Microsoft.Identity.Client.ManagedIdentityPopExtensions
Extension methods for enabling mTLS Proof-of-Possession in managed identity flows.
public static AcquireTokenForManagedIdentityParameterBuilder WithMtlsProofOfPossession(this AcquireTokenForManagedIdentityParameterBuilder builder)
Enables mTLS Proof-of-Possession for managed identity token acquisition.
When attestation is required (KeyGuard scenarios), use the Msal.KeyAttestation package
and call .WithAttestationSupport() after this method.
public static AcquireTokenForManagedIdentityParameterBuilder WithMtlsProofOfPossession(this AcquireTokenForManagedIdentityParameterBuilder builder, PoPOptions options)
Enables mTLS Proof-of-Possession for managed identity token acquisition with additional
PoP options, such as a minimum required binding strength.
When attestation is required (KeyGuard scenarios), use the Msal.KeyAttestation package
and call .WithAttestationSupport() after this method.
public static AcquireTokenForManagedIdentityParameterBuilder WithRequestOverMtls(this AcquireTokenForManagedIdentityParameterBuilder builder)
Uses the IMDSv2 attested flow (Credential Guard–issued certificate over mTLS) to acquire
a standard bearer token. The mTLS certificate authenticates the connection to the ESTS
token endpoint, but the returned token carries token_type=bearer and has no
binding certificate in the AuthenticationResult.
Requires Windows Credential Guard (VBS) to be enabled on the host.
When attestation is required, call .WithAttestationSupport() (from the
Microsoft.Identity.Client.KeyAttestation package) after this method.