[Feature Request] Support CAE

[jiasli]

Context

As explained in #19853 (comment), Azure Identity SDK was dropped during MSAL migration. With that, the experimental CAE (Continuous Access Evaluation) support was dropped.

We need to support CAE in the new MSAL-based Azure CLI.

Problems

MSAL

MSAL.PY returns revoked access tokens even after re-login and updating the refresh token (AzureAD/microsoft-authentication-library-for-python#335). This imposes some complexity in supporting CAE.

Track 1 SDKs

Python SDK Track 2 has now supported challenge through azure.mgmt.core.policies._authentication.ARMChallengeAuthenticationPolicy, but there are still many Azure CLI modules or extensions based on Track 1 SDKs and there is and will be no CAE support for Track 1 SDKs (#20460).

Microsoft Graph

According to my observation, Microsoft Graph has already enforced CAE. However, there is no Python SDK for Microsoft Graph and we use our own light-weight client to call Microsoft Graph API (#12946). We need to make that light-weight client support CAE as well.

Reference

• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation

[yonzhan]

CAE

[jiasli]

According to AAD document:

https://docs.microsoft.com/en-us/azure/active-directory/develop/app-resilience-continuous-access-evaluation#the-code

try
{
    authResult = await _clientApp.AcquireTokenSilent(scopes, firstAccount)
        .WithClaims(claimChallenge)
        .ExecuteAsync()
        .ConfigureAwait(false);
}
catch (MsalUiRequiredException)
{
    try
    {
        authResult = await _clientApp.AcquireTokenInteractive(scopes)
            .WithClaims(claimChallenge)
            .WithAccount(firstAccount)
            .ExecuteAsync()
            .ConfigureAwait(false);
    }
    // ...

claims challenge should be sent back to interactive re-auth. But Azure PowerShell cmdlet Connect-AzAccount doesn't expose -Claims parameter, and everything still works as expected.

We still need to decide whether Azure CLI wants to expose --claims in az login.