From d4d37b42cbd6e8afa398367a228a18b7de368fa5 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangyan@microsoft.com>
Date: Mon, 29 Aug 2022 14:46:41 -0700
Subject: [PATCH 01/16] add wam support

---
 sdk/identity/azure-identity/CHANGELOG.md       |  2 ++
 .../azure/identity/_credentials/certificate.py | 16 ++++++++++++++--
 .../identity/_credentials/client_secret.py     | 18 +++++++++++++++---
 .../identity/_credentials/on_behalf_of.py      | 15 +++++++++++++--
 .../identity/_internal/msal_credentials.py     |  4 +++-
 sdk/identity/azure-identity/setup.py           |  2 +-
 6 files changed, 48 insertions(+), 9 deletions(-)

diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md
index 2b99f0e3a34c..04366c565703 100644
--- a/sdk/identity/azure-identity/CHANGELOG.md
+++ b/sdk/identity/azure-identity/CHANGELOG.md
@@ -4,6 +4,8 @@
 
 ### Features Added
 
+- Added Windows Web Account Manager (WAM) Brokered Authentication Support. ([#23687](https://github.com/Azure/azure-sdk-for-python/issues/23687))
+
 ### Breaking Changes
 
 ### Bugs Fixed
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
index 2ebb90b12feb..83c1dd7e65b1 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
@@ -45,10 +45,22 @@ class CertificateCredential(ClientCredentialBase):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
+    :keyword bool allow_broker:  
+        Brokers provide Single-Sign-On, device identification,
+        and application identification verification.
+        If this parameter is set to True,
+        the broker will be used when possible. Default to False.
     """
 
-    def __init__(self, tenant_id, client_id, certificate_path=None, **kwargs):
-        # type: (str, str, Optional[str], **Any) -> None
+    def __init__(
+            self,
+            tenant_id: str,
+            client_id: str,
+            certificate_path: str = None,
+            *,
+            allow_broker: bool = False,
+            **kwargs
+    ) -> None:
         validate_tenant_id(tenant_id)
 
         client_credential = get_client_credential(certificate_path, **kwargs)
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
index 4b68e401a023..1f584f902064 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
@@ -8,7 +8,7 @@
 
 if TYPE_CHECKING:
     # pylint:disable=unused-import,ungrouped-imports
-    from typing import Any
+    from typing import Any, Optional
 
 
 class ClientSecretCredential(ClientCredentialBase):
@@ -24,10 +24,22 @@ class ClientSecretCredential(ClientCredentialBase):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
+    :keyword bool allow_broker:  
+        Brokers provide Single-Sign-On, device identification,
+        and application identification verification.
+        If this parameter is set to True,
+        the broker will be used when possible. Default to False.
     """
 
-    def __init__(self, tenant_id, client_id, client_secret, **kwargs):
-        # type: (str, str, str, **Any) -> None
+    def __init__(
+            self,
+            tenant_id: str,
+            client_id: str,
+            client_secret: str,
+            *,
+            allow_broker: bool = False,
+            **kwargs
+    ) -> None:
         if not client_id:
             raise ValueError("client_id should be the id of an Azure Active Directory application")
         if not client_secret:
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
index b9d6a3e0dd9f..3c4265ee2db8 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
@@ -48,10 +48,21 @@ class OnBehalfOfCredential(MsalCredential, GetTokenMixin):
         is a unicode string, it will be encoded as UTF-8. If the certificate requires a different encoding, pass
         appropriately encoded bytes instead.
     :paramtype password: str or bytes
+    :keyword bool allow_broker:
+        Brokers provide Single-Sign-On, device identification,
+        and application identification verification.
+        If this parameter is set to True,
+        the broker will be used when possible. Default to False.
     """
 
-    def __init__(self, tenant_id, client_id, **kwargs):
-        # type: (str, str, **Any) -> None
+    def __init__(
+            self,
+            tenant_id: str,
+            client_id: str,
+            *,
+            allow_broker: bool = False,
+            **kwargs
+    ) -> None:
         self._assertion = kwargs.pop("user_assertion", None)
         if not self._assertion:
             raise TypeError('"user_assertion" is required.')
diff --git a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
index a0c9780e1eea..a709deb8b003 100644
--- a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
+++ b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
@@ -36,6 +36,7 @@ def __init__(self, client_id, client_credential=None, **kwargs):
         self._client_applications = {}  # type: Dict[str, msal.ClientApplication]
         self._client_credential = client_credential
         self._client_id = client_id
+        self._allow_broker = kwargs.pop("allow_broker", False)
 
         self._cache = kwargs.pop("_cache", None)
         if not self._cache:
@@ -73,7 +74,8 @@ def _get_app(self, **kwargs):
                 azure_region=self._regional_authority,
                 token_cache=self._cache,
                 http_client=self._client,
-                validate_authority=self._validate_authority
+                validate_authority=self._validate_authority,
+                allow_broker=self._allow_broker
             )
 
         return self._client_applications[tenant_id]
diff --git a/sdk/identity/azure-identity/setup.py b/sdk/identity/azure-identity/setup.py
index 85e1909cd977..07e12906661b 100644
--- a/sdk/identity/azure-identity/setup.py
+++ b/sdk/identity/azure-identity/setup.py
@@ -74,7 +74,7 @@
     install_requires=[
         "azure-core<2.0.0,>=1.11.0",
         "cryptography>=2.5",
-        "msal<2.0.0,>=1.12.0",
+        "msal<2.0.0,>=1.19.0",
         "msal-extensions<2.0.0,>=0.3.0",
         "six>=1.12.0",
     ],

From f98a3743eca39e530b6c73f52ed7c744e17b7631 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Tue, 30 Aug 2022 14:24:49 -0700
Subject: [PATCH 02/16] Update sdk/identity/azure-identity/CHANGELOG.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: McCoy Patiño <39780829+mccoyp@users.noreply.github.com>
---
 sdk/identity/azure-identity/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md
index 04366c565703..7d85ab25f459 100644
--- a/sdk/identity/azure-identity/CHANGELOG.md
+++ b/sdk/identity/azure-identity/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Features Added
 
-- Added Windows Web Account Manager (WAM) Brokered Authentication Support. ([#23687](https://github.com/Azure/azure-sdk-for-python/issues/23687))
+- Added Windows Web Account Manager (WAM) Brokered Authentication support. ([#23687](https://github.com/Azure/azure-sdk-for-python/issues/23687))
 
 ### Breaking Changes
 

From d2ac7e5718ed6f878bf52231d18a26fcb2646615 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Tue, 30 Aug 2022 14:25:01 -0700
Subject: [PATCH 03/16] Update
 sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: McCoy Patiño <39780829+mccoyp@users.noreply.github.com>
---
 .../azure/identity/_credentials/certificate.py             | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
index 83c1dd7e65b1..255e92bd757c 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
@@ -45,11 +45,8 @@ class CertificateCredential(ClientCredentialBase):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
-    :keyword bool allow_broker:  
-        Brokers provide Single-Sign-On, device identification,
-        and application identification verification.
-        If this parameter is set to True,
-        the broker will be used when possible. Default to False.
+    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(

From a81cd6b0efa021142100375d3798cc290a0e1aca Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangyan@microsoft.com>
Date: Tue, 30 Aug 2022 14:53:48 -0700
Subject: [PATCH 04/16] update

---
 .../azure/identity/_credentials/certificate.py  |  6 +++++-
 .../identity/_credentials/client_secret.py      | 17 +++++++----------
 .../azure/identity/_credentials/on_behalf_of.py | 14 ++++++++------
 3 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
index 255e92bd757c..1a29d7b6109b 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
@@ -63,7 +63,11 @@ def __init__(
         client_credential = get_client_credential(certificate_path, **kwargs)
 
         super(CertificateCredential, self).__init__(
-            client_id=client_id, client_credential=client_credential, tenant_id=tenant_id, **kwargs
+            client_id=client_id,
+            client_credential=client_credential,
+            tenant_id=tenant_id,
+            allow_broker=allow_broker,
+            **kwargs
         )
 
 
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
index 1f584f902064..74a5d3d9a992 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
@@ -6,10 +6,6 @@
 
 from .._internal.client_credential_base import ClientCredentialBase
 
-if TYPE_CHECKING:
-    # pylint:disable=unused-import,ungrouped-imports
-    from typing import Any, Optional
-
 
 class ClientSecretCredential(ClientCredentialBase):
     """Authenticates as a service principal using a client secret.
@@ -24,11 +20,8 @@ class ClientSecretCredential(ClientCredentialBase):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
-    :keyword bool allow_broker:  
-        Brokers provide Single-Sign-On, device identification,
-        and application identification verification.
-        If this parameter is set to True,
-        the broker will be used when possible. Default to False.
+    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(
@@ -50,5 +43,9 @@ def __init__(
             )
 
         super(ClientSecretCredential, self).__init__(
-            client_id=client_id, client_credential=client_secret, tenant_id=tenant_id, **kwargs
+            client_id=client_id,
+            client_credential=client_secret,
+            tenant_id=tenant_id,
+            allow_broker=allow_broker,
+            **kwargs
         )
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
index 3c4265ee2db8..3c401f30101e 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
@@ -48,11 +48,8 @@ class OnBehalfOfCredential(MsalCredential, GetTokenMixin):
         is a unicode string, it will be encoded as UTF-8. If the certificate requires a different encoding, pass
         appropriately encoded bytes instead.
     :paramtype password: str or bytes
-    :keyword bool allow_broker:
-        Brokers provide Single-Sign-On, device identification,
-        and application identification verification.
-        If this parameter is set to True,
-        the broker will be used when possible. Default to False.
+    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(
@@ -87,7 +84,12 @@ def __init__(
         else:
             raise TypeError('Either "client_certificate" or "client_secret" must be provided')
 
-        super(OnBehalfOfCredential, self).__init__(client_id, credential, tenant_id=tenant_id, **kwargs)
+        super(OnBehalfOfCredential, self).__init__(
+            client_id=client_id,
+            client_credential=credential,
+            tenant_id=tenant_id,
+            allow_broker=allow_broker,
+            **kwargs)
         self._auth_record = None  # type: Optional[AuthenticationRecord]
 
     @wrap_exceptions

From 2a18b2bd245e15de8955deb37bcefcb66b1a6ddc Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Tue, 6 Sep 2022 11:08:51 -0700
Subject: [PATCH 05/16] Update setup.py

---
 sdk/identity/azure-identity/setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/setup.py b/sdk/identity/azure-identity/setup.py
index 07e12906661b..c5ea7cd344d0 100644
--- a/sdk/identity/azure-identity/setup.py
+++ b/sdk/identity/azure-identity/setup.py
@@ -74,7 +74,7 @@
     install_requires=[
         "azure-core<2.0.0,>=1.11.0",
         "cryptography>=2.5",
-        "msal<2.0.0,>=1.19.0",
+        "msal<2.0.0,>=1.20.0b1",
         "msal-extensions<2.0.0,>=0.3.0",
         "six>=1.12.0",
     ],

From 7baed5bb01e29f9fd8bd5980ddc6d52f00d01b97 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Tue, 6 Sep 2022 12:40:21 -0700
Subject: [PATCH 06/16] Update shared_requirements.txt

---
 shared_requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared_requirements.txt b/shared_requirements.txt
index 2ae18c21294f..f88c25ac26ff 100644
--- a/shared_requirements.txt
+++ b/shared_requirements.txt
@@ -112,7 +112,7 @@ futures
 mock
 typing
 typing-extensions
-msal<2.0.0,>=1.12.0
+msal<2.0.0,>=1.20.0b1
 msal-extensions<2.0.0,>=0.3.0
 msrest>=0.6.21
 msrestazure<2.0.0,>=0.4.32

From c005816f3c190607cabdcd7226ec2e3bd54ae454 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Tue, 6 Sep 2022 13:01:07 -0700
Subject: [PATCH 07/16] Update client_secret.py

---
 .../azure-identity/azure/identity/_credentials/client_secret.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
index 74a5d3d9a992..bf4cb9741521 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
@@ -2,8 +2,6 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 # ------------------------------------
-from typing import TYPE_CHECKING
-
 from .._internal.client_credential_base import ClientCredentialBase
 
 

From 2d1d04bb8c033927ce09c8df426c807a576c6bfd Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Tue, 6 Sep 2022 13:03:14 -0700
Subject: [PATCH 08/16] Update environment.py

---
 .../azure-identity/azure/identity/_credentials/environment.py    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/environment.py b/sdk/identity/azure-identity/azure/identity/_credentials/environment.py
index 626e812350c3..6fe04d2f1126 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/environment.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/environment.py
@@ -64,7 +64,6 @@ class EnvironmentCredential(object):
     """
 
     def __init__(self, **kwargs):
-        # type: (Mapping[str, Any]) -> None
         self._credential = None  # type: Optional[EnvironmentCredentialTypes]
 
         if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

From 66e365f79def4950f6c52e26e40e4447aa29ffb7 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangyan@microsoft.com>
Date: Wed, 16 Nov 2022 11:38:41 -0800
Subject: [PATCH 09/16] update

---
 .../azure-identity/azure/identity/_credentials/browser.py    | 2 ++
 .../azure/identity/_credentials/certificate.py               | 5 -----
 .../azure/identity/_credentials/client_secret.py             | 5 -----
 .../azure/identity/_credentials/device_code.py               | 2 ++
 .../azure/identity/_credentials/on_behalf_of.py              | 5 -----
 .../azure/identity/_credentials/user_password.py             | 2 ++
 .../azure/identity/_internal/msal_credentials.py             | 2 +-
 7 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
index 5b624046a7ac..e9846cfba08f 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
@@ -51,6 +51,8 @@ class InteractiveBrowserCredential(InteractiveCredential):
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
     :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes).
+    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     :raises ValueError: invalid **redirect_uri**
     """
 
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
index 1a29d7b6109b..9030f17c77ea 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py
@@ -45,8 +45,6 @@ class CertificateCredential(ClientCredentialBase):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
-    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
-        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(
@@ -54,8 +52,6 @@ def __init__(
             tenant_id: str,
             client_id: str,
             certificate_path: str = None,
-            *,
-            allow_broker: bool = False,
             **kwargs
     ) -> None:
         validate_tenant_id(tenant_id)
@@ -66,7 +62,6 @@ def __init__(
             client_id=client_id,
             client_credential=client_credential,
             tenant_id=tenant_id,
-            allow_broker=allow_broker,
             **kwargs
         )
 
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
index bf4cb9741521..f3df16f814b0 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py
@@ -18,8 +18,6 @@ class ClientSecretCredential(ClientCredentialBase):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
-    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
-        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(
@@ -27,8 +25,6 @@ def __init__(
             tenant_id: str,
             client_id: str,
             client_secret: str,
-            *,
-            allow_broker: bool = False,
             **kwargs
     ) -> None:
         if not client_id:
@@ -44,6 +40,5 @@ def __init__(
             client_id=client_id,
             client_credential=client_secret,
             tenant_id=tenant_id,
-            allow_broker=allow_broker,
             **kwargs
         )
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py
index e5af7b89c8d1..138dafa3b41e 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py
@@ -55,6 +55,8 @@ class DeviceCodeCredential(InteractiveCredential):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
+    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(self, client_id=DEVELOPER_SIGN_ON_CLIENT_ID, **kwargs):
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
index 3c401f30101e..dc87d07bcf5d 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py
@@ -48,16 +48,12 @@ class OnBehalfOfCredential(MsalCredential, GetTokenMixin):
         is a unicode string, it will be encoded as UTF-8. If the certificate requires a different encoding, pass
         appropriately encoded bytes instead.
     :paramtype password: str or bytes
-    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
-        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(
             self,
             tenant_id: str,
             client_id: str,
-            *,
-            allow_broker: bool = False,
             **kwargs
     ) -> None:
         self._assertion = kwargs.pop("user_assertion", None)
@@ -88,7 +84,6 @@ def __init__(
             client_id=client_id,
             client_credential=credential,
             tenant_id=tenant_id,
-            allow_broker=allow_broker,
             **kwargs)
         self._auth_record = None  # type: Optional[AuthenticationRecord]
 
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
index 0521e8fa42d6..fdd2f60a7f22 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
@@ -37,6 +37,8 @@ class UsernamePasswordCredential(InteractiveCredential):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
+    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(self, client_id, username, password, **kwargs):
diff --git a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
index a709deb8b003..06aeb8093a4e 100644
--- a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
+++ b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
@@ -36,7 +36,7 @@ def __init__(self, client_id, client_credential=None, **kwargs):
         self._client_applications = {}  # type: Dict[str, msal.ClientApplication]
         self._client_credential = client_credential
         self._client_id = client_id
-        self._allow_broker = kwargs.pop("allow_broker", False)
+        self._allow_broker = kwargs.pop("allow_broker", None)
 
         self._cache = kwargs.pop("_cache", None)
         if not self._cache:

From 1a602a044c4a1bc50cf49d8fc08de36dd9fd2c87 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangyan@microsoft.com>
Date: Wed, 16 Nov 2022 16:10:13 -0800
Subject: [PATCH 10/16] update

---
 .../azure-identity/azure/identity/_credentials/device_code.py  | 2 --
 .../azure/identity/_internal/msal_credentials.py               | 3 ++-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py
index 5821ec33aee2..7834919cb1af 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py
@@ -47,8 +47,6 @@ class DeviceCodeCredential(InteractiveCredential):
     :keyword cache_persistence_options: configuration for persistent token caching. If unspecified, the credential
         will cache tokens in memory.
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
-    :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
-        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
     """
 
     def __init__(
diff --git a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
index 8adc14ffd04b..1cb898a476b6 100644
--- a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
+++ b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py
@@ -22,6 +22,7 @@ def __init__(
             client_credential: Union[str, Dict] = None,
             *,
             additionally_allowed_tenants: List[str] = None,
+            allow_broker: bool = None,
             **kwargs
     ) -> None:
         authority = kwargs.pop("authority", None)
@@ -34,7 +35,7 @@ def __init__(
         self._client_applications = {}  # type: Dict[str, msal.ClientApplication]
         self._client_credential = client_credential
         self._client_id = client_id
-        self._allow_broker = kwargs.pop("allow_broker", None)
+        self._allow_broker = allow_broker
         self._additionally_allowed_tenants = additionally_allowed_tenants or []
 
         self._cache = kwargs.pop("_cache", None)

From 3bd0042510a4d3c8129488ec610b010fa6caee41 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangyan@microsoft.com>
Date: Wed, 16 Nov 2022 16:15:17 -0800
Subject: [PATCH 11/16] Updates

---
 .../azure-identity/azure/identity/_credentials/browser.py     | 4 +++-
 .../azure/identity/_credentials/user_password.py              | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
index 009088e9e0d6..d6ff3b67841a 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
@@ -43,7 +43,9 @@ class InteractiveBrowserCredential(InteractiveCredential):
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
     :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes).
     :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
-        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False. 
+        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam 
+        for more WAM information.
     :raises ValueError: invalid **redirect_uri**
     """
 
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
index acd31820e5c6..e082330a8924 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
@@ -36,6 +36,8 @@ class UsernamePasswordCredential(InteractiveCredential):
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
     :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
         verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
+        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam 
+        for more WAM information.
     :keyword List[str] additionally_allowed_tenants: Specifies tenants in addition to the specified "tenant_id"
         for which the credential may acquire tokens. Add the wildcard value "*" to allow the credential to
         acquire tokens for any tenant the application can access.

From 9c0accc1f241e35ebfa01bab7792b66314a6c4d5 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangyan@microsoft.com>
Date: Wed, 16 Nov 2022 17:18:21 -0800
Subject: [PATCH 12/16] update

---
 .../azure-identity/azure/identity/_credentials/browser.py     | 4 ++--
 .../azure/identity/_credentials/user_password.py              | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
index d6ff3b67841a..604ef6a2d524 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
@@ -43,8 +43,8 @@ class InteractiveBrowserCredential(InteractiveCredential):
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
     :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes).
     :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
-        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False. 
-        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam 
+        verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
+        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam
         for more WAM information.
     :raises ValueError: invalid **redirect_uri**
     """
diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
index e082330a8924..8f9d2fcd3cf6 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
@@ -36,7 +36,7 @@ class UsernamePasswordCredential(InteractiveCredential):
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
     :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
         verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
-        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam 
+        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam
         for more WAM information.
     :keyword List[str] additionally_allowed_tenants: Specifies tenants in addition to the specified "tenant_id"
         for which the credential may acquire tokens. Add the wildcard value "*" to allow the credential to

From 52fe8e9baaaaa125722654bc625a90288877020e Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Thu, 17 Nov 2022 15:44:00 -0800
Subject: [PATCH 13/16] Update
 sdk/identity/azure-identity/azure/identity/_credentials/browser.py

Co-authored-by: Paul Van Eck <paulvaneck@microsoft.com>
---
 .../azure-identity/azure/identity/_credentials/browser.py       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
index 604ef6a2d524..2630f1544bb7 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py
@@ -44,7 +44,7 @@ class InteractiveBrowserCredential(InteractiveCredential):
     :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes).
     :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
         verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
-        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam
+        Check https://learn.microsoft.com/azure/active-directory/develop/scenario-desktop-acquire-token-wam
         for more WAM information.
     :raises ValueError: invalid **redirect_uri**
     """

From 694756dfe49354173eaa50ebd32d8eb83347ab32 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Thu, 17 Nov 2022 15:44:15 -0800
Subject: [PATCH 14/16] Update
 sdk/identity/azure-identity/azure/identity/_credentials/user_password.py

Co-authored-by: Paul Van Eck <paulvaneck@microsoft.com>
---
 .../azure-identity/azure/identity/_credentials/user_password.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
index 8f9d2fcd3cf6..37e2e115950c 100644
--- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
+++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py
@@ -36,7 +36,7 @@ class UsernamePasswordCredential(InteractiveCredential):
     :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions
     :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification
         verification. If this parameter is set to True, the broker will be used when possible. Defaults to False.
-        Check https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-wam
+        Check https://learn.microsoft.com/azure/active-directory/develop/scenario-desktop-acquire-token-wam
         for more WAM information.
     :keyword List[str] additionally_allowed_tenants: Specifies tenants in addition to the specified "tenant_id"
         for which the credential may acquire tokens. Add the wildcard value "*" to allow the credential to

From 1f13d881477adfee7713b5101270c1dc3d0a6e69 Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Thu, 17 Nov 2022 15:45:05 -0800
Subject: [PATCH 15/16] Update sdk/identity/azure-identity/setup.py

---
 sdk/identity/azure-identity/setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/identity/azure-identity/setup.py b/sdk/identity/azure-identity/setup.py
index c464bac70042..f653c573120b 100644
--- a/sdk/identity/azure-identity/setup.py
+++ b/sdk/identity/azure-identity/setup.py
@@ -60,7 +60,7 @@
     install_requires=[
         "azure-core<2.0.0,>=1.11.0",
         "cryptography>=2.5",
-        "msal<2.0.0,>=1.20.0b1",
+        "msal<2.0.0,>=1.20.0",
         "msal-extensions<2.0.0,>=0.3.0",
         "six>=1.12.0",
     ],

From cfbc5a362c2081b77a2a76fe94fd2c1726fcf80e Mon Sep 17 00:00:00 2001
From: Xiang Yan <xiangsjtu@gmail.com>
Date: Thu, 17 Nov 2022 15:45:23 -0800
Subject: [PATCH 16/16] Update shared_requirements.txt

---
 shared_requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared_requirements.txt b/shared_requirements.txt
index 6e14f5e16711..2a3102ce741b 100644
--- a/shared_requirements.txt
+++ b/shared_requirements.txt
@@ -113,7 +113,7 @@ futures
 mock
 typing
 typing-extensions
-msal<2.0.0,>=1.20.0b1
+msal<2.0.0,>=1.20.0
 msal-extensions<2.0.0,>=0.3.0
 msrest>=0.6.21
 msrestazure<2.0.0,>=0.4.32