Make the macOS broker gate an arm64 allowlist

Previously the gate denied a fixed list of Intel architectures. Invert it
so the broker is enabled only on a recognized Apple Silicon (arm64)
machine, and any unexpected darwin architecture errs on the side of not
using the broker. Mirror the same rule in the manual smoke test.

Also restore the 'installed' qualifier on the macOS opt-in table row,
widening the column so the row stays consistent with the others.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: ashok672

msal/application.py

@@ -819,11 +819,14 @@ def _decide_broker(self, allow_broker, enable_pii_log):
         if (
             self._enable_broker
             and sys.platform == "darwin"
-            and platform.machine() in ("x86_64", "i386")
+            and platform.machine() != "arm64"
         ):
             # Broker on macOS is supported only on Apple Silicon (arm64).
-            # Intel Macs are excluded by product policy, regardless of whether
-            # a broker is actually installed on the device.
+            # Anything else on darwin -- Intel Macs, and an x86_64 Python
+            # running under Rosetta -- is excluded by product policy,
+            # regardless of whether a broker is installed on the device.
+            # This is an allowlist so that an unrecognized architecture
+            # errs on the side of not using the broker.
             self._enable_broker = False
             logger.warning(
                 "Broker is not supported on Intel-based Macs. "
@@ -2180,17 +2183,17 @@ def __init__(
 
             1. You can set any combination of the following opt-in parameters to true:
 
-               +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
-               | Opt-in flag              | If app will run on                | App has registered this as a Desktop platform redirect URI in Azure Portal         |
-               +==========================+===================================+====================================================================================+
-               | enable_broker_on_windows | Windows 10+                       | ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id                            |
-               +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
-               | enable_broker_on_wsl     | WSL                               | ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id                            |
-               +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
-               | enable_broker_on_mac     | Apple Silicon Mac, Company Portal | msauth.com.msauth.unsignedapp://auth                                               |
-               +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
-               | enable_broker_on_linux   | Linux with Intune installed       | ``https://login.microsoftonline.com/common/oauth2/nativeclient`` (MUST be enabled) |
-               +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
+               +--------------------------+-------------------------------------------------+------------------------------------------------------------------------------------+
+               | Opt-in flag              | If app will run on                              | App has registered this as a Desktop platform redirect URI in Azure Portal         |
+               +==========================+=================================================+====================================================================================+
+               | enable_broker_on_windows | Windows 10+                                     | ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id                            |
+               +--------------------------+-------------------------------------------------+------------------------------------------------------------------------------------+
+               | enable_broker_on_wsl     | WSL                                             | ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id                            |
+               +--------------------------+-------------------------------------------------+------------------------------------------------------------------------------------+
+               | enable_broker_on_mac     | Apple Silicon Mac with Company Portal installed | msauth.com.msauth.unsignedapp://auth                                               |
+               +--------------------------+-------------------------------------------------+------------------------------------------------------------------------------------+
+               | enable_broker_on_linux   | Linux with Intune installed                     | ``https://login.microsoftonline.com/common/oauth2/nativeclient`` (MUST be enabled) |
+               +--------------------------+-------------------------------------------------+------------------------------------------------------------------------------------+
 
             2. Install broker dependency,
                e.g. ``pip install msal[broker]>=1.33,<2``.

tests/intel_mac_broker_smoke_test.py

@@ -15,7 +15,8 @@
 
 * Apple Silicon Mac (``arm64``) with ``pymsalruntime`` installed:
   ``_enable_broker`` is ``True``.
-* Intel Mac (``x86_64`` / ``i386``):
+* Intel Mac (``x86_64`` / ``i386``), or any other non-``arm64`` machine
+  (including an ``x86_64`` Python running under Rosetta):
   ``_enable_broker`` is ``False`` even though the opt-in was passed and even
   if a broker is installed on the device.
 * Non-Mac (Windows, Linux):
@@ -37,8 +38,8 @@
 def _expected_broker_state():
     if sys.platform != "darwin":
         return False, "non-Mac platform — enable_broker_on_mac is a no-op"
-    if platform.machine() in ("x86_64", "i386"):
-        return False, "Intel Mac — broker disabled by product policy"
+    if platform.machine() != "arm64":
+        return False, "not Apple Silicon — broker disabled by product policy"
     return True, "Apple Silicon Mac — broker should be enabled"
 
 

tests/test_application.py

@@ -1787,6 +1787,16 @@ def test_broker_should_be_disabled_on_i386_mac(self):
             )
         self.assertFalse(app._enable_broker)
 
+    @patch("msal.application.platform.machine", new=Mock(return_value="unexpected"))
+    def test_broker_should_be_disabled_on_unrecognized_machine(self):
+        """The gate is an allowlist, so an unknown architecture stays broker-free."""
+        app = msal.PublicClientApplication(
+            "client_id",
+            authority="https://login.microsoftonline.com/common",
+            enable_broker_on_mac=True,
+            )
+        self.assertFalse(app._enable_broker)
+
 
 class MismatchingScopeTestCase(unittest.TestCase):
     """Test cache behavior when HTTP response scope differs from requested scope"""