[Bug] Explicit WithAzureRegion(...) still waits on IMDS region discovery, adding customer-visible token acquisition latency

[4gust]

Library version used

4.78.0

.NET version

Customers are seeing additional latency during confidential client token acquisition when using an explicit region with WithAzureRegion(...).

Example:

var app = ConfidentialClientApplicationBuilder.Create(clientId)
    .WithCertificate(certificate)
    .WithAuthority(authority)
    .WithAzureRegion("eastus")
    .Build();

var result = await app
    .AcquireTokenForClient(scopes)
    .ExecuteAsync();

Even though the region is explicitly provided, MSAL.NET still performs synchronous IMDS region discovery before using that region. If IMDS is slow, unavailable, or blocked, this adds ~2+ seconds to token acquisition.

From the current flow:

var discoveredRegion = await DiscoverAndCacheAsync(...).ConfigureAwait(false);

RecordTelemetry(requestContext.ApiEvent, azureRegionConfig, discoveredRegion);

...
return azureRegionConfig;
This means:

The explicit region is not returned until IMDS discovery completes or times out.
The IMDS result is mainly used to record telemetry / detect region mismatch.
If discovery fails, MSAL still uses the explicit region anyway.
Therefore the customer pays the discovery latency even though it does not affect the region ultimately used.
Expected behavior

When a customer provides an explicit region via WithAzureRegion("..."), MSAL should avoid adding synchronous IMDS discovery latency to the token acquisition path.

Proposed fix:

For explicit WithAzureRegion("..."), skip DiscoverAndCacheAsync entirely.

Today, IMDS discovery is used to compare the configured region with the auto-discovered region for telemetry. However, this discovery runs synchronously and adds customer-visible latency. Since the explicit region is ultimately used even when IMDS discovery fails, this telemetry path should not block token acquisition.

Suggested behavior:

• If WithAzureRegion("eastus") is used, validate and return "eastus" immediately.
• Do not call IMDS discovery for telemetry comparison.
• Keep IMDS discovery only for WithAzureRegion(ConfidentialClientApplication.AttemptRegionDiscovery) / auto-detect mode.
• Preserve existing fallback behavior for invalid or missing regions.

This removes the 2+ second delay for customers in environments where IMDS is slow.

Scenario

ManagedIdentityClient - managed identity

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

Running managed identity app

Relevant code snippets

Expected behavior

No response

Identity provider

Other

Regression

No response

Solution and workarounds

No response

[4gust]

Fixed in #6092