[Yash (notyashhh)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests	Suppressions
️✔️ None	️✔️ 130/130	️✔️ None

Related command
az login, az account get-access-token on Windows and macOS with broker authentication enabled.

Description
Related: Azure/CLIPS#986.

Bump pymsalruntime from 0.20.6 to 0.20.7 on Windows and macOS to consume the upstream runtime fixes and keep the broker dependency aligned across both platforms.

• Windows: update the runtime pin in requirements.py3.windows.txt, used by the Windows installer builds.
• macOS: move msal[broker]==1.39.0 and the explicit pymsalruntime==0.20.7 pin into requirements.py3.Darwin.txt.
• Remove the now-redundant requirements.py3.Darwin.Broker.txt overlay and point the standalone macOS tarball builder at the consolidated Darwin requirements file. Standard Darwin dependency installs now include broker support directly; this is not a Windows-only update.
• Linux requirements and the standalone Linux requirements selection remain unchanged.

The published MSAL 1.39.0 broker dependency range is pymsalruntime>=0.20,<0.21, which includes 0.20.7. No MSAL version bump or authentication-code changes are needed. Latest upstream dev as of the earlier update was merged into this branch without conflicts.

No HISTORY.rst files are modified. The customer-facing history note is generated from the [Core] PR title. Shipping version/ETA and affected agentic-workflow acceptance remain to be confirmed in the tracking issue.

Testing Guide
Completed for head 82114468851067f8ff9cc33c98f6086a65671904:

• All 57 reported GitHub/CI checks passed, including Windows MSI x64/x86, Windows ZIP x64, Windows and Darwin requirements verification, CLI style/linter, and Python 3.12/3.14 unit tests.
• Ran existing standalone packaging tests locally on Linux: python3 -m unittest discover -s scripts/release/standalone/tests -p 'test_*.py' -q — 24 tests passed.
• Verified the builder parses and loads, selects the consolidated Darwin manifest for macOS, and retains the Linux manifest for Linux.
• Verified both Windows and Darwin manifests contain exactly one msal[broker]==1.39.0 requirement and one pymsalruntime==0.20.7 pin; no references to the deleted overlay remain in repository build/config files.
• Checked published PyPI metadata: MSAL 1.39.0 accepts runtime 0.20.7. Runtime wheels exist for CPython 3.12 and 3.14 on Windows x86/x64 and macOS ARM64/x86_64; the checked macOS wheels target macOS 12.0 or later.
• git diff --check origin/dev...HEAD passed.

Remaining native validation:

• Verify installed Windows and macOS artifacts contain pymsalruntime==0.20.7 and pip check succeeds.
• Build, sign/notarize, and smoke-test the standalone macOS tarballs on ARM64 and Intel. These packaging jobs are gated out of ordinary PR runs, so green PR CI alone does not prove signed macOS artifact validation.
• With broker authentication enabled on each platform, smoke-test az login and repeated az account get-access-token --query expiresOn -o tsv calls to exercise token acquisition and reuse without printing tokens.
• Obtain the affected agentic-workflow reproduction/acceptance criteria from the issue reporter and rerun that scenario. Native Windows/macOS authentication was not exercised by the local Linux checks.

---

• The PR title and description follow Submitting Pull Requests.
• I adhere to the Command Guidelines. No command-surface changes.
• I adhere to the Error Handling Guidelines. No error-handling changes.

[Copilot]

🔵 Needs a closer look

Outstanding Windows installer and native broker authentication smoke tests, along with inaccessible acceptance criteria in Azure/CLIPS#986, prevent validation of the intended fix.

No open issues 🎉

What changed in this PR

Updates the Windows broker authentication runtime dependency to consume upstream fixes for Windows agentic workflows.

Changes:

• Bumps pymsalruntime from 0.20.6 to 0.20.7.
• Leaves MSAL, authentication code, and macOS/Linux requirements unchanged.

Windows installer and broker-authentication validation remain pending.

File	Description
src/​azure-cli/​requirements.py3.windows.txt	Pins the Windows broker runtime to pymsalruntime==0.20.7.

_{Review effort: Balanced}

[x-engineering-agent]

Hi Yash (@notyashhh),
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[Yong Zhang (yonzhan)]

Please fix CI issues

[Naga Nandyala (naga-nandyala)]

There is also a macos file you need to update

1. Consolidate these two files into one as we only have Broker flow now
   https://github.com/Azure/azure-cli/blob/dev/src/azure-cli/requirements.py3.Darwin.Broker.txt
   https://github.com/Azure/azure-cli/blob/dev/src/azure-cli/requirements.py3.Darwin.txt

2. change this https://github.com/Azure/azure-cli/blob/dev/scripts/release/standalone/build_binary_tar_gz.py#L79
   from requirements.py3.Darwin.Broker.txt to requirements.py3.Darwin.txt

[Copilot]

🟡 Changes recommended

The changes also upgrade the bundled macOS broker runtime from 0.20.6 to 0.20.7 despite the stated Windows-only scope and validation plan, so the macOS changes must be reverted or explicitly covered by an expanded scope and validation plan.

1 open issue

• Revert unintended macOS broker runtime upgrade · New

_{Review effort: Balanced}

[Naga Nandyala (naga-nandyala)]

i have updated the PR desc to reflect current changes..