[Identity] Support Azure Arc user-assigned managed identity (UAMI) in ManagedIdentityCredential

[g2vinay]

Background

azure-identity's ManagedIdentityCredential supports Azure Arc, but only system-assigned managed identity (SAMI); user-assigned managed identity (UAMI) is explicitly blocked. The library implements Arc natively (there is no MSAL for C++), so — unlike the MSAL-based Azure SDKs — enabling Arc UAMI requires a native code change in this repo (it will not arrive via any dependency bump).

Azure Arc now supports UAMI at the platform level. This issue tracks enabling it in azure-identity.

Current behavior

• AzureArcManagedIdentitySource::Create (sdk/identity/azure-identity/src/managed_identity_source.cpp) throws when a user-assigned id is supplied:

  User assigned identity is not supported by the Azure Arc Managed Identity Endpoint. To authenticate with the system assigned identity, omit the client, object, or resource ID when constructing the ManagedIdentityCredential.

• The AzureArcManagedIdentitySource constructor passes an empty client id to the base ManagedIdentitySource and only appends api-version=2019-11-01; it never appends a user-assigned id query parameter (unlike AppServiceManagedIdentitySource, which appends client_id / principal_id / mi_res_id).
• The challenge-response path (ValidateArcKeyFile, WWW-Authenticate handling) is otherwise complete and identical for SAMI/UAMI.

Scope of work

• Remove the UAMI throw in AzureArcManagedIdentitySource::Create; pass clientId / objectId / resourceId into the constructor.
• Update the AzureArcManagedIdentitySource constructor (and its declaration in sdk/identity/azure-identity/src/private/managed_identity_source.hpp) to forward a non-empty client id to the base and append the correct id query parameter (verify names — Arc/IMDS msi_res_id vs App Service mi_res_id).
• No change needed in GetToken — both the initial and challenge-response requests clone m_url, so the id parameter flows through automatically.
• Update/add unit tests (ManagedIdentityCredentialTest): flip the existing "Arc + UAMI throws" case and assert the request URL carries the id parameter.
• Update CHANGELOG.md and docs (remove Arc SAMI-only wording).

Notes

• Requires the Arc HIMDS endpoint to accept a user-assigned id (the platform prerequisite; the same one the MSAL GA depends on).
• This is a native (non-MSAL) change; it does not depend on any MSAL version.
• The C SDK (azure-sdk-for-c) has no managed-identity credential, so no equivalent change applies there.

Key references

• sdk/identity/azure-identity/src/managed_identity_source.cpp
• sdk/identity/azure-identity/src/private/managed_identity_source.hpp
• sdk/identity/azure-identity/src/managed_identity_credential.cpp