Back to Explore

AzureAD/microsoft-authentication-library-for-python

GitHub
1 updates · last 90 days1 watchersOpen source

Last release:

Microsoft Authentication Library (MSAL) for Python helps you authenticate applications against Microsoft Entra ID (Microsoft identity platform) and obtain OAuth2 tokens to call Microsoft APIs like Microsoft Graph or your own APIs. It supports signing in users or apps with Microsoft identities, and uses standard OAuth2 and OpenID Connect protocols, with documentation and stable APIs available on Learn and ReadTheDocs.

Project status

  • Actively maintained, with a recent upstream push on 2026-07-16 and versioned updates continuing through 2026 (1.35.1 on 2026-03-04, 1.36.0 on 2026-04-09, 1.37.0 on 2026-06-01).
  • Apparent cadence is roughly every 1 to 2 months for updates, at least across the last three shown updates, suggesting an ongoing development and release process.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • 1.37.0

    Release 1.37.0 adds support for the OAuth grant type user_fic (user federated identity credential) and continues a broader tightening of platform behavior. It also drops Python 3.8 support and includes several broker-related fixes around redirect URIs, username handling, and metadata forwarding.

    BreakingFeatures

  • 1.36.0

    Release 1.36.0 updates MSAL Python primarily around security hardening and specific authentication flows. Documented changes include fixing PoP flow in the console app, using cryptographically secure randomness for PKCE/state/nonce generation, and tightening OIDC issuer validation to prevent B2C host domain spoofing. It also adds new CI/CD pipeline definitions and documentation, plus FMI-related support for ConfidentialClientApplication token acquisition.

    SecurityFeatures

  • 1.35.1

    Release 1.35.1 is a patch version focused on instance discovery behavior. The code change makes instance discovery requests use the correct cloud host for known sovereign and national clouds, and refactors how authority alias groups are cached and validated.

  • 1.35.0

    Release 1.35.0 updates MSAL Python with improved authorization request security and stronger issuer validation for OIDC authority discovery. It also adds form_post response mode support intended for browser-based authentication, and includes a WSL security hardening related to browser launching.

    BreakingSecurityFeatures

  • 1.35.0b1

    MSAL Python 1.35.0b1 updates managed identity and client certificate handling, including removing the runtime dependency on socket.getfqdn and making the client_credential thumbprint optional when a public_certificate is provided. It also broadens runtime and Python support, including PyMsalRuntime 0.20.* range updates and adding CI coverage for Python 3.14.

    BreakingFeatures

  • 1.34.0

    MSAL Python 1.34.0 is the final release for the 1.34.0 line, carrying forward all beta changes from 1.34.0b1. The release notes highlight dependency and platform support changes, specifically a cryptography upper bound bump that drops Python 3.7, plus official support for Python 3.13.

    BreakingFeatures

  • 1.34.0b1

    MSAL Python 1.34.0b1 introduces support for supplying a claims challenge when initiating the OAuth device flow, and it improves token cache matching by normalizing the environment field to lowercase during searches. The diff also shows related internal plumbing changes for device flow request payload construction and a few test updates/skips.

    Features

  • 1.33.0

    Release 1.33.0 is described as a re-shipping of the 1.33.0b1 beta as a stable release. Based on the provided code diff (b1 -> 1.33.0), the only change in this diff is the package version string update.

    Features

  • 1.33.0b1

    MSAL Python 1.33.0b1 adds broader broker support, including Linux and WSL, and expands Managed Identity token acquisition to support both `client_capabilities` and `claims_challenge` for Service Fabric scenarios. The release also tightens exception handling (notably around `MsalServiceError`) and updates internal token cache usage patterns. In the code diff, several behavior changes and API contract shifts are visible that are not fully spelled out in the release notes, particularly around broker behavior on Linux and `MsalServiceError` construction semantics.

    Features

  • 1.32.3

    Release 1.32.3 claims to fix a regression affecting Azure Arc and on-prem scenarios. The actual code diff is small and centers on how `ThrottledHttpClient` captures and exposes HTTP response headers.