Skip to content

Bump Microsoft.Identity.Web.UI from 4.14.2 to 4.15.0 - #442

Merged
mergify[bot] merged 1 commit into
mainfrom
dependabot/nuget/GraphOrgExample/Microsoft.Identity.Web.UI-4.15.0
Sep 22, 2026
Merged

mergify[bot] merged 1 commit into
mainfrom
dependabot/nuget/GraphOrgExample/Microsoft.Identity.Web.UI-4.15.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026 •

Copy link
Copy Markdown
Contributor

Updated Microsoft.Identity.Web.UI from 4.14.2 to 4.15.0.

Release notes

Sourced from Microsoft.Identity.Web.UI's releases.

4.15.0

Federated credentials and proof of possession

  • Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
  • The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
  • Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

  • EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
  • Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

  • OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
  • Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
  • Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

  • Invalid selected AgentUserId values return HTTP 400. #​4011
  • Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
  • Non-local Host headers are rejected outside Development except on /healthz. #​4023
  • Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

  • Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
  • Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.

@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Sep 22, 2026

@mergify mergify Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approving dependabot

@mergify

mergify Bot commented Sep 22, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

---
updated-dependencies:
- dependency-name: Microsoft.Identity.Web.UI
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/nuget/GraphOrgExample/Microsoft.Identity.Web.UI-4.15.0 branch from 2b4405a to 8cc8625 Compare September 22, 2026 01:08
@mergify
mergify Bot merged commit 73175c8 into main Sep 22, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/nuget/GraphOrgExample/Microsoft.Identity.Web.UI-4.15.0 branch September 22, 2026 01:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants