AzureAD/microsoft-identity-web 4.15.0

on GitHub

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #4006 #4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #4010
• Local redirect paths containing control characters are rejected. #4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #4018
• Non-local Host headers are rejected outside Development except on /healthz. #4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #4003 #3994 #4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #4020 #3994

Full changelog: 4.14.2...4.15.0