[Feature Request] Remove Non‑Regional Checks from MSAL for mTLS / PoP

[gladjohn]

MSAL client type

Managed identity, Confidential

Problem statement

MSAL currently performs non‑regional in SNI mTLS / Proof‑of‑Possession scenarios. These checks are not required for MSI token acquisition as mTLS is now supported in Global as well.

Proposed solution

Remove non‑regional authority / environment checks from MSAL SNI mTLS flow

Alternatives

No response

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• [Feature Request] Update the logic to handle mtls flow #5608

Powered by issue-sentinel

[gladjohn]

Here is a test that enforces this check today, https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/tests/Microsoft.Identity.Test.Unit/PublicApiTests/MtlsPopTests.cs#L134. Ideally, we want this check removed and the calls to global for SNI mTLS should acquire a token.

[gladjohn]

1. PR #5853 changes - Validation for tenanted authorities with mTLS PoP

2. Issue #5865 implementation - Remove regional-only restrictions for global endpoint support

3. Needs new E2E tests - New global endpoint test in ClientCredentialsMtlsPopTests.cs

Current Situation

• PR Unignore mTLS PoP test for non-tenanted authority #5853's purpose (enforce tenancy validation for mTLS PoP)
• Issue [Feature Request] Remove Non‑Regional Checks from MSAL for mTLS / PoP #5865's requirement (support global/non-regional endpoints)
• Current codebase structure (RegionAndMtlsDiscoveryProvider, MtlsPopParametersInitializer, tests)
• E2E test file structure (ClientCredentialsMtlsPopTests.cs) with examples
• Current product code behavior and restrictions
• Test patterns and naming conventions

End result - consolidate both the tenancy validation (from #5853) and global endpoint support (#5865) into one comprehensive pull request with:

• Product code changes - Remove regional-only restrictions, add tenancy validation
• Unit tests - Update MtlsPopTests.cs with global endpoint scenarios
• E2E tests - Add new global endpoint test to ClientCredentialsMtlsPopTests.cs
• Documentation - Update design documentation