docs/setup/azure-managed-identity.md:14

• The /openai/v1/ endpoint requires a token whose audience is Cognitive Services. Microsoft’s Foundry REST reference and the feature’s own usage examples use https://cognitiveservices.azure.com/.default; https://ai.azure.com/.default produces a token for the wrong audience and the model request will be rejected. Update this scope (and the matching language samples below).

1. Pass a callback, in `bearer_token_provider` of the BYOK provider configuration, that uses `DefaultAzureCredential` to obtain a token for the `https://ai.azure.com/.default` scope.

docs/setup/azure-managed-identity.md:146

• This requests a token for the wrong audience. Azure’s /openai/v1/ endpoint requires the https://cognitiveservices.azure.com/.default scope, otherwise the sample fails authentication.

                new TokenRequestContext(["https://ai.azure.com/.default"]));

docs/setup/azure-managed-identity.md:187

• This requests a token for the wrong audience. Azure’s /openai/v1/ endpoint requires the https://cognitiveservices.azure.com/.default scope, otherwise the sample fails authentication.

			Scopes: []string{"https://ai.azure.com/.default"},

docs/setup/azure-managed-identity.md:259

• This requests a token for the wrong audience. Azure’s /openai/v1/ endpoint requires the https://cognitiveservices.azure.com/.default scope, otherwise the sample fails authentication.

                .getToken(new TokenRequestContext().addScopes("https://ai.azure.com/.default"))

docs/setup/azure-managed-identity.md:304

• This requests a token for the wrong audience. Azure’s /openai/v1/ endpoint requires the https://cognitiveservices.azure.com/.default scope, otherwise the sample fails authentication.

        token = await credential.get_token("https://ai.azure.com/.default")

docs/setup/azure-managed-identity.md:365

• This requests a token for the wrong audience. Azure’s /openai/v1/ endpoint requires the https://cognitiveservices.azure.com/.default scope, otherwise the sample fails authentication.

                    .get_token(&["https://ai.azure.com/.default"], None)

docs/setup/azure-managed-identity.md:410

• This requests a token for the wrong audience. Azure’s /openai/v1/ endpoint requires the https://cognitiveservices.azure.com/.default scope, otherwise the sample fails authentication.

  const tokenResponse = await credential.getToken("https://ai.azure.com/.default");

docs/auth/byok.md:208

• The bearer-token callback is explicitly experimental in every SDK’s public API (for example, nodejs/src/types.ts:2556-2557 and rust/src/types.rs:1155-1158), but this reference presents it as stable. Mark the field experimental so consumers understand that it may change or be removed.

| `bearerTokenProvider` / `bearer_token_provider` | callback | Returns a bearer token on demand (takes precedence over `apiKey` and `bearerToken`) |

docs/setup/azure-managed-identity.md:117

• This presents the token-provider approach without disclosing that the API is experimental. The SDK declarations explicitly warn that this surface may change or be removed (for example, nodejs/src/types.ts:2613 and rust/src/types.rs:1155), so users following this guide need the same stability warning.

### Use a token provider callback

Use this approach when you want the GitHub Copilot SDK runtime to request fresh tokens on demand through a callback that you provide. The Azure Identity SDK handles token caching and refresh timing.

docs/auth/byok.md:208

• The reference lists this callback like a stable provider field, but every SDK marks the new surface experimental (for example, dotnet/src/Types.cs:2201 and java/src/main/java/com/github/copilot/rpc/BearerTokenProvider.java:20). Please expose that lifecycle status here so consumers do not treat it as a compatibility guarantee.

| `bearerTokenProvider` / `bearer_token_provider` | callback | Returns a bearer token on demand (takes precedence over `apiKey` and `bearerToken`) |

docs/setup/azure-managed-identity.md:3

• This guide presents the bearer-token callback as a normal supported configuration, but the corresponding APIs in every SDK are explicitly marked experimental and may change or be removed (for example, go/types.go:1873-1875 and dotnet/src/Types.cs:2201). Add that lifecycle warning here so users do not treat this new integration surface as stable.

The GitHub Copilot SDK's [BYOK mode](../auth/byok.md) supports static API keys, but Azure deployments often use **Managed Identity** (Microsoft Entra ID) instead of long-lived keys. The GitHub Copilot SDK is designed to compose with the Azure Identity SDK for maximum flexibility. Supply a bearer token provider callback that can fetch fresh tokens on demand using an Azure Identity SDK API.

docs/auth/byok.md:208

• This new reference row omits that bearerTokenProvider is an experimental API across all six SDKs. Labeling it as experimental is necessary so the configuration reference does not imply stability that the public API contracts explicitly disclaim.

| `bearerTokenProvider` / `bearer_token_provider` | callback | Returns a bearer token on demand (takes precedence over `apiKey` and `bearerToken`) |

docs/setup/azure-managed-identity.md:349

• The Rust branch always constructs ManagedIdentityCredential with default options, so setting the newly documented AZURE_CLIENT_ID still selects only the system-assigned identity. Unlike the other Azure Identity SDKs, Rust requires ManagedIdentityCredentialOptions.user_assigned_id; read the environment variable into that option so the sample actually supports the documented User-assigned Managed Identity configuration.

        Ok("ManagedIdentityCredential") => Ok(ManagedIdentityCredential::new(None)?),