Add SHA256 certificate thumbprint support with authority-based selection

[Copilot]

Adds thumbprint_sha256 parameter to enable modern SHA256 certificate authentication alongside legacy SHA1 support.

Changes

Core Implementation (msal/application.py)

• Accept thumbprint_sha256 in client_credential dictionary
• Selection logic when both thumbprints provided:
  • AAD/B2C/CIAM authorities → SHA256 (PS256 algorithm)
  • ADFS/generic authorities → SHA1 (RS256 algorithm)
• Use authority._is_b2c for B2C/CIAM detection

Tests (tests/test_optional_thumbprint.py)

• 6 new test cases covering all authority types (AAD, ADFS, B2C, CIAM, generic)
• Verify both algorithm selection and thumbprint values

Usage

# SHA256 only (modern)
client_credential = {
    "private_key": private_key_pem,
    "thumbprint_sha256": "abc123..."
}

# Both provided - uses SHA256 for AAD, SHA1 for ADFS
client_credential = {
    "private_key": private_key_pem,
    "thumbprint": "def456...",          # SHA1
    "thumbprint_sha256": "abc123..."    # SHA256
}

Backward compatible - existing thumbprint (SHA1) usage unchanged.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• login.microsoftonline.com
  • Triggering command: /usr/bin/python python -m pytest tests/ -v --benchmark-skip -x (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Feature Request] Add support for SHA256 certificate thumbprint similar to SHA1</issue_title>
<issue_description>### MSAL client type

Confidential

Problem Statement

{
    "private_key": "<private_key_pem_bytes>",
    "thumbprint": "<sha1_thumbprint_hex_string>"
+    "thumbprint_sha256": "<sha2_thumbprint_hex_string>"    
}

Spec is:

But anyway, so the spec would be

if only thumbprint is defined - use it
if only thumbprint_sha256 is defined - use it
if both are defined - use sha2 for AAD authorities (including b2c, ciam), use sha1 for ADFS and generic authorities

Proposed solution

No response</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Feature Request] Add support for SHA256 certificate thumbprint similar to SHA1 #872

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.