chore(deps): bump azure-identity from 1.25.3 to 1.27.0 in the azure-identity group across 1 directory - #1588

Sourced from azure-identity's releases.

azure-identity_1.27.0

1.27.0 (2026-10-26)

Features Added

• Added support for WorkloadIdentityCredential identity binding mode in AKS environments. This feature uses an AKS proxy to handle FIC exchanges on behalf of pods, addressing Entra's limit on federated identity credentials per managed identity. Enable it by constructing WorkloadIdentityCredential directly with enable_azure_proxy=True. Identity binding mode isn't supported through DefaultAzureCredential. (#43287, #44147)

Bugs Fixed

• Fixed AzureDeveloperCliCredential to correctly parse error messages from Azure Developer CLI v1.23.7 and later, which previously caused raw JSON to surface in ClientAuthenticationError instead of the underlying error text. (#46711)
• Fixed persistent token cache isolation on macOS when using custom cache names or CAE-enabled caches. (#49314)
• Fixed a regression in 1.26.0 where asynchronous OnBehalfOfCredential instances could not reuse access or refresh tokens cached by another instance with the same user assertion. Cache entries are now isolated by user assertion, allowing safe reuse across instances, including with TokenCachePersistenceOptions. Existing cache entries without assertion binding require a fresh token exchange. (#49533)

azure-identity_1.26.0

1.26.0 (2026-09-30)

Features Added

• ManagedIdentityCredential now supports user-assigned managed identities on Azure Arc-enabled servers. An identity can be selected by client ID, object ID, or resource ID. Token responses that do not confirm the requested identity are rejected. (#48967)

Bugs Fixed

• Fixed synchronous Service Fabric managed identity authentication with MSAL 1.39.0 and later. Service Fabric now uses the session from an Azure Core RequestsTransport. (#48967)
• Fixed an issue where AuthorizationCodeCredential and the asynchronous OnBehalfOfCredential could return a cached token for another account when multiple credentials shared a token cache. (#49001)

Other Changes

• Added RequestIdPolicy to the default pipeline policies to ensure a unique x-ms-client-request-id header is sent with each request. (#46070)
• CertificateCredential now passes the PEM private key to MSAL as a str rather than bytes, matching MSAL's documented client_credential contract. (#46801)
• Bumped the minimum dependency on msal to >=1.39.0.

• 8e13b5e Fix azure-identity 1.27.0 changelog release date (#49707)
• e6e5e63 [AgentServer] Prepare Core 2.3.0b2 and Invocations 1.3.0b1 releases (#49704)
• c76f466 [AutoPR azure-mgmt-containerservice]-generated-from-SDK Generation - Python-6...
• a7dd9f3 AgentServer invocation-local original-subject attribution (#49679)
• c17b3ab Skip spec-PR SDK breaking-change flags before first GA release (#49702)
• 762d184 [Identity] Prepare 1.27.0 stable release with AKS identity bindings (#49612)
• 2b95412 Add experimental feature flag (#49682)
• fe53432 Sync eng/common directory with azure-sdk-tools for PR 17391 (#49683)
• 0131b83 [AutoPR azure-mgmt-datatransfer]-generated-from-SDK Generation - Python-69719...
• 335c8fa [AutoPR azure-mgmt-redhatopenshifthcp]-generated-from-SDK Generation - Python...
• Additional commits viewable in compare view