Bump Microsoft.Identity.Web.GraphServiceClient from 4.14.2 to 4.15.0

[dependabot]

Updated Microsoft.Identity.Web.GraphServiceClient from 4.14.2 to 4.15.0.

Release notes

Sourced from Microsoft.Identity.Web.GraphServiceClient's releases.

4.15.0

Federated credentials and proof of possession

• Federated credential token exchange derives cloud-specific audience and scope metadata from the authority host, with explicit overrides still supported. #​3994
• The Entra Sidecar /Validate endpoint accepts Signed HTTP Request proof-of-possession tokens for app-only client-credential flows. #​4008
• Credential Guard key attestation is available through the optional Microsoft.Identity.Web.KeyAttestation package and AddMicrosoftIdentityWebKeyAttestation() registration. #​4004

Authentication and token acquisition

• EasyAuth app-token acquisition returns an app-only authentication result produced through client credentials. #​4015
• Graph v4 credentials are attached only to destinations matching the configured absolute HTTPS origin; custom Graph proxy base URLs remain supported. #​4012

Authorization and request validation

• OWIN web APIs require a non-empty recognized scope or role unless ACL-based authorization is explicitly enabled. #​4006 #​4009
• Explicitly configured missing scope or app-permission requirements now fail authorization. #​4010
• Local redirect paths containing control characters are rejected. #​4028

Entra Sidecar reliability and validation

• Invalid selected AgentUserId values return HTTP 400. #​4011
• Automatic forwarded-header processing is rejected outside Development when ForwardedHeaders_Enabled=true. #​4018
• Non-local Host headers are rejected outside Development except on /healthz. #​4023
• Windows containers use ContainerUser, and ACL authorization defaults are correctly applied to named bearer options. #​4042

Dependency updates

• Microsoft.Identity.Client and Microsoft.Identity.Client.KeyAttestation: 4.87.0 -> 4.90.0. #​4003 #​3994 #​4052
• Microsoft.Identity.Abstractions: 12.6.0 -> 12.7.0. #​4020 #​3994

Full changelog: AzureAD/microsoft-identity-web@4.14.2...4.15.0

Commits viewable in compare view.