Artifact Signing Client 1.0.151: unsupported MSAL.NET dependency and Azure CLI authentication

Kira Mamula 0

We are preparing a production signing workflow using Microsoft.ArtifactSigning.Client 1.0.151 with SignTool and Azure Artifact Signing Public Trust.

Our inspection identified bundled MSAL.NET 4.71.1, which is outside Microsoft's currently supported MSAL versions.

We intend to authenticate exclusively through AzureCliCredential, excluding other credential types.

Could the Artifact Signing engineering team confirm:

Whether client 1.0.151 is supported and security-cleared in this configuration.

Whether Azure.Identity initialization can still invoke the unsupported MSAL dependency.

Whether a serviced client or another supported production integration is recommended.

We need a supported configuration before introducing company credentials into our controlled signing environment.

Kira Mamula 0 Reputation points

2026-11-12T05:03:53.6966667+00:00

We have independently verified that Microsoft.ArtifactSigning.Client 1.0.151 bundles MSAL.NET 4.71.1, which is outside Microsoft's published support range. The current official Client Tools installers contain the same version.

I am requesting a response from a Microsoft Artifact Signing engineer or product-team representative, specifically:

Is client 1.0.151 supported and serviced for security vulnerabilities in its bundled dependencies?

Does restricting DefaultAzureCredential to AzureCliCredential prevent the affected MSAL.NET code from being invoked?

Is there a Microsoft-supported, security-maintained client or integration recommended for production signing?

We have an organization-validated Public Trust profile and are preparing a controlled Windows software-signing environment. We need a documented supportability decision before introducing production credentials.

Could this question please be reviewed or escalated to the Artifact Signing product team?

Thank you.

Your answer