azrepos: use GCM's own Entra application by mjcheetham · Pull Request #2416 · git-ecosystem/git-credential-manager

mjcheetham · 2026-08-24T13:53:30Z

This PR has been a long time in the making! We are giving Git Credential Manager its own first-party Microsoft Entra client application for Azure Repos!

GCM previously authenticated as the Visual Studio application, whose registration could not safely be extended for all of GCM's broker and Microsoft account requirements.

The dedicated application enables broker authentication on Windows, macOS, and Linux. In particular, this avoids unnecessary browser prompts on platforms where the broker can provide an existing signed-in account.

Changes

Use GCM's dedicated Entra client application for Azure Repos OAuth.
Enable broker support for the new application on macOS and Linux, in addition to the existing Windows support. (Note that broker support is still opt-in at this time!)
Preserve the Visual Studio client as a documented compatibility option through credential.azreposUseLegacyClientId and GCM_AZREPOS_USE_LEGACY_CLIENTID.
If user authentication fails, then print a message informing the user they can switch back to the legacy client if MSAL, and asks them to report the failure.
Replace the unrestricted developer client-ID and authority overrides with the focused legacy-client compatibility setting.

Compatibility

The new GCM application is the default. Users who need the previous behaviour can select the legacy client explicitly. An MSAL failure in the new application triggers an advice message to retry with the old client when obtaining a user Entra token, either directly for OAuth credentials or as part of PAT creation.

Managed identity, workload federation, and service-principal flows are unaffected.

Fixes #47

Copilot

Pull request overview

Moves Azure Repos authentication to GCM’s dedicated Entra application while retaining legacy Visual Studio client compatibility.

Changes:

Enables cross-platform broker support with the new client.
Adds automatic legacy-client fallback and configuration overrides.
Documents the compatibility settings.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`src/Microsoft.AzureRepos/AzureReposHostProvider.cs`	Selects clients and implements fallback.
`src/Microsoft.AzureRepos/AzureDevOpsRestApi.cs`	Removes the authority override.
`src/Microsoft.AzureRepos/AzureDevOpsConstants.cs`	Defines client IDs and settings.
`src/Core/Authentication/Entra/IEntraAuthentication.cs`	Exposes public-client configuration.
`src/Core/Authentication/Entra/EntraAuthentication.PublicClient.cs`	Exposes and consumes the configuration.
`src/Core/Authentication/Entra/EntraAuthentication.cs`	Initializes the exposed configuration.
`src/Core/Authentication/Entra/EntraAuthentication.Caching.cs`	Uses the exposed cache configuration.
`docs/environment.md`	Documents the environment override.
`docs/configuration.md`	Documents the Git configuration override.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

mr-otmarg

One compatibility issue remains: the authentication-factory refactor removes existing public AzureReposHostProvider constructor APIs. The new client selection and targeted failure guidance otherwise look well covered, and all 27 CI checks are green.

its an internal contract

dscho

Very nice!

It probably makes sense to keep this change in mind in particular, once the time to write release notes for the next version comes around.

Azure Repos OAuth currently identifies GCM as the Visual Studio application. That client registration does not provide the redirect URIs required for broker authentication on macOS and Linux. Use GCM's dedicated first-party Entra application by default and enable broker support on all supported platforms. Retain the Visual Studio client ID as an explicit compatibility fallback while replacing the unrestricted developer overrides with a narrow, documented setting. Assisted-by: GPT-5.6 Sol Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

Consumer currently cannot determine which application registration or capabilities back an Entra authentication instance after it has been constructed. Azure Repos needs this information to distinguish its new client application from the legacy fallback. Expose the immutable public client configuration through the authentication interface and use it as the implementation's single source of configuration state. Assisted-by: GPT-5.6 Sol Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

The new GCM Entra application can encounter registration problems that did not affect the legacy Visual Studio application. Automatically retrying every MSAL failure can hide those problems and encourage unintentional reliance on the compatibility client. Refusals, policy challenges and transient failures also do not justify changing application identity. Keep the original failure visible and leave recovery to an explicit user choice. Offer legacy-client guidance only for recognized application-configuration service errors from the new client, without treating authentication challenges or temporary failures as registration defects. This applies to user OAuth and PAT creation. Managed identity, workload federation and service-principal authentication do not use the public client ID and are unaffected. Assisted-by: GPT-5.6 Sol Assisted-by: GPT-6 Astra Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

Compatibility guidance is useful only when switching the public client can plausibly resolve the failure. Matching an MSAL error string alone is insufficient: policy, interaction and throttling exceptions can carry codes that resemble application-registration problems. Protect the warning boundary in both OAuth and PAT flows, including empty or whitespace-only claims and clients already using the legacy identity. Require the original exception to propagate and only one authentication attempt, so these cases cannot silently regain the old automatic fallback. Assisted-by: GPT-5.6 Sol Assisted-by: GPT-6 Astra Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

…nager to v3 (#981) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github:git-ecosystem/git-credential-manager](https://redirect.github.com/git-ecosystem/git-credential-manager) | tools | major | `v2.9.1` → `v3.0.1` | --- ### Release Notes <details> <summary>git-ecosystem/git-credential-manager (github:git-ecosystem/git-credential-manager)</summary> ### [`v3.0.1`](https://redirect.github.com/git-ecosystem/git-credential-manager/releases/tag/v3.0.1): GCM 3.0.1 [Compare Source](https://redirect.github.com/git-ecosystem/git-credential-manager/compare/v3.0.0...v3.0.1) Git Credential Manager 3.0 brings native ahead-of-time compilation, Microsoft authentication broker support across Windows, macOS, and Linux, and a refreshed terminal experience. ### Changes since 3.0.0 - **(Bug fix)** Prompt for default OS account on Microsoft DevBox ([#2459](https://redirect.github.com/git-ecosystem/git-credential-manager/issues/2459)) - **(Bug fix)** Restore Entra broker parent window handling ([#2464](https://redirect.github.com/git-ecosystem/git-credential-manager/issues/2464)) - **(Feature)** Support `authtype` Git capability ([#2457](https://redirect.github.com/git-ecosystem/git-credential-manager/issues/2457)) - **(Feature)** Add console parent window parenting for non-Entra UI ([#2465](https://redirect.github.com/git-ecosystem/git-credential-manager/issues/2465)) - Drop Windows x86 release binaries ([#2456](https://redirect.github.com/git-ecosystem/git-credential-manager/issues/2456)) **Changelog:** [v3.0.0...v3.0.1][point1-changelog] ### Changes since 2.9.1 > \[!IMPORTANT] > This release changes supported operating systems and the default Azure Repos authentication experience. Review the breaking changes before upgrading. #### Breaking changes and upgrade notes ##### Updated platform and .NET requirements GCM now targets **.NET 10 on all platforms**. Windows builds no longer use .NET Framework. | Platform or installation method | Requirement | | ------------------------------- | --------------------------------------------------------- | | Windows | Windows 10 or later; Windows Server 2016 or later | | macOS | macOS 14 or later | | Linux | A distribution supported by .NET 10 | | .NET tool | Install the .NET 10 SDK before installing or updating GCM | See the [supported environments][supported-environments] and [.NET 10 support matrix][dotnet-support] for details. Standalone platform packages do **not** require a separate .NET installation. **Windows 7 and Windows 8.x are no longer supported by GCM 3.x.** GCM 2.9.x will receive minimal, security-only maintenance for those systems, but no new features. Upgrading Windows is recommended. ([git-ecosystem/git-credential-manager#2365][pr-2365], [git-ecosystem/git-credential-manager#2367][pr-2367]) ##### Azure Repos uses OAuth tokens by default GCM now returns Microsoft identity **OAuth tokens**, rather than creating personal access tokens (PATs), by default for Azure Repos. OAuth tokens are automatically refreshed as needed. Explicit credential-type settings are still respected. If you need the previous PAT behavior, set: ```shell git config --global credential.azreposCredentialType pat ``` The equivalent environment variable is `GCM_AZREPOS_CREDENTIALTYPE=pat`. See [Azure Repos users and tokens][azrepos-tokens]. ([git-ecosystem/git-credential-manager#2449][pr-2449]) ##### Microsoft authentication uses the OS broker by default Broker integration is now enabled by default wherever supported, rather than requiring an opt-in. This applies to Microsoft authentication, such as Azure Repos; it does not change authentication for GitHub, Bitbucket, or GitLab. On macOS, broker authentication requires Company Portal and device enrollment. On Linux, it requires the supported Intune setup, a GNOME desktop, and Microsoft Edge; headless and WSL environments do not support the Linux broker. > \[!WARNING] > Depending on your organization's policies, broker sign-in can prompt you to join or enroll your device. On Windows, signing in with a personal Microsoft account can also affect the account linked to your local Windows user. Review the [broker documentation][broker] before proceeding, especially on personal devices. To opt out: ```shell git config --global credential.msauthUseBroker false ``` The equivalent environment variable is `GCM_MSAUTH_USEBROKER=false`. When the broker is in use, it takes precedence over `credential.msauthFlow`. ([git-ecosystem/git-credential-manager#2449][pr-2449]) ##### Azure Repos uses a dedicated GCM Entra application GCM now signs in using its own first-party Microsoft Entra application instead of the Visual Studio application. This enables broker support on macOS and Linux, in addition to Windows. If you encounter a client-application configuration error, GCM provides guidance for retrying with the legacy application; it does **not** silently switch back. For a one-command compatibility retry: ```shell git -c credential.azreposUseLegacyClientId=true fetch ``` Please report the original failure if this workaround succeeds. The legacy application does not support broker authentication on macOS or Linux. Managed identity, service-principal, and workload-identity federation flows are unaffected by the application change. The undocumented developer overrides `credential.azreposDevClientId` and `credential.azreposDevAuthorityBaseUri`, and their environment-variable equivalents `GCM_DEV_AZREPOS_CLIENTID` and `GCM_DEV_AZREPOS_AUTHORITYBASEURI`, have been removed. The [legacy-client setting][legacy-client] is a focused compatibility option, not an arbitrary client-ID or authority override. ([git-ecosystem/git-credential-manager#2416][pr-2416]) ##### The embedded Microsoft sign-in web view has been removed The Windows-only embedded web view depended on .NET Framework and is no longer available. Use the broker, system browser, or device-code flow instead. If you previously forced `credential.msauthFlow=embedded` or `GCM_MSAUTH_FLOW=embedded`, change it to `auto`, `system`, or `devicecode`. Disable broker integration as described above if you specifically need to force a non-broker flow. ([git-ecosystem/git-credential-manager#2365][pr-2365]) ##### Terminal and diagnostic output has changed Terminal selection prompts now use arrow-key navigation instead of numbered input, and `diagnose` has a new output format. Automation that drives interactive menus or parses diagnostic text may need updating. Git's credential-protocol input and output remain separate from interactive prompts. ([git-ecosystem/git-credential-manager#2377][pr-2377], [git-ecosystem/git-credential-manager#2425][pr-2425]) #### Features and improvements - **Native ahead-of-time builds.** Published platform packages compile GCM to native code to reduce startup overhead. The .NET tool remains a framework-dependent distribution. ([git-ecosystem/git-credential-manager#2366][pr-2366], [git-ecosystem/git-credential-manager#2367][pr-2367]) - **Cross-platform Microsoft single sign-on.** The authentication broker can reuse OS accounts on supported Windows, macOS, and Linux installations. When a default OS account can be used, GCM asks for confirmation unless automatic use is explicitly enabled, or enabled by default in environments such as Microsoft Dev Box. Set `credential.msauthUseDefaultAccount=false` to skip the default-account attempt. See the [broker documentation][broker]. ([git-ecosystem/git-credential-manager#2379][pr-2379], [git-ecosystem/git-credential-manager#2416][pr-2416]) - **Optional isolated Azure Repos token cache.** Set `credential.azreposUseMicrosoftSharedCache=false`, or `GCM_AZREPOS_USE_MSFT_CACHE=false`, to use a GCM-specific cache. Sharing with other Microsoft developer tools remains the default. ([git-ecosystem/git-credential-manager#2415][pr-2415]) - **Support for Bitbucket Cloud's updated OAuth tokens.** Rotating refresh tokens are now consistently saved against the resolved Bitbucket username, avoiding repeated sign-ins caused by reusing an old refresh token. Large access and refresh tokens are split across credential entries when needed, so Windows users can keep the default `wincredman` store without switching to another credential store. ([git-ecosystem/git-credential-manager#2433][pr-2433], [git-ecosystem/git-credential-manager#2440][pr-2440]) - **Generic OAuth beyond HTTP(S).** Generic OAuth configuration now works for non-HTTP credential requests, such as SMTP authentication for `git send-email`. Windows Integrated Authentication remains HTTP(S)-only. ([git-ecosystem/git-credential-manager#2445][pr-2445]) - **Refreshed terminal prompts and diagnostics.** Interactive prompts use Spectre.Console, and Ctrl+C during a prompt restores the terminal and exits cleanly with status 130. `git-credential-manager diagnose` distinguishes passed, warning, failed, and skipped checks, reports the actual credential store, and summarizes generated logs. Add `--strict` to return a non-zero exit code for warnings as well as errors; without it, only errors fail. ([git-ecosystem/git-credential-manager#2377][pr-2377], [git-ecosystem/git-credential-manager#2423][pr-2423], [git-ecosystem/git-credential-manager#2425][pr-2425]) - **More complete Trace2 diagnostics.** Expanded instrumentation covers command execution, configuration, credential storage, UI startup, and authentication. Entra tracing now records broker, cache, and interaction-mode decisions alongside timings, using the existing Git Trace2 settings. ([git-ecosystem/git-credential-manager#2408][pr-2408], [git-ecosystem/git-credential-manager#2450][pr-2450]) - **Newer Git credential-protocol support.** GCM supports capability negotiation and the `state[]` and `continue` fields introduced in Git 2.46, providing infrastructure for multi-stage authentication. Existing authentication flows and compatibility with older Git versions are preserved. ([git-ecosystem/git-credential-manager#2357][pr-2357]) #### Fixes - Improve dispatcher failure and shutdown handling without starting the UI framework for operations that do not need it. ([git-ecosystem/git-credential-manager#2451][pr-2451]) - Respect Git configuration `include` and `includeIf` files in scoped queries, avoiding duplicate configuration entries when settings already exist in an included file. ([git-ecosystem/git-credential-manager#2345][pr-2345]) #### Installation and contributor changes - The install-from-source helper now supports both macOS and Linux at `build/install-from-source.sh`. It defaults to a trimmed, self-contained build; use `--aot` to opt into native compilation and its additional toolchain requirements. See the [installation instructions][install-from-source]. - Source builds now use `git-credential-manager.slnx`, with libraries and tests directly under `src/` and packaging scripts under `build/`. A solution build no longer runs packaging; use the per-platform distribution projects for that. See the [development guide][development]. ([git-ecosystem/git-credential-manager#2367][pr-2367]) - Windows x64 and ARM64 packages use the 64-bit Inno Setup installer; x86 packages retain a 32-bit installer. ([git-ecosystem/git-credential-manager#2380][pr-2380]) - Internal credential-helper actions (`get`, `store`, `erase`, and `capability`) are hidden from `--help`, but remain available for Git to invoke. ([git-ecosystem/git-credential-manager#2357][pr-2357]) **Changelog:** [v2.9.1...v3.0.0][full-changelog] [point1-changelog]: https://redirect.github.com/git-ecosystem/git-credential-manager/compare/v3.0.0...v3.0.1 [azrepos-tokens]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.1/docs/azrepos-users-and-tokens.md [broker]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.1/docs/msauth-broker.md [development]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.1/docs/development.md [dotnet-support]: https://redirect.github.com/dotnet/core/blob/main/release-notes/10.0/supported-os.md [full-changelog]: https://redirect.github.com/git-ecosystem/git-credential-manager/compare/v2.9.1...v3.0.0 [install-from-source]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.1/docs/install.md#install-from-source-helper-script [legacy-client]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.1/docs/configuration.md#credentialazreposuselegacyclientid [supported-environments]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.1/README.md#supported-environments [pr-2345]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2345 [pr-2357]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2357 [pr-2365]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2365 [pr-2366]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2366 [pr-2367]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2367 [pr-2377]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2377 [pr-2379]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2379 [pr-2380]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2380 [pr-2408]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2408 [pr-2415]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2415 [pr-2416]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2416 [pr-2423]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2423 [pr-2425]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2425 [pr-2433]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2433 [pr-2440]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2440 [pr-2445]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2445 [pr-2449]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2449 [pr-2450]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2450 [pr-2451]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2451 ### [`v3.0.0`](https://redirect.github.com/git-ecosystem/git-credential-manager/releases/tag/v3.0.0): GCM 3.0.0 [Compare Source](https://redirect.github.com/git-ecosystem/git-credential-manager/compare/v2.9.1...v3.0.0) Git Credential Manager 3.0 brings native ahead-of-time compilation, Microsoft authentication broker support across Windows, macOS, and Linux, and a refreshed terminal experience. These notes cover changes since **GCM 2.9.1**. > \[!IMPORTANT] > This release changes supported operating systems and the default Azure Repos authentication experience. Review the breaking changes before upgrading. #### Breaking changes and upgrade notes ##### Updated platform and .NET requirements GCM now targets **.NET 10 on all platforms**. Windows builds no longer use .NET Framework. | Platform or installation method | Requirement | | ------------------------------- | --------------------------------------------------------- | | Windows | Windows 10 or later; Windows Server 2016 or later | | macOS | macOS 14 or later | | Linux | A distribution supported by .NET 10 | | .NET tool | Install the .NET 10 SDK before installing or updating GCM | See the [supported environments][supported-environments] and [.NET 10 support matrix][dotnet-support] for details. Standalone platform packages do **not** require a separate .NET installation. **Windows 7 and Windows 8.x are no longer supported by GCM 3.x.** GCM 2.9.x will receive minimal, security-only maintenance for those systems, but no new features. Upgrading Windows is recommended. ([git-ecosystem/git-credential-manager#2365][pr-2365], [git-ecosystem/git-credential-manager#2367][pr-2367]) ##### Azure Repos uses OAuth tokens by default GCM now returns Microsoft identity **OAuth tokens**, rather than creating personal access tokens (PATs), by default for Azure Repos. OAuth tokens are automatically refreshed as needed. Explicit credential-type settings are still respected. If you need the previous PAT behavior, set: ```shell git config --global credential.azreposCredentialType pat ``` The equivalent environment variable is `GCM_AZREPOS_CREDENTIALTYPE=pat`. See [Azure Repos users and tokens][azrepos-tokens]. ([git-ecosystem/git-credential-manager#2449][pr-2449]) ##### Microsoft authentication uses the OS broker by default Broker integration is now enabled by default wherever supported, rather than requiring an opt-in. This applies to Microsoft authentication, such as Azure Repos; it does not change authentication for GitHub, Bitbucket, or GitLab. On macOS, broker authentication requires Company Portal and device enrollment. On Linux, it requires the supported Intune setup, a GNOME desktop, and Microsoft Edge; headless and WSL environments do not support the Linux broker. > \[!WARNING] > Depending on your organization's policies, broker sign-in can prompt you to join or enroll your device. On Windows, signing in with a personal Microsoft account can also affect the account linked to your local Windows user. Review the [broker documentation][broker] before proceeding, especially on personal devices. To opt out: ```shell git config --global credential.msauthUseBroker false ``` The equivalent environment variable is `GCM_MSAUTH_USEBROKER=false`. When the broker is in use, it takes precedence over `credential.msauthFlow`. ([git-ecosystem/git-credential-manager#2449][pr-2449]) ##### Azure Repos uses a dedicated GCM Entra application GCM now signs in using its own first-party Microsoft Entra application instead of the Visual Studio application. This enables broker support on macOS and Linux, in addition to Windows. If you encounter a client-application configuration error, GCM provides guidance for retrying with the legacy application; it does **not** silently switch back. For a one-command compatibility retry: ```shell git -c credential.azreposUseLegacyClientId=true fetch ``` Please report the original failure if this workaround succeeds. The legacy application does not support broker authentication on macOS or Linux. Managed identity, service-principal, and workload-identity federation flows are unaffected by the application change. The undocumented developer overrides `credential.azreposDevClientId` and `credential.azreposDevAuthorityBaseUri`, and their environment-variable equivalents `GCM_DEV_AZREPOS_CLIENTID` and `GCM_DEV_AZREPOS_AUTHORITYBASEURI`, have been removed. The [legacy-client setting][legacy-client] is a focused compatibility option, not an arbitrary client-ID or authority override. ([git-ecosystem/git-credential-manager#2416][pr-2416]) ##### The embedded Microsoft sign-in web view has been removed The Windows-only embedded web view depended on .NET Framework and is no longer available. Use the broker, system browser, or device-code flow instead. If you previously forced `credential.msauthFlow=embedded` or `GCM_MSAUTH_FLOW=embedded`, change it to `auto`, `system`, or `devicecode`. Disable broker integration as described above if you specifically need to force a non-broker flow. ([git-ecosystem/git-credential-manager#2365][pr-2365]) ##### Terminal and diagnostic output has changed Terminal selection prompts now use arrow-key navigation instead of numbered input, and `diagnose` has a new output format. Automation that drives interactive menus or parses diagnostic text may need updating. Git's credential-protocol input and output remain separate from interactive prompts. ([git-ecosystem/git-credential-manager#2377][pr-2377], [git-ecosystem/git-credential-manager#2425][pr-2425]) #### Features and improvements - **Native ahead-of-time builds.** Published platform packages compile GCM to native code to reduce startup overhead. The .NET tool remains a framework-dependent distribution. ([git-ecosystem/git-credential-manager#2366][pr-2366], [git-ecosystem/git-credential-manager#2367][pr-2367]) - **Cross-platform Microsoft single sign-on.** The authentication broker can reuse OS accounts on supported Windows, macOS, and Linux installations. When a default OS account can be used, GCM asks for confirmation unless automatic use is explicitly enabled, or enabled by default in environments such as Microsoft Dev Box. Set `credential.msauthUseDefaultAccount=false` to skip the default-account attempt. See the [broker documentation][broker]. ([git-ecosystem/git-credential-manager#2379][pr-2379], [git-ecosystem/git-credential-manager#2416][pr-2416]) - **Optional isolated Azure Repos token cache.** Set `credential.azreposUseMicrosoftSharedCache=false`, or `GCM_AZREPOS_USE_MSFT_CACHE=false`, to use a GCM-specific cache. Sharing with other Microsoft developer tools remains the default. ([git-ecosystem/git-credential-manager#2415][pr-2415]) - **Support for Bitbucket Cloud's updated OAuth tokens.** Rotating refresh tokens are now consistently saved against the resolved Bitbucket username, avoiding repeated sign-ins caused by reusing an old refresh token. Large access and refresh tokens are split across credential entries when needed, so Windows users can keep the default `wincredman` store without switching to another credential store. ([git-ecosystem/git-credential-manager#2433][pr-2433], [git-ecosystem/git-credential-manager#2440][pr-2440]) - **Generic OAuth beyond HTTP(S).** Generic OAuth configuration now works for non-HTTP credential requests, such as SMTP authentication for `git send-email`. Windows Integrated Authentication remains HTTP(S)-only. ([git-ecosystem/git-credential-manager#2445][pr-2445]) - **Refreshed terminal prompts and diagnostics.** Interactive prompts use Spectre.Console, and Ctrl+C during a prompt restores the terminal and exits cleanly with status 130. `git-credential-manager diagnose` distinguishes passed, warning, failed, and skipped checks, reports the actual credential store, and summarizes generated logs. Add `--strict` to return a non-zero exit code for warnings as well as errors; without it, only errors fail. ([git-ecosystem/git-credential-manager#2377][pr-2377], [git-ecosystem/git-credential-manager#2423][pr-2423], [git-ecosystem/git-credential-manager#2425][pr-2425]) - **More complete Trace2 diagnostics.** Expanded instrumentation covers command execution, configuration, credential storage, UI startup, and authentication. Entra tracing now records broker, cache, and interaction-mode decisions alongside timings, using the existing Git Trace2 settings. ([git-ecosystem/git-credential-manager#2408][pr-2408], [git-ecosystem/git-credential-manager#2450][pr-2450]) - **Newer Git credential-protocol support.** GCM supports capability negotiation and the `state[]` and `continue` fields introduced in Git 2.46, providing infrastructure for multi-stage authentication. Existing authentication flows and compatibility with older Git versions are preserved. ([git-ecosystem/git-credential-manager#2357][pr-2357]) #### Fixes - Improve dispatcher failure and shutdown handling without starting the UI framework for operations that do not need it. ([git-ecosystem/git-credential-manager#2451][pr-2451]) - Respect Git configuration `include` and `includeIf` files in scoped queries, avoiding duplicate configuration entries when settings already exist in an included file. ([git-ecosystem/git-credential-manager#2345][pr-2345]) #### Installation and contributor changes - The install-from-source helper now supports both macOS and Linux at `build/install-from-source.sh`. It defaults to a trimmed, self-contained build; use `--aot` to opt into native compilation and its additional toolchain requirements. See the [installation instructions][install-from-source]. - Source builds now use `git-credential-manager.slnx`, with libraries and tests directly under `src/` and packaging scripts under `build/`. A solution build no longer runs packaging; use the per-platform distribution projects for that. See the [development guide][development]. ([git-ecosystem/git-credential-manager#2367][pr-2367]) - Windows x64 and ARM64 packages use the 64-bit Inno Setup installer; x86 packages retain a 32-bit installer. ([git-ecosystem/git-credential-manager#2380][pr-2380]) - Internal credential-helper actions (`get`, `store`, `erase`, and `capability`) are hidden from `--help`, but remain available for Git to invoke. ([git-ecosystem/git-credential-manager#2357][pr-2357]) **Full changelog:** [v2.9.1...v3.0.0][full-changelog] [azrepos-tokens]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.0/docs/azrepos-users-and-tokens.md [broker]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.0/docs/msauth-broker.md [development]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.0/docs/development.md [dotnet-support]: https://redirect.github.com/dotnet/core/blob/main/release-notes/10.0/supported-os.md [full-changelog]: https://redirect.github.com/git-ecosystem/git-credential-manager/compare/v2.9.1...v3.0.0 [install-from-source]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.0/docs/install.md#install-from-source-helper-script [legacy-client]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.0/docs/configuration.md#credentialazreposuselegacyclientid [supported-environments]: https://redirect.github.com/git-ecosystem/git-credential-manager/blob/v3.0.0/README.md#supported-environments [pr-2345]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2345 [pr-2357]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2357 [pr-2365]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2365 [pr-2366]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2366 [pr-2367]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2367 [pr-2377]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2377 [pr-2379]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2379 [pr-2380]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2380 [pr-2408]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2408 [pr-2415]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2415 [pr-2416]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2416 [pr-2423]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2423 [pr-2425]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2425 [pr-2433]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2433 [pr-2440]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2440 [pr-2445]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2445 [pr-2449]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2449 [pr-2450]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2450 [pr-2451]: https://redirect.github.com/git-ecosystem/git-credential-manager/pull/2451 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/tak848/dotfiles).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: tak-automation[bot] <221638520+tak-automation[bot]@users.noreply.github.com>

mjcheetham added the enhancement New feature or request label Aug 24, 2026

mjcheetham requested a review from a team as a code owner August 24, 2026 13:53

mjcheetham added host:azure-repos Specific to the Azure Repos (Azure DevOps, VSTS) host provider auth:entra Specific to Microsoft Entra Authentication entra:broker Related to the authentication broker for Entra Authentication labels Aug 24, 2026

mjcheetham requested review from a team and mpysson August 24, 2026 13:53

mjcheetham mentioned this pull request Aug 24, 2026

Create new client ID for GCM when speaking to Azure Repos #47

Closed

mjcheetham requested a balanced review from Copilot August 25, 2026 12:42

Copilot started reviewing on behalf of mjcheetham August 25, 2026 12:42

View session

Copilot AI reviewed Aug 25, 2026

View reviewed changes

Comment thread src/Microsoft.AzureRepos/AzureReposHostProvider.cs Resolved

Comment thread src/Microsoft.AzureRepos/AzureReposHostProvider.cs Resolved

mjcheetham force-pushed the new-entra-app branch 2 times, most recently from 7e4be3c to baaa2ad Compare August 26, 2026 16:48

mr-otmarg reviewed Aug 27, 2026

View reviewed changes

Comment thread src/Microsoft.AzureRepos/AzureReposHostProvider.cs Resolved

mjcheetham force-pushed the new-entra-app branch from baaa2ad to af2a1cd Compare September 14, 2026 13:34

mjcheetham requested a review from dscho September 14, 2026 13:48

mr-otmarg previously requested changes Sep 14, 2026

View reviewed changes

Comment thread src/Microsoft.AzureRepos/AzureReposHostProvider.cs Resolved

mr-otmarg approved these changes Sep 14, 2026

View reviewed changes

dscho approved these changes Sep 15, 2026

View reviewed changes

mjcheetham added 4 commits September 16, 2026 09:24

mjcheetham force-pushed the new-entra-app branch from af2a1cd to add0a20 Compare September 16, 2026 08:26

mjcheetham enabled auto-merge September 16, 2026 08:26

mjcheetham merged commit 4040e0b into git-ecosystem:main Sep 16, 2026
27 checks passed

mjcheetham deleted the new-entra-app branch September 16, 2026 10:56

Navigation Menu

Repository navigation

azrepos: use GCM's own Entra application - #2416

azrepos: use GCM's own Entra application#2416
mjcheetham merged 4 commits into
git-ecosystem:mainfrom
mjcheetham:new-entra-app

mjcheetham commented Aug 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mr-otmarg left a comment

Uh oh!

Uh oh!

dscho left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

mjcheetham commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Compatibility

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mr-otmarg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dscho left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mjcheetham commented Aug 24, 2026 •

edited

Loading