From 7b36c874ec57ce87d82d987c06d41ced5c139287 Mon Sep 17 00:00:00 2001
From: jennypng <63012604+JennyPng@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:13:35 -0700
Subject: [PATCH 1/2] pin msal

---
 sdk/identity/azure-identity/pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/pyproject.toml b/sdk/identity/azure-identity/pyproject.toml
index b11b428b2f45..59c77c680fba 100644
--- a/sdk/identity/azure-identity/pyproject.toml
+++ b/sdk/identity/azure-identity/pyproject.toml
@@ -26,7 +26,7 @@ classifiers = [
 dependencies = [
     "azure-core>=1.31.0",
     "cryptography>=2.5",
-    "msal>=1.35.1",
+    "msal>=1.35.1,<1.38.0",
     "msal-extensions>=1.2.0",
     "typing-extensions>=4.0.0",
 ]

From 0f09dc3d479fd3167fa74fa63c46eb48b2c5b646 Mon Sep 17 00:00:00 2001
From: jennypng <63012604+JennyPng@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:20:11 -0700
Subject: [PATCH 2/2] changelog

---
 sdk/identity/azure-identity/CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md
index 5e32811dd115..8e2db68f9c68 100644
--- a/sdk/identity/azure-identity/CHANGELOG.md
+++ b/sdk/identity/azure-identity/CHANGELOG.md
@@ -16,6 +16,7 @@
 
 - Added `RequestIdPolicy` to the default pipeline policies to ensure a unique `x-ms-client-request-id` header is sent with each request. ([#46070](https://github.com/Azure/azure-sdk-for-python/pull/46070))
 - `CertificateCredential` now passes the PEM private_key to MSAL as a str rather than bytes, matching MSAL's documented `client_credential` contract. ([#46801](https://github.com/Azure/azure-sdk-for-python/pull/46801))
+- Temporarily constrained `msal` to `<1.38.0` because MSAL 1.38 is incompatible with the Azure Core-backed transport used by synchronous Service Fabric managed identity authentication.
 
 ## 1.25.3 (2026-03-12)