Fix Azure Arc errors returned before authentication challenge

[Gladwin Johnson VR (gladjohn)]

Summary

Azure Arc can reject an identity selector on the initial request with an HTTP error response before returning the Basic authentication challenge. MSAL currently discards that response body and raises ManagedIdentityError: Unrecognizable WWW-Authenticate header, hiding the actionable error returned by Arc.

This change:

• returns the Arc response body through the standard MSAL token-error dictionary (error and error_description) when the initial response is not the expected HTTP 401 challenge
• preserves fail-closed behavior for explicit identity selectors; MSAL does not retry without the selector or return a token for another identity
• adds regression coverage for a client_id rejected on the initial request

Regression context

This path became reachable after #944 began forwarding Azure Arc user-assigned identity selectors. Before #944, Arc selectors were ignored, so supplying a system-assigned identity's client ID appeared to work because Arc returned the system-assigned token. After #944, any supplied client_id is correctly treated as a user-assigned identity selector, and Arc can reject a system-assigned client ID before issuing the Basic challenge.

The correct system-assigned usage is to omit the selector. This PR does not restore the old silent fallback; it only preserves and surfaces Arc's actual error response.

Before

ManagedIdentityError: Unrecognizable WWW-Authenticate header: {...}

After

{
    "error": "invalid_request",
    "error_description": "<Azure Arc response body>",
}

Tests

• python -m pytest tests/test_mi.py -q
• python -m pytest -q — 409 passed, 104 skipped

[Copilot]

🟢 Approval recommended

The reviewed changes are covered by regression tests and have no identified blocking issues.

Pull request overview

Fixes Azure Arc pre-challenge errors by surfacing actionable response bodies instead of masking them as authentication-header errors.

Changes:

• Normalize non-401 Arc responses into managed identity errors.
• Preserve fail-closed identity selection.
• Add regression coverage for rejected selectors and caching.

File summaries

File	Description
tests/test_mi.py	Adds regression tests for pre-challenge errors and cache behavior.
msal/managed_identity.py	Handles and surfaces Arc errors before authentication challenges.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.