating system account manager as an authentication broker.
+`false`|Do not use the broker.
 
 #### Windows
 
 ```batch
-SET GCM_MSAUTH_USEBROKER=true
+SET GCM_MSAUTH_USEBROKER=false
 ```
 
 #### macOS/Linux
@@ -982,14 +978,12 @@ export GCM_AZREPOS_USE_LEGACY_CLIENTID="true"
 
 Specify the type of credential the Azure Repos host provider should return.
 
-Defaults to the value `pat`. In certain cloud hosted environments when using a
-work or school account, such as [Microsoft DevBox][devbox], the default value is
-`oauth`.
+Defaults to the value `oauth`.
 
 Value|Description
 -|-
 `pat`|Azure DevOps personal access tokens
-`oauth`|Microsoft identity OAuth tokens (AAD or MSA tokens)
+`oauth`|Microsoft identity OAuth tokens (Entra ID or MSA tokens)
 
 More information about Azure Access tokens can be found [here][azure-access-tokens].
 
@@ -1465,7 +1459,7 @@ Defaults to disabled.
 [trace2-event-config]: configuration.md#trace2eventTarget
 [trace2-performance-docs]: https://git-scm.com/docs/api-trace2#_the_performance_format_target
 [trace2-performance-config]: configuration.md#trace2perfTarget
-[windows-broker]: windows-broker.md
+[msauth-broker]: msauth-broker.md
 [service-principal]: https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
 [azrepos-sp-mid]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity
 [azrepos-wif-doc]: azrepos-wif.md