{Packaging} Upgrade MSAL to 1.38.0

[Hima Bindu Gadupudi (hima-gadupudi)]

Description

This PR bumps MSAL package version to 1.38 this is to support Azure Arc for services User Assigned Managed Identity.

Testing Guide

ran the upgrade locally C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe -m pip install --upgrade 'msal[broker]==1.38.0' and User Assigned Identity login went through

History Notes

[Component Name 1] BREAKING CHANGE: az command a: Make some customer-facing breaking change.
[Component Name 2] az command b: Add some customer-facing feature.

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[Copilot]

🟡 Changes recommended

Changes are required before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates Azure CLI’s MSAL dependency to 1.38.0 to support Azure Arc user-assigned managed identities.

Changes:

• Updates MSAL pins for all platforms.
• Documents the dependency upgrade.
• Adds security reporting guidance.

File summaries

File	Description
src/azure-cli/requirements.py3.windows.txt	Updates the Windows MSAL pin.
src/azure-cli/requirements.py3.Linux.txt	Updates the Linux MSAL pin.
src/azure-cli/requirements.py3.Darwin.txt	Updates the macOS MSAL pin.
src/azure-cli-core/HISTORY.rst	Documents the dependency upgrade.
SECURITY.md	Adds security reporting guidance.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

Msalversionupdate

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Yeming Liu (isra-fel)]

The version updates LGTM

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Naga Nandyala (naga-nandyala)]

Thanks for raising this PR. MSAL 1.39.0 is now available and includes the macOS Intel/Rosetta broker fallback fix from AzureAD/microsoft-authentication-library-for-python#926.

I opened #34105, which bumps MSAL to 1.39.0 across azure-cli-core and all three platform requirement files. Could maintainers please advise whether #34105 should supersede this PR?

[Yeming Liu (isra-fel)]

Hi Hima Bindu Gadupudi (@hima-gadupudi) we had to bump MSAL to 1.39.0 for another requirement so will not merge this PR. Still thank you for the contribution :)