Fix merging logic: Parse Authority into Instance and TenantId when provided alone (AAD & B2C)

[jmprieur]

Background

In @AzureAD/microsoft-identity-web#3609, we've identified that configuring MicrosoftIdentityApplicationOptions with only Authority fails for AAD scenarios. However, we also need to ensure B2C scenarios (which are being deprecated, but remain relevant to some customers) work as expected.

Root Cause

• PrepareAuthorityInstanceForMsal() returns early if Instance is null, resulting in a malformed authority string being passed to MSAL.
• ParseAuthorityIfNecessary() only triggers if both Instance and TenantId are unset, but is invoked too late.
• In B2C, authority parsing is more complex due to user-flow policies.

Fix Spec

• Ensure that when only Authority is set (and Instance/TenantId are unset), Authority is parsed early enough into Instance and TenantId before MSAL validation.
• For B2C, ensure policies in authorities are handled, and parsing logic gracefully supports B2C paths (including /tfp/ etc.).

Sample Failure (AAD)

[Fact]
public async Task AcquireToken_WithMicrosoftIdentityApplicationOptions_ClientCredentialsAsync_WithAuthority()
{
    services.Configure<MicrosoftIdentityApplicationOptions>(s_optionName, option =>
    {
        option.Authority = "https://login.microsoftonline.com/msidlab4.onmicrosoft.com/v2.0";
        option.ClientId = "f6b698c0-140c-448f-8155-4aa9bf77ceba";
        option.ClientCredentials = s_clientCredentials;
    });
    await CreateGraphClientAndAssertAsync(tokenAcquirerFactory, services);
}

(E2E: TokenAcquirer.cs#L229)

Sample B2C config

services.Configure<MicrosoftIdentityApplicationOptions>(s_optionName, option =>
{
    option.Authority = "https://<b2c domain>.b2clogin.com/tfp/<tenant>/<policy>/v2.0";
    option.ClientId = "...";
    option.ClientCredentials = s_clientCredentials;
});

Acceptance Criteria

• Authority-only works for AAD, CIAM, and B2C scenarios
• Authority is parsed into Instance/TenantId/Policy before MSAL validation
• Sample E2E test(s) pass
• New B2C test verifies parsing and success path
• Code blocks updated in relevant areas, with permalinks
• Update code comments to clarify B2C path handling
• Document changes for migration

References

• MergedOptions.cs:ParseAuthorityIfNecessary
• TokenAcquisition.cs:BuildConfidentialClientApplicationAsync

---

Bridge: Propose implementation diff and test samples when Jean-Marc replies "Go ahead".