Add LAB_APP_TENANT_ID support; wire up RequestMSIDLAB client ID for ADO

- lab_config.py: _get_credential() now reads LAB_APP_TENANT_ID env var
  (with fallback to Microsoft tenant 72f988bf-...) so ADO builds can
  override the tenant if needed. GH builds are unaffected since they
  don't set LAB_APP_TENANT_ID.
- template-pipeline-stages.yml: pass LAB_APP_TENANT_ID to the test step
  alongside LAB_APP_CLIENT_ID and LAB_APP_CLIENT_CERT_PFX_PATH.

LAB_APP_CLIENT_ID for ADO = f62c5ae3-bf3a-4af5-afa8-a68b800396e9 (RequestMSIDLAB)
Verified locally: both msidlabs and id4skeyvault accessible with this ID + LabAuth cert.

Author: RyAuld

.Pipelines/template-pipeline-stages.yml

@@ -189,6 +189,7 @@ stages:
         # The matching certificate is retrieved from Key Vault by the steps above.
         # When unset, all LabBasedTestCase tests skip gracefully.
         LAB_APP_CLIENT_ID: $(LAB_APP_CLIENT_ID)
+        LAB_APP_TENANT_ID: $(LAB_APP_TENANT_ID)
         LAB_APP_CLIENT_CERT_PFX_PATH: $(LAB_APP_CLIENT_CERT_PFX_PATH)
 
     - task: PublishTestResults@2

tests/lab_config.py

@@ -194,7 +194,12 @@ def _get_credential():
     """
     client_id = _clean_env("LAB_APP_CLIENT_ID")
     cert_path = _clean_env("LAB_APP_CLIENT_CERT_PFX_PATH")
-    tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"  # Microsoft tenant
+    # Allow callers to override the tenant via LAB_APP_TENANT_ID.
+    # Defaults to the Microsoft tenant where the MSID Lab app is registered.
+    tenant_id = (
+        _clean_env("LAB_APP_TENANT_ID")
+        or "72f988bf-86f1-41af-91ab-2d7cd011db47"  # Microsoft tenant
+    )
 
     if not client_id:
         raise EnvironmentError(