Skip to content

Add instance aware flow restriction to copilot-instructions.md #8144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: dev
Choose a base branch
from
Open

Add instance aware flow restriction to copilot-instructions.md #8144

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
82b4533
Initial plan
Copilot Nov 14, 2025
fe83c26
Add instance aware flow restrictions to copilot-instructions.md
Copilot Nov 14, 2025
ec2b4b8
Apply suggestions from code review
jo-arroyo Nov 14, 2025
5203bc9
Update instructions
jo-arroyo Nov 20, 2025
0272652
Merge branch 'dev' into copilot/update-copilot-instructions-file
jo-arroyo Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/copilot-instructions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,29 @@ microsoft-authentication-library-for-js/
- Write unit tests for new functionality and bug fixes
- Document all public API changes

### Instance Aware Flow Restrictions

**IMPORTANT: The instance aware flow is only available for 1st party Microsoft customers and should NEVER be suggested or used for 3rd party customers.**
Copy link
Collaborator

@tnorling tnorling Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot is unlikely to know if I am a 1st party or 3rd party customer or what that is. The instructions here are probably not going to be all that useful, we probably need to restrict access in code instead if this is the goal.

Copy link
Contributor

@peterzenz peterzenz Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this should just be that this feature isn't supported and we have copilot instructions in the 1p repo to ignore that statement in the 3p repo? We aren't looking to make code changes for this, just doc updates.

Copy link
Collaborator

@tnorling tnorling Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When working in the 1P repo, this instructions file won't be read at all so no need to ignore explicitly. At a higher level though exposing something we don't support creates several challenges, including this one. We should reconsider whether this is the right approach.

Copy link
Collaborator

@jo-arroyo jo-arroyo Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to know re. what Copilot does and does not know. This part has now been amended, since the current ask is just to move/remove the public-facing documentation.


- **Do not suggest** the `instanceAware` configuration option or `instance_aware` query parameter for 3rd party applications
- **Do not recommend** instance aware flow in code examples, documentation, or solutions for external developers
- Instance aware flow documentation exists at `lib/msal-browser/docs/instance-aware.md` but is intended only for internal Microsoft use cases
- If asked about multi-cloud or cloud instance scenarios by 3rd party developers, provide alternative solutions that do not involve instance aware flow

**What is Instance Aware Flow:**
- A feature that allows the STS to send back additional parameters in the `/authorize` response to specify where tokens should be retrieved from
- Enabled via `instanceAware: true` in auth config or `instance_aware: "true"` in request `extraQueryParameters`
- Used primarily for scenarios where user accounts may reside in different cloud instances

**When to use (1st party only):**
- Only for Microsoft internal applications and services
- When the application needs to handle users across different cloud instances (e.g., public cloud, government clouds, etc.)

**What to suggest instead for 3rd party customers:**
- Standard MSAL authentication flows without instance aware configuration
- Proper authority configuration for the specific cloud environment the application targets
- Separate application registrations for different cloud environments if needed

### Telemetry and Performance Monitoring

**IMPORTANT: Add telemetry for any new operations or significant code paths in msal-browser and msal-common where observability would be useful.**
Expand Down
Loading