honor AZURE_CLIENT_ID in mi

[xiangyan99]

What does this PR do?

[Provide a clear, concise description of the changes]

Port fix #1033 honor AZURE_CLIENT_ID in mi into 1.0.1

[Any additional context, screenshots, or information that helps reviewers]

GitHub issue number?

[Link to the GitHub issue this PR addresses]

Pre-merge Checklist

• Required for All PRs
  • Read contribution guidelines
  • PR title clearly describes the change
  • Commit history is clean with descriptive messages (cleanup guide)
  • Added comprehensive tests for new/modified functionality
  • Updated servers/Azure.Mcp.Server/CHANGELOG.md and/or servers/Fabric.Mcp.Server/CHANGELOG.md for product changes (features, bug fixes, UI/UX, updated dependencies)
• For MCP tool changes:
  • One tool per PR: This PR adds or modifies only one MCP tool for faster review cycles
  • Updated servers/Azure.Mcp.Server/README.md and/or servers/Fabric.Mcp.Server/README.md documentation
  • Validate README.md changes using script at eng/scripts/Process-PackageReadMe.ps1. See Package README
  • Updated command list in /servers/Azure.Mcp.Server/docs/azmcp-commands.md and/or /docs/fabric-commands.md
  • Run .\eng\scripts\Update-AzCommandsMetadata.ps1 to update tool metadata in azmcp-commands.md (required for CI)
  • For new or modified tool descriptions, ran ToolDescriptionEvaluator and obtained a score of 0.4 or more and a top 3 ranking for all related test prompts
  • For new tools associated with Azure services or publicly available tools/APIs/products, add URL to documentation in the PR description
• Extra steps for Azure MCP Server tool changes:
  • Updated test prompts in /servers/Azure.Mcp.Server/docs/e2eTestPrompts.md
  • 👉 For Community (non-Microsoft team member) PRs:
    • Security review: Reviewed code for security vulnerabilities, malicious code, or suspicious activities before running tests (crypto mining, spam, data exfiltration, etc.)
    • Manual tests run: added comment /azp run mcp - pullrequest - live to run Live Test Pipeline

[Copilot]

Pull Request Overview

This PR adds support for User-Assigned Managed Identity authentication by introducing the AZURE_CLIENT_ID environment variable. It also refines the credential fallback behavior to prevent interactive browser prompts in production environments when explicit credentials are specified.

Key changes:

• Added AZURE_CLIENT_ID support for configuring User-Assigned Managed Identity (defaults to System-Assigned if not set)
• Modified credential chain logic to exclude InteractiveBrowserCredential fallback when AZURE_TOKEN_CREDENTIALS is explicitly set to "prod" or a specific credential type
• Updated documentation to clarify the new behavior and provide examples for both System-Assigned and User-Assigned Managed Identity scenarios

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
core/Azure.Mcp.Core/src/Services/Azure/Authentication/CustomChainedCredential.cs	Added AZURE_CLIENT_ID support in AddManagedIdentityCredential and conditional logic to exclude InteractiveBrowserCredential when explicit credentials are specified
core/Azure.Mcp.Core/tests/Azure.Mcp.Core.UnitTests/Services/Azure/Authentication/CustomChainedCredentialTests.cs	Added comprehensive unit tests covering User-Assigned Managed Identity scenarios, client ID handling, and credential chain behavior
servers/Azure.Mcp.Server/TROUBLESHOOTING.md	Updated documentation with detailed examples for User-Assigned Managed Identity configuration and clarified interactive browser fallback behavior
docs/Authentication.md	Added User-Assigned Managed Identity section with configuration examples
servers/Azure.Mcp.Server/CHANGELOG.md	Added feature entry for User-Assigned Managed Identity support

Comments suppressed due to low confidence (1)

core/Azure.Mcp.Core/src/Services/Azure/Authentication/CustomChainedCredential.cs:207

• The switch statement at lines 154-208 handles various credential types but lacks a case for 'interactivebrowsercredential'. The documentation in TROUBLESHOOTING.md (line 431) shows 'AZURE_TOKEN_CREDENTIALS=InteractiveBrowserCredential' as a valid option, but there's no corresponding case to handle it. Add a case for 'interactivebrowsercredential' that creates only the InteractiveBrowserCredential without adding it to the chain (since it's handled separately in CreateCredential).

                default:
                    // Unknown value, fall back to default chain
                    AddDefaultCredentialChain(credentials, tenantId);
                    break;