@@ -36,6 +36,7 @@ pr: none
 variables:
   CDP_DEFINITION_BUILD_COUNT: $[counter('', 0)]
   system.debug: ${{ parameters.debug }}
+  WindowsContainerImage: 'onebranch.azurecr.io/windows/ltsc2022/vse2022:latest' # https://aka.ms/obpipelines/containers
 
 resources:
   repositories:
@@ -64,6 +65,7 @@ extends:
         tsaEnabled: true
     featureFlags:
       EnableCDPxPAT: false
+      WindowsHostVersion: '1ESWindows2022'
 
     stages:
 
@@ -82,34 +84,26 @@ extends:
       condition: eq(dependencies.E2ETests.result, 'Succeeded')
       jobs:
       - job: BuildDist
-        displayName: 'Build sdist + wheel (Python 3.12)'
+        displayName: 'Build sdist + wheel'
         pool:
-          type: linux
-          isCustom: true
-          vmImage: 'ubuntu-22.04'
+          type: windows
         variables:
           ob_outputDirectory: '$(Build.ArtifactStagingDirectory)'
         steps:
-        - task: UsePythonVersion@0
-          inputs:
-            versionSpec: '3.12'
-          displayName: 'Use Python 3.12'
+        - script: python --version
+          displayName: 'Check Python version'
 
-        - script: |
-            python -m pip install --upgrade pip build twine
-          displayName: 'Install build toolchain'
-
-        - script: |
-            python -m build
+        - script: python setup.py sdist bdist_wheel
           displayName: 'Build sdist and wheel'
 
-        - script: |
-            python -m twine check dist/*
-          displayName: 'Verify distribution (twine check)'
-
-        - script: |
-            cp -r dist/* $(ob_outputDirectory)/
+        - task: CopyFiles@2
           displayName: 'Copy dist to output directory'
+          inputs:
+            SourceFolder: '$(Build.SourcesDirectory)\dist'
+            Contents: |
+              *.whl
+              *.tar.gz
+            TargetFolder: '$(ob_outputDirectory)'
 
     # ========================================================================
     # Stage 5a - Publish to test.pypi.org (Preview / RC)
@@ -135,8 +129,9 @@ extends:
         - task: DownloadPipelineArtifact@2
           displayName: 'Download build artifact'
           inputs:
-            artifactName: drop_Build_BuildDist
-            targetPath: $(Pipeline.Workspace)/python-dist
+            buildType: 'current'
+            artifactName: 'drop_Build_BuildDist'
+            targetPath: $(Pipeline.Workspace)\python-dist
 
         - task: UsePythonVersion@0
           inputs:
@@ -211,8 +206,9 @@ extends:
         - task: DownloadPipelineArtifact@2
           displayName: 'Download python-dist artifact'
           inputs:
-            artifactName: drop_Build_BuildDist
-            targetPath: $(Pipeline.Workspace)/python-dist
+            buildType: 'current'
+            artifactName: 'drop_Build_BuildDist'
+            targetPath: $(Pipeline.Workspace)\python-dist
 
         - task: EsrpRelease@12
           displayName: 'Publish to PyPI via ESRP'
@@ -225,9 +221,9 @@ extends:
             intent: 'PackageDistribution'
             contenttype: 'PyPi'
             contentsource: 'Folder'
-            folderlocation: '$(Pipeline.Workspace)/python-dist'
+            folderlocation: '$(Pipeline.Workspace)\python-dist'
             waitforreleasecompletion: true
-            owners: 'ryauld@microsoft.com,avdunn@microsoft.com'
+            owners: 'avdunn@microsoft.com,bogavril@microsoft.com'
             approvers: 'avdunn@microsoft.com,bogavril@microsoft.com'
             serviceendpointurl: 'https://api.esrp.microsoft.com'
             mainpublisher: 'ESRPRELPACMAN'
 
@@ -125,6 +125,7 @@ stages:
           --ignore=tests/test_e2e.py \
           --ignore=tests/test_e2e_manual.py \
           --ignore=tests/test_fmi_e2e.py \
+          --ignore=tests/test_mi_e2e.py \
           --deselect tests/test_cryptography.py::CryptographyTestCase::test_ceiling_should_be_latest_cryptography_version_plus_three \
           --deselect tests/test_cryptography.py::CryptographyTestCase::test_should_be_run_with_latest_version_of_cryptography
       displayName: 'Run pytest (unit)'
@@ -275,3 +276,123 @@ stages:
     - bash: rm -f "$(Agent.TempDirectory)/lab-auth.pfx"
       displayName: 'Remove lab certificate from agent'
       condition: always()
+
+# ══════════════════════════════════════════════════════════════════════════════
+# Stage 4 - MI E2E (IMDS) - REAL managed identity token acquisition on an Azure VM.
+#           Runs on the self-hosted "MISEManagedIdentity" pool, a Windows Azure VM
+#           that has the lab system-assigned + user-assigned identities assigned.
+#           Mirrors the MSAL Go "MI E2E - IMDS" stage. Only the IMDS cases in
+#           tests/test_mi_e2e.py run here (gated on MSAL_TEST_MI_IMDS); the Arc case
+#           self-skips. No lab certificate is needed - the VM's own managed identity
+#           is used.
+#
+#           Pool assumptions (self-hosted): Python 3.x on PATH and outbound access to
+#           PyPI for "pip install". Adjust if the pool differs.
+# ══════════════════════════════════════════════════════════════════════════════
+- stage: MIE2EImds
+  displayName: 'MI E2E - IMDS'
+  dependsOn: UnitTests
+  # Fork guard: never run untrusted forked-PR code on the self-hosted pool.
+  condition: and(eq(dependencies.UnitTests.result, 'Succeeded'), ne(variables['System.PullRequest.IsFork'], 'True'))
+  jobs:
+  - job: Pytest
+    displayName: 'Managed Identity E2E - VM / IMDS'
+    pool:
+      type: windows
+      isCustom: true
+      name: MISEManagedIdentity
+    timeoutInMinutes: 30
+    variables:
+      ob_outputDirectory: '$(Build.ArtifactStagingDirectory)'
+    steps:
+    # msal + its dependencies (requests, cryptography, PyJWT) and pytest are PRE-PROVISIONED on the
+    # self-hosted pool (like the Go/.NET toolchains already are), so there is no runtime pip install.
+    # This also avoids the Arc pool's egress TLS inspection blocking files.pythonhosted.org.
+    - task: PowerShell@2
+      displayName: 'Run pytest (MI E2E - IMDS)'
+      inputs:
+        targetType: 'inline'
+        workingDirectory: '$(System.DefaultWorkingDirectory)'
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $py = (Get-Command python.exe -ErrorAction SilentlyContinue).Source
+          if (-not $py) {
+            $py = Get-ChildItem 'C:\Program Files\Python3*\python.exe','C:\Program Files (x86)\Python3*\python.exe','C:\Python3*\python.exe' -ErrorAction SilentlyContinue |
+              Select-Object -First 1 -ExpandProperty FullName
+          }
+          if (-not $py) { throw 'Python not found on this agent. Install Python 3.x on the pool machine.' }
+          Write-Host "Using Python: $py"
+          & $py --version
+          New-Item -ItemType Directory -Force -Path test-results | Out-Null
+          & $py -m pytest -vv --junitxml=test-results/junit-mi-e2e-imds.xml tests/test_mi_e2e.py
+      env:
+        PYTHONUNBUFFERED: '1'
+        MSAL_TEST_MI_IMDS: '1'
+
+    - task: PublishTestResults@2
+      displayName: 'Publish MI E2E (IMDS) test results'
+      condition: succeededOrFailed()
+      inputs:
+        testResultsFormat: 'JUnit'
+        testResultsFiles: 'test-results/junit-mi-e2e-imds.xml'
+        failTaskOnFailedTests: true
+        testRunTitle: 'MI E2E - IMDS'
+
+# ══════════════════════════════════════════════════════════════════════════════
+# Stage 5 - MI E2E (Azure Arc) - REAL managed identity token acquisition on an
+#           Azure Arc-enabled machine. Runs on the self-hosted "MISEAZUREARC" pool.
+#           Azure Arc supports the system-assigned identity only. Mirrors the MSAL Go
+#           "MI E2E - Azure Arc" stage. tests/test_mi_e2e.py's Arc case runs here; the
+#           IMDS cases self-skip (MSAL_TEST_MI_IMDS unset).
+#
+#           Pool note: as observed for MSAL Go, the Arc machine's egress inspection can
+#           reset TLS for package downloads. If "pip install" cannot reach PyPI, pre-provision
+#           the dependencies on the pool (or use an offline wheel cache) and drop the install step.
+# ══════════════════════════════════════════════════════════════════════════════
+- stage: MIE2EAzureArc
+  displayName: 'MI E2E - Azure Arc'
+  dependsOn: UnitTests
+  # Fork guard: never run untrusted forked-PR code on the self-hosted pool.
+  condition: and(eq(dependencies.UnitTests.result, 'Succeeded'), ne(variables['System.PullRequest.IsFork'], 'True'))
+  jobs:
+  - job: Pytest
+    displayName: 'Managed Identity E2E - Azure Arc'
+    pool:
+      type: windows
+      isCustom: true
+      name: MISEAZUREARC
+    timeoutInMinutes: 30
+    variables:
+      ob_outputDirectory: '$(Build.ArtifactStagingDirectory)'
+    steps:
+    # msal + its dependencies (requests, cryptography, PyJWT) and pytest are PRE-PROVISIONED on the
+    # self-hosted pool (like the Go/.NET toolchains already are), so there is no runtime pip install.
+    # This is required here because the Arc machine's egress TLS inspection blocks files.pythonhosted.org.
+    - task: PowerShell@2
+      displayName: 'Run pytest (MI E2E - Azure Arc)'
+      inputs:
+        targetType: 'inline'
+        workingDirectory: '$(System.DefaultWorkingDirectory)'
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $py = (Get-Command python.exe -ErrorAction SilentlyContinue).Source
+          if (-not $py) {
+            $py = Get-ChildItem 'C:\Program Files\Python3*\python.exe','C:\Program Files (x86)\Python3*\python.exe','C:\Python3*\python.exe' -ErrorAction SilentlyContinue |
+              Select-Object -First 1 -ExpandProperty FullName
+          }
+          if (-not $py) { throw 'Python not found on this agent. Install Python 3.x on the pool machine.' }
+          Write-Host "Using Python: $py"
+          & $py --version
+          New-Item -ItemType Directory -Force -Path test-results | Out-Null
+          & $py -m pytest -vv --junitxml=test-results/junit-mi-e2e-arc.xml tests/test_mi_e2e.py
+      env:
+        PYTHONUNBUFFERED: '1'
+
+    - task: PublishTestResults@2
+      displayName: 'Publish MI E2E (Azure Arc) test results'
+      condition: succeededOrFailed()
+      inputs:
+        testResultsFormat: 'JUnit'
+        testResultsFiles: 'test-results/junit-mi-e2e-arc.xml'
+        failTaskOnFailedTests: true
+        testRunTitle: 'MI E2E - Azure Arc'
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run Issue Sentinel
-        uses: Azure/issue-sentinel@v1
+        uses: Azure/issue-sentinel@d1e433f192aa9442d44292b9b6d5d31419639aba # v1.6.1
         with:
           password: ${{secrets.ISSUE_SENTINEL_PASSWORD}}
           enable-similar-issues-scanning: true # Scan for similar issues
 
@@ -22,9 +22,9 @@ jobs:
       contents: read
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.12'
         cache: 'pip'
@@ -38,7 +38,7 @@ jobs:
       # `twine check` catches broken long_description / metadata that would fail PyPI upload.
       run: twine check dist/*
     - name: Upload built artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: dist
         path: dist/
 
@@ -216,11 +216,7 @@ def _remove_tokens_for_client(app):
 
 def _exit(app):
     """Exit"""
-    bug_link = (
-        "https://identitydivision.visualstudio.com/Engineering/_queries/query/79b3a352-a775-406f-87cd-a487c382a8ed/"
-        if app._enable_broker else
-        "https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/new/choose"
-        )
+    bug_link = "https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/new/choose"
     print("Bye. If you found a bug, please report it here: {}".format(bug_link))
     sys.exit()
 
@@ -334,4 +330,3 @@ def _main():
 
 if __name__ == "__main__":
     _main()
-