Azure/azure-sdk-for-python azure-identity

1.27.0 (2026-10-26)

Added support for WorkloadIdentityCredential identity binding mode in AKS environments. This feature uses an AKS proxy to handle FIC exchanges on behalf of pods, addressing Entra's limit on federated identity credentials per managed identity. Enable it by constructing WorkloadIdentityCredential directly with enable_azure_proxy=True. Identity binding mode isn't supported through DefaultAzureCredential. (#43287, #44147)

Fixed AzureDeveloperCliCredential to correctly parse error messages from Azure Developer CLI v1.23.7 and later, which previously caused raw JSON to surface in ClientAuthenticationError instead of the underlying error text. (#46711)
Fixed persistent token cache isolation on macOS when using custom cache names or CAE-enabled caches. (#49314)
Fixed a regression in 1.26.0 where asynchronous OnBehalfOfCredential instances could not reuse access or refresh tokens cached by another instance with the same user assertion. Cache entries are now isolated by user assertion, allowing safe reuse across instances, including with TokenCachePersistenceOptions. Existing cache entries without assertion binding require a fresh token exchange. (#49533)