Regional

Regional auth

This is an option for Microsoft 1p apps only, needing to use certificate based auth.

3p apps can benefit from regional authentication by using Managed Identity.

Enable regional auth via env variable

If MSAL_FORCE_REGION is set to e.g. "westus1", MSAL will use that region. Unless MSAL was already configured programmatically, i.e. WithAzureRegion API takes precedence.

Important

Azure SDK enables regional auth through its own env variable - AZURE_REGIONAL_AUTHORITY_NAME. Internally, Azure SDK uses MSAL with the API WithAzureRegion, so this takes precedence over MSAL_FORCE_REGION

Disable MSAL_FORCE_REGION env variable

If you use WithAzureRegion("DisableMsalForceRegion") programatically, then MSAL will ignore MSAL_FORCE_REGION

Disable ESTS-R via env variable

If MSAL_DISABLE_REGION is set to any value, then MSAL will ignore ESTS-R and hit the global ESTS. This disables the API WithAzureRegion

References:

• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4930
• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/5223