msal

library1.38.0pypypi✓ verified 25d ago

The Microsoft Authentication Library (MSAL) for Python enables your app to access the Microsoft Cloud by supporting authentication with Microsoft Azure Active Directory (AAD) and Microsoft Accounts (MSA) using OAuth2 and OpenID Connect. Current version is 1.35.1, with regular updates addressing bugs and feature enhancements.

auth-security azure

pip install msal

github ↗package ↗homepage ↗docs ↗changelog ↗

INSTALL

IMPORT

SIG · MSAL

msal

auth-securitypythonv1.38.0

Install

3.6s avg

Import

494ms

Disk

38MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.38.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.514s · 39.3MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.6s · import 0.474s · 40MB

38MB installed

● package 38MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ConfidentialClientApplication

✓ from msal import ConfidentialClientApplication

Always use the correct module to prevent import errors.

This example demonstrates how to acquire an access token for Azure AD.

import os from msal import ConfidentialClientApplication client_id = os.environ.get('AZURE_CLIENT_ID', '') client_secret = os.environ.get('AZURE_CLIENT_SECRET', '') authority = 'https://login.microsoftonline.com/your_tenant_id' app = ConfidentialClientApplication(client_id, authority=authority, client_credential=client_secret) token_response = app.acquire_token_for_client(scopes=['https://graph.microsoft.com/.default']) print(token_response)

Debug

Known issues

breakingSupport for the Resource Owner Password Credentials (ROPC) flow is deprecated.

fix

Update your authentication flow to use authorization code flow or other supported options.

affects: < 1.35.0

gotchaEnsure environment variable names are correctly set (case-sensitive).

fix

Always use uppercase letters for environment variables.

affects: all

breakingTenant ID or authority URL is incorrect or not found, leading to OIDC Discovery failure (AADSTS90002).

fix

Ensure the tenant ID or tenant name in the authority URL is correct and valid. Verify it against your Azure Active Directory / Microsoft Entra ID configuration. Double-check the format of the authority URL, e.g., 'https://login.microsoftonline.com/<tenant_id>' or 'https://login.microsoftonline.com/<tenant_name>.onmicrosoft.com'.

breakingFailed to get MSAL authority configuration due to an invalid or not found tenant ID in the provided authority URL.

fix

Ensure the tenant ID or tenant name in the MSAL authority URL is correct and exists within the specified Microsoft Entra ID (Azure AD) cloud instance. Double-check the authority URL format. Examples include https://login.microsoftonline.com/your_tenant_id or https://tenant_name.ciamlogin.com or https://tenant_name.b2clogin.com/tenant.onmicrosoft.com/policy.

affects: all

Errors

Common errors & fixes

{'error': 'invalid_grant', 'error_description': 'AADSTS...'}

This general error indicates that the provided credentials or authorization grant is invalid, often due to expired credentials, MFA requirements, incorrect client secret/certificate, or misconfiguration of the application or tenant in Azure AD.

fix

Examine the 'error_description' field for specific AADSTS error codes and consult Microsoft Entra ID documentation for details. If Multi-Factor Authentication (MFA) is required, use an interactive token acquisition flow like `acquire_token_interactive`. Ensure your client secret or certificate is valid and not expired, and that your application's permissions and configuration in Azure AD are correct.

`app.acquire_token_silent` returns None or hangs

`acquire_token_silent` attempts to retrieve a token from the cache without user interaction. It returns `None` if no suitable token is found (e.g., the token expired, or an interactive step like MFA or consent is required). In some environments, like EC2, it might hang due to underlying network or configuration issues preventing silent acquisition.

fix

Always implement a fallback mechanism to an interactive token acquisition flow (e.g., `acquire_token_interactive` or `acquire_token_by_authorization_code`) if `acquire_token_silent` returns `None`. For hanging issues, verify network connectivity and ensure the application is correctly configured for the specific deployment environment.

KeyError: 'expires_in'

This error occurs when an attempt is made to access the 'expires_in' key in a dictionary returned by an MSAL token acquisition method, but the key is not present. This usually happens if the token acquisition failed or the response object does not contain the expected 'expires_in' field due to an unexpected format or an error condition.

fix

Before accessing specific keys like 'expires_in', always check if the key exists in the result dictionary. MSAL's successful responses contain 'access_token', while error responses contain 'error' and 'error_description'.

ValueError: The issuer '{iss}' does not match the authority '{auth}' or a known pattern.

This `ValueError` indicates that the authority URL provided during MSAL application initialization (e.g., in `ConfidentialClientApplication`) does not correctly match the issuer URL discovered from the OpenID Connect metadata endpoint for that authority. This is typically caused by a typo in the authority URL, an incorrect tenant ID, or a mismatch in the Azure AD configuration.

fix

Double-check the `authority` URL passed to your MSAL application. Ensure it is precisely formatted (e.g., `https://login.microsoftonline.com/{tenant_id}` or `https://login.microsoftonline.com/common`) and that the tenant ID or name is correct and valid for your Azure AD setup.

Upgrade

Version history

1.38.0latest on PyPI · released Aug 24, 2026

Audit

Dependencies

No dependency data recorded yet.

Agent activity

29 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/AzureAD/microsoft-authentication-library-for-python ↗

packagehttps://pypi.org/project/msal/ ↗

homepagehttps://docs.microsoft.com/azure/active-directory/develop/msal-overview ↗

docshttps://msal-python.readthedocs.io/ ↗

changeloghttps://github.com/AzureAD/microsoft-authentication-library-for-python/releases ↗