[Azure Identity] `tenant_id` is not honored by `ManagedIdentityCredential.get_token`

[jiasli]

• Package Name: azure-identity
• Package Version: 1.7.1

Describe the bug

#20940 added support for getting an access token from another tenant other than the tenant used in the constructor of the credential, using get_token(tenant_id=xxx) API.

However, as tested with this script in a VM with system assigned identity:

from azure.identity import ManagedIdentityCredential

cred = ManagedIdentityCredential()
print(cred.get_token('https://management.azure.com//.default', tenant_id='72f988bf-86f1-41af-91ab-2d7cd011db47'))

The access token decoded using https://jwt.ms/ still has

  "iss": "https://sts.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/",

Using this access token will fail to authenticate into resources.

The truth is managed identity doesn't support tenant_id and you simply can't get an access token for another tenant. See https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http

Azure Identity should error out in such case, instead of returning the a token for the wrong tenant.

[lmazuel]

Hi Jiashuo Li (@jiasli)

tenant_id should be seem as a hint of how to increase the odds of getting a valid token. If the scenario doesn't support that hint, the expectation is to ignore it. Otherwise, it means you could never used ever again KeyVault and ManagedIdentity, since KeyVault will always inject the tenant_id.

So by design, if the hint is not applicable, we ignore it.

But thank you for the issue, investigating it we discovered a problem:
#23138