Copilot instructions

1# Code Review Rules
2 
3These rules apply to Copilot code review. Read all rules before commenting.
4 
5## Review scope
6 
7- Only comment on lines added or modified in the PR diff
8- Do not comment on pre-existing code unless the PR directly introduces the issue
9- Do not comment on style, formatting, or indentation
10- Focus exclusively on: bugs, security issues, logic errors, API contract violations
11- If unsure whether something is a bug, do not comment
12- Prefer no comment over a speculative comment
13- Do not re-post a comment already made on an earlier commit in the same PR
14 
15## Repo-specific patterns — do NOT flag these
16 
17These patterns are correct in this repo. Do not suggest changes:
18 
19- `[RunOn]` inherits from `TestMethodAttribute`. Do not flag as missing `[TestMethod]`
20- `Client.AppConfig.X` resolves via parent namespace `Microsoft.Identity`. Do not flag as unresolved namespace
21- `Assert.IsTrue(bool?)` is a valid MSTest overload. Do not flag nullable bool as a type mismatch
22- `Assert.DoesNotContain(substring, value)` — MSTest v4 signature is substring first, value second
23- `ConfigureAwait(false)` is intentional in library code. Do not suggest removal
24 
25## ConcurrentDictionary.GetOrAdd — always use factory delegate
26 
27`GetOrAdd(key, value)` eagerly evaluates the value arg. Flag any call where the second argument is not a delegate/lambda/method group:
28 
29- Bad: `pool.GetOrAdd(key, new ExpensiveObject());`
30- Good: `pool.GetOrAdd(key, _ => new ExpensiveObject());`
31 
32## C# coding standards
33 
34- Use `is null` / `is not null` instead of `== null` / `!= null`
35- No reflection in product code (`/src`). Acceptable in tests
36- Static fields: `s_camelCase` (e.g., `s_knownHosts`)
37- Ordinal string comparisons for protocol values, identifiers, cache keys
38- Validate inputs at method boundaries (fail fast with specific exception types)
39- Do not include secrets/tokens/PII in exception messages or logs
40- Use `nameof` instead of string literals for member names
41 
42## Testing standards
43 
44- MSTest SDK v4 with NSubstitute for mocking
45- Use `// Arrange`, `// Act`, `// Assert` comments
46- Prefer deterministic tests (no timing flakiness)
47 
48## Public API changes
49 
50- Update `PublicAPI.Unshipped.txt` for any public API additions/removals
51- XML doc comments required on all public APIs
52- Maintain backward compatibility
53 
54## MSAL-specific rules
55 
56- Use certificate-based auth over client secrets when possible
57- Use async APIs consistently
58- Keep dependencies minimal and well-justified
59 
60---
61 
62<!-- Everything below this line is for Copilot Chat and Copilot Agent only. -->
63<!-- Copilot code review reads only the first 4,000 characters of this file. -->
64 
65Carefully review all markdown documents in the ../.clinerules folder. Those are your custom instructions.
66 
67---
68 
69# GitHub Copilot Agent Skills (Repository Skills)
70 
71This repository defines **Copilot Agent Skills** under `.github/skills/`.
72 
73## How skills work
74- A **skill** is defined by a folder: `.github/skills/<skill-folder>/`
75- Each skill must contain a file named **`SKILL.md`**
76- `SKILL.md` must start with YAML frontmatter that includes at least:
77  - `name`
78  - `description`
79 
80> Note: Copilot does **not** read `copilot-instructions.md` files inside subfolders.
81> Only `.github/copilot-instructions.md` is treated as the repo-wide instructions file.
82> Skill content must be inside `.github/skills/**/SKILL.md`.
83 
84## How to use skills in Copilot Chat
85- Prefer invoking a relevant skill explicitly when available:
86  - `@<skill-name> ...your question...`
87- If unsure which skill applies, ask:
88  - “What skills are available in this repo?”
89  - “Which skill should I use for this task?”
90 
91## Expectations when using skills
92- Follow the skill’s guidance and patterns exactly (APIs, naming, examples).
93- If code is requested, provide complete, runnable code with required imports.
94- If multiple approaches exist, explain the tradeoffs and recommend one.
95 
96---
97 
98# MSAL.NET Agent Guidance
99 
100## Warning-clean API changes
101- The repo builds with `TreatWarningsAsErrors=true`. When adding `[Obsolete]`, `EditorBrowsable`, or other public API annotations, build both the product project and affected test project(s).
102- If tests intentionally exercise a newly obsolete API, add a narrow warning suppression around that assertion/test instead of suppressing broadly.
103 
104## Downstream compatibility checks
105- Before obsoleting, hiding, or changing request-builder authority APIs, telemetry parameters, or query-parameter/cache-key behavior, check known downstream consumers.
106- Treat soft-obsolete changes as downstream-breaking when consumers build with warnings-as-errors. Adding `[Obsolete]` with `error: false`, `[EditorBrowsable]`, or analyzer-facing warnings can still break `Microsoft.Identity.Web` package-bump PRs.
107- `Microsoft.Identity.Web` is commonly available as a sibling checkout at `D:\source\microsoft-identity-web`; search it for production usages before deciding whether a change is safe.
108- Use targeted searches for the exact public API/member names, for example:
109  - `rg "WithB2CAuthority|AffectedApiName" D:\source\microsoft-identity-web\src`
110  - `rg "Microsoft.Identity.Client" D:\source\microsoft-identity-web\Directory.Packages.props D:\source\microsoft-identity-web\src`
111- If `Microsoft.Identity.Web` uses the affected API, do not obsolete, hide, remove, or change it unless the PR also provides a safe migration plan. Prefer updating Identity.Web first or coordinating a staged change.
112- Mention the Identity.Web impact check in the PR summary, including whether the sibling checkout was present and what API names were searched.
113 
114## Regression tests for cache and pooling changes
115- Regression tests must prove the changed side effect, not only final success or returned object identity.
116- For cache-key changes, assert the cached entry state after each relevant acquisition call, not only after the final call.
117- For pooling/lazy-creation fixes, verify creation counts or factory invocation counts so the test fails against the old eager-allocation implementation.
118 
119---
120 
121# Copilot Instructions for MSAL.NET mTLS Proof-of-Possession
122 
123## 🚀 Quick Start: Discover Available Skills
124 
125**Ask these questions in VS Code Copilot Chat to discover and explore all available skills:**
126 
127What can you tell me about mTLS PoP in MSAL.NET?
128 
129Code
130 
131Copilot will automatically reference and describe:
132- `@msal-mtls-pop-guidance` - Foundational concepts
133- `@msal-mtls-pop-vanilla` - Direct token acquisition
134- `@msal-mtls-pop-fic-two-leg` - Token exchange patterns
135- `@msal-auth-code-flow` - Authorization Code Flow
136- `@msal-client-credentials` - Client Credentials Flow
137- `@msal-obo-flow` - On-Behalf-Of Flow
138 
139---
140 
141## 📚 Available Skills Overview
142 
143This repository contains **six GitHub Agent Skills** for MSAL.NET authentication:
144 
145| Skill | Purpose | Best For |
146|-------|---------|----------|
147| **@msal-mtls-pop-guidance** | Foundational concepts, terminology, decision frameworks | Learning the fundamentals, comparing approaches |
148| **@msal-mtls-pop-vanilla** | Direct single-step token acquisition with complete code | Quick implementation with MSI or Confidential Client |
149| **@msal-mtls-pop-fic-two-leg** | Two-step token exchange patterns | Complex scenarios requiring token exchange |
150| **@msal-auth-code-flow** | Authorization Code Flow for web apps | User sign-in with server-side backend |
151| **@msal-client-credentials** | Client Credentials Flow for daemons | Service-to-service, no user context |
152| **@msal-obo-flow** | On-Behalf-Of Flow for multi-tier APIs | Propagating user identity through API chain |
153 
154---
155 
156## 🔍 Discovery Prompts: Explore Each Skill
157 
158### **Discover Skill 1: Guidance & Concepts**
159@msal-mtls-pop-guidance What is mTLS PoP and why do I need it? @msal-mtls-pop-guidance What are the main concepts I need to understand? @msal-mtls-pop-guidance Explain vanilla vs FIC two-leg flows @msal-mtls-pop-guidance What are the MSI limitations? @msal-mtls-pop-guidance Which approach should I use for my scenario? @msal-mtls-pop-guidance What version requirements exist?
160 
161Code
162 
163### **Discover Skill 2: Vanilla (Direct) Token Acquisition**
164@msal-mtls-pop-vanilla What code examples do you have for mTLS PoP? @msal-mtls-pop-vanilla Show me System-Assigned Managed Identity (SAMI) example @msal-mtls-pop-vanilla Show me User-Assigned Managed Identity (UAMI) example @msal-mtls-pop-vanilla Show me Confidential Client with certificate example @msal-mtls-pop-vanilla How do I configure the HttpClient for mTLS? @msal-mtls-pop-vanilla What helper classes are available? @msal-mtls-pop-vanilla How do I handle certificate binding safely?
165 
166Code
167 
168### **Discover Skill 3: FIC Two-Leg Token Exchange**
169@msal-mtls-pop-fic-two-leg What is the two-leg token exchange pattern? @msal-mtls-pop-fic-two-leg Show me a complete end-to-end example @msal-mtls-pop-fic-two-leg How does certificate binding work between legs? @msal-mtls-pop-fic-two-leg What's the difference between Leg 1 and Leg 2? @msal-mtls-pop-fic-two-leg What helper classes are available? @msal-mtls-pop-fic-two-leg Why is MSI limited to Leg 1 only?
170 
171Code
172 
173---
174 
175## 🎯 Comprehensive Question Bank
176 
177Use these questions to explore the full depth of available skills:
178 
179### **Foundation & Architecture Questions**
180 
181@msal-mtls-pop-guidance What is mTLS Proof-of-Possession (PoP)? @msal-mtls-pop-guidance Why would I use mTLS PoP instead of bearer tokens? @msal-mtls-pop-guidance What are the security benefits of mTLS PoP? @msal-mtls-pop-guidance What MSAL.NET version do I need? @msal-mtls-pop-guidance What namespaces do I need to import? @msal-mtls-pop-guidance What are the three UAMI identifier types? @msal-mtls-pop-guidance Explain the difference between SAMI and UAMI @msal-mtls-pop-guidance What's the api://AzureADTokenExchange resource?
182 
183Code
184 
185### **Vanilla Flow - Quick Implementation**
186 
187@msal-mtls-pop-vanilla How do I get started with mTLS PoP in 5 minutes? @msal-mtls-pop-vanilla Show me the simplest working example @msal-mtls-pop-vanilla What's the bare minimum code I need? @msal-mtls-pop-vanilla How do I test my implementation?
188 
189Code
190 
191### **Vanilla Flow - System-Assigned Managed Identity (SAMI)**
192 
193@msal-mtls-pop-vanilla What is SAMI and when should I use it? @msal-mtls-pop-vanilla Show me how to create a ManagedIdentityApplicationBuilder for SAMI @msal-mtls-pop-vanilla What's the complete code for SAMI mTLS PoP? @msal-mtls-pop-vanilla How do I acquire a token for System-Assigned Managed Identity? @msal-mtls-pop-vanilla Show me the SAMI example with Credential Guard attestation @msal-mtls-pop-vanilla How do I use the binding certificate from SAMI token? @msal-mtls-pop-vanilla What errors might I encounter with SAMI and how do I fix them?
194 
195Code
196 
197### **Vanilla Flow - User-Assigned Managed Identity (UAMI)**
198 
199@msal-mtls-pop-vanilla What is UAMI and when should I use it? @msal-mtls-pop-vanilla Show me the three ways to identify a UAMI @msal-mtls-pop-vanilla How do I use UAMI by ClientId? @msal-mtls-pop-vanilla How do I use UAMI by ResourceId? @msal-mtls-pop-vanilla How do I use UAMI by ObjectId? @msal-mtls-pop-vanilla What's the complete code for UAMI mTLS PoP? @msal-mtls-pop-vanilla Show me how to handle different UAMI identifier types @msal-mtls-pop-vanilla How do I know which UAMI identifier to use?
200 
201Code
202 
203### **Vanilla Flow - Confidential Client**
204 
205@msal-mtls-pop-vanilla What is Confidential Client and when should I use it? @msal-mtls-pop-vanilla How do I configure a Confidential Client with certificate (SNI)? @msal-mtls-pop-vanilla Show me the complete Confidential Client mTLS PoP example @msal-mtls-pop-vanilla How do I load a certificate for mTLS PoP? @msal-mtls-pop-vanilla What's the difference between SAMI, UAMI, and Confidential Client? @msal-mtls-pop-vanilla When should I use Confidential Client instead of MSI?
206 
207Code
208 
209### **Certificate & HTTP Configuration**
210 
211@msal-mtls-pop-vanilla How do I get the binding certificate from the token result? @msal-mtls-pop-vanilla What is a binding certificate and why do I need it? @msal-mtls-pop-vanilla How do I add the certificate to HttpClientHandler? @msal-mtls-pop-vanilla What are null-safe certificate handling best practices? @msal-mtls-pop-vanilla How do I avoid compiler warnings with certificate binding? @msal-mtls-pop-vanilla Show me the complete HttpClient setup for mTLS PoP @msal-mtls-pop-vanilla What's the correct pattern for checking if certificate is null? @msal-mtls-pop-vanilla How do I dispose of HttpClient properly?
212 
213Code
214 
215### **Authorization & Endpoints**
216 
217@msal-mtls-pop-vanilla What's the correct Authorization header for mTLS PoP? @msal-mtls-pop-vanilla Why is the "mtls_pop" scheme important? @msal-mtls-pop-vanilla What's the mTLS-specific endpoint for Microsoft Graph? @msal-mtls-pop-vanilla Why use https://mtlstb.graph.microsoft.com instead of regular endpoint? @msal-mtls-pop-vanilla Should I use /applications or /me for service-to-service calls? @msal-mtls-pop-vanilla How do I call Microsoft Graph with mTLS PoP tokens? @msal-mtls-pop-vanilla What other endpoints support mTLS PoP? @msal-mtls-pop-vanilla How do I verify my endpoint is correct?
218 
219Code
220 
221### **Production Patterns & Best Practices**
222 
223@msal-mtls-pop-vanilla What production-grade patterns should I follow? @msal-mtls-pop-vanilla Why should I use ConfigureAwait(false)? @msal-mtls-pop-vanilla How do I add CancellationToken support? @msal-mtls-pop-vanilla How do I implement IDisposable correctly? @msal-mtls-pop-vanilla What validation should I do with ArgumentNullException? @msal-mtls-pop-vanilla Show me the complete production helper class pattern @msal-mtls-pop-vanilla How do I add proper error handling? @msal-mtls-pop-vanilla What logging should I add for debugging?
224 
225Code
226 
227### **Credential Guard & Attestation**
228 
229@msal-mtls-pop-vanilla What is Credential Guard attestation? @msal-mtls-pop-vanilla How do I enable .WithAttestationSupport()? @msal-mtls-pop-vanilla Why should I use attestation support? @msal-mtls-pop-vanilla What's the security benefit of attestation?
230 
231Code
232 
233### **FIC Two-Leg Flow - Concepts**
234 
235@msal-mtls-pop-fic-two-leg What is FIC (Federated Identity Credentials)? @msal-mtls-pop-fic-two-leg What is a two-leg token exchange pattern? @msal-mtls-pop-fic-two-leg When should I use FIC two-leg instead of vanilla? @msal-mtls-pop-fic-two-leg What are the four valid FIC scenario combinations? @msal-mtls-pop-fic-two-leg Show me the FIC matrix (MSI/ConfApp × Bearer/PoP) @msal-mtls-pop-fic-two-leg What's the difference between vanilla and FIC flows? @msal-mtls-pop-fic-two-leg Why is FIC two-leg more complex?
236 
237Code
238 
239### **FIC Two-Leg Flow - Leg 1 (Acquisition)**
240 
241@msal-mtls-pop-fic-two-leg What happens in Leg 1? @msal-mtls-pop-fic-two-leg How do I acquire a Leg 1 token? @msal-mtls-pop-fic-two-leg Can I use MSI for Leg 1? @msal-mtls-pop-fic-two-leg Can I use Confidential Client for Leg 1? @msal-mtls-pop-fic-two-leg What resource should I request in Leg 1? @msal-mtls-pop-fic-two-leg Show me complete MSI Leg 1 code @msal-mtls-pop-fic-two-leg Show me complete Confidential Client Leg 1 code @msal-mtls-pop-fic-two-leg What's the api://AzureADTokenExchange resource? @msal-mtls-pop-fic-two-leg How do I extract the binding certificate from Leg 1 result?
242 
243Code
244 
245### **FIC Two-Leg Flow - Certificate Binding**
246 
247@msal-mtls-pop-fic-two-leg What is certificate binding between legs? @msal-mtls-pop-fic-two-leg Why must I pass TokenBindingCertificate to Leg 2? @msal-mtls-pop-fic-two-leg How do I include the certificate in Leg 2? @msal-mtls-pop-fic-two-leg What happens if I forget the certificate binding? @msal-mtls-pop-fic-two-leg How do I extract and pass the certificate safely? @msal-mtls-pop-fic-two-leg Is certificate binding required in all scenarios? @msal-mtls-pop-fic-two-leg Show me the complete certificate binding pattern
248 
249Code
250 
251### **FIC Two-Leg Flow - Leg 2 (Exchange)**
252 
253@msal-mtls-pop-fic-two-leg What happens in Leg 2? @msal-mtls-pop-fic-two-leg Why can only Confidential Client do Leg 2? @msal-mtls-pop-fic-two-leg Why can't MSI perform Leg 2? @msal-mtls-pop-fic-two-leg How do I acquire a Leg 2 token? @msal-mtls-pop-fic-two-leg What does .WithAzureRegion() do? @msal-mtls-pop-fic-two-leg Why is region specification important in Leg 2? @msal-mtls-pop-fic-two-leg Show me complete Leg 2 Confidential Client code @msal-mtls-pop-fic-two-leg How do I use ClientSignedAssertion in Leg 2? @msal-mtls-pop-fic-two-leg Can I use bearer tokens in Leg 2? @msal-mtls-pop-fic-two-leg Can I use mTLS PoP tokens in Leg 2?
254 
255Code
256 
257### **FIC Two-Leg Flow - Complete Scenarios**
258 
259@msal-mtls-pop-fic-two-leg Show me MSI Leg 1 → ConfApp Leg 2 with Bearer token @msal-mtls-pop-fic-two-leg Show me MSI Leg 1 → ConfApp Leg 2 with mTLS PoP token @msal-mtls-pop-fic-two-leg Show me ConfApp Leg 1 → ConfApp Leg 2 with Bearer token @msal-mtls-pop-fic-two-leg Show me ConfApp Leg 1 → ConfApp Leg 2 with mTLS PoP token @msal-mtls-pop-fic-two-leg Show me the complete end-to-end FIC flow @msal-mtls-pop-fic-two-leg How do I integrate Leg 1 and Leg 2 together? @msal-mtls-pop-fic-two-leg What's the complete flow from start to API call?
260 
261Code
262 
263### **FIC Two-Leg Flow - Helper Classes**
264 
265@msal-mtls-pop-fic-two-leg What helper classes are available? @msal-mtls-pop-fic-two-leg Show me FicLeg1Acquirer usage @msal-mtls-pop-fic-two-leg Show me FicAssertionProvider usage @msal-mtls-pop-fic-two-leg Show me FicLeg2Exchanger usage @msal-mtls-pop-fic-two-leg Show me ResourceCaller usage @msal-mtls-pop-fic-two-leg How do these helper classes work together? @msal-mtls-pop-fic-two-leg Can I use these classes as-is or do I need to modify them?
266 
267Code
268 
269### **Error Handling & Troubleshooting**
270 
271@msal-mtls-pop-vanilla What errors might I encounter? @msal-mtls-pop-vanilla How do I debug certificate binding issues? @msal-mtls-pop-vanilla What does "certificate not found" error mean? @msal-mtls-pop-vanilla How do I verify my token is actually a PoP token? @msal-mtls-pop-vanilla What should I check if my API call fails with mTLS PoP? @msal-mtls-pop-fic-two-leg What are common FIC two-leg errors? @msal-mtls-pop-fic-two-leg What does "certificate binding mismatch" mean? @msal-mtls-pop-fic-two-leg How do I troubleshoot token exchange failures?
272 
273Code
274 
275### **Testing & Validation**
276 
277@msal-mtls-pop-vanilla How do I test my mTLS PoP implementation? @msal-mtls-pop-vanilla Where are the integration tests? @msal-mtls-pop-vanilla Can I run the tests locally? @msal-mtls-pop-vanilla How do I verify my certificate binding is working? @msal-mtls-pop-vanilla What test scenarios should I cover? @msal-mtls-pop-fic-two-leg How do I test FIC two-leg flows? @msal-mtls-pop-fic-two-leg Are there E2E test examples?
278 
279Code
280 
281---
282 
283## 📖 Complete Reference Guide
284 
285### Key Concepts
286 
287**mTLS Proof-of-Possession (PoP)**
288- Token bound to a specific client certificate
289- More secure than bearer tokens
290- Requires certificate in HTTP request
291- Cannot be replayed without the certificate
292 
293**Vanilla Flow**
294- Single-step direct token acquisition
295- MSI (SAMI/UAMI) or Confidential Client
296- Fastest path to mTLS PoP tokens
297- Recommended for most use cases
298 
299**FIC Two-Leg Flow**
300- First leg: Get token for `api://AzureADTokenExchange`
301- Second leg: Exchange for actual resource access
302- MSI can do Leg 1 only
303- Confidential Client required for Leg 2
304- Certificate binding between legs is critical
305 
306**Version Requirements**
307- MSAL.NET 4.82.1+
308- Namespaces: `Microsoft.Identity.Client.AppConfig`, `Microsoft.Identity.Client.KeyAttestation`
309 
310### Capability Comparison
311 
312| Feature | SAMI | UAMI | ConfApp |
313|---------|------|------|---------|
314| Vanilla mTLS PoP | ✅ | ✅ | ✅ |
315| FIC Leg 1 | ✅ | ✅ | ✅ |
316| FIC Leg 2 | ❌ | ❌ | ✅ |
317| Custom Certificate | ❌ | ❌ | ✅ |
318| Region Specification | ❌ | ❌ | ✅ |
319 
320### Endpoints
321 
322- **mTLS Graph**: `https://mtlstb.graph.microsoft.com`
323- **Token Exchange**: `api://AzureADTokenExchange`
324- **Token Scheme**: `mtls_pop` (authorization header)
325 
326---
327 
328## 🎓 Learning Paths
329 
330### **Path 1: New to mTLS PoP (30 minutes)**
3311. `@msal-mtls-pop-guidance What is mTLS PoP?`
3322. `@msal-mtls-pop-guidance Explain vanilla vs FIC flows`
3333. `@msal-mtls-pop-vanilla How do I get started in 5 minutes?`
3344. `@msal-mtls-pop-vanilla Show me SAMI example`
3355. Implement SAMI example locally
336 
337### **Path 2: UAMI Implementation (20 minutes)**
3381. `@msal-mtls-pop-guidance What are the three UAMI identifier types?`
3392. `@msal-mtls-pop-vanilla Show me UAMI by ClientId example`
3403. `@msal-mtls-pop-vanilla Show me UAMI by ResourceId example`
3414. `@msal-mtls-pop-vanilla Show me UAMI by ObjectId example`
3425. Choose and implement one identifier type
343 
344### **Path 3: Confidential Client Setup (25 minutes)**
3451. `@msal-mtls-pop-vanilla What is Confidential Client?`
3462. `@msal-mtls-pop-vanilla How do I load a certificate?`
3473. `@msal-mtls-pop-vanilla Show me complete ConfApp example`
3484. `@msal-mtls-pop-vanilla How do I handle certificate safely?`
3495. Implement Confidential Client locally
350 
351### **Path 4: FIC Two-Leg Deep Dive (45 minutes)**
3521. `@msal-mtls-pop-fic-two-leg What is FIC two-leg?`
3532. `@msal-mtls-pop-fic-two-leg Show me the four scenario combinations`
3543. `@msal-mtls-pop-fic-two-leg Show me MSI Leg 1 → ConfApp Leg 2`
3554. `@msal-mtls-pop-fic-two-leg How does certificate binding work?`
3565. `@msal-mtls-pop-fic-two-leg Show complete end-to-end flow`
3576. Implement two-leg flow locally
358 
359### **Path 5: Production Ready (60 minutes)**
3601. Complete one of the above paths
3612. `@msal-mtls-pop-vanilla What production patterns should I follow?`
3623. `@msal-mtls-pop-vanilla How do I add error handling?`
3634. `@msal-mtls-pop-vanilla How do I add proper logging?`
3645. Refactor your implementation with production patterns
3656. Add comprehensive error handling
366 
367---
368 
369## 🚀 Pro Tips
370 
371✅ **Start with `@msal-mtls-pop-guidance`** if you're new
372✅ **Use discovery prompts** from the "Discovery Prompts" section to explore
373✅ **Follow a learning path** based on your use case
374✅ **Enable `.WithAttestationSupport()`** for Credential Guard
375✅ **Always check null** before adding certificates to HttpClientHandler
376✅ **Use `ConfigureAwait(false)`** in production code
377✅ **Add `CancellationToken`** support for better control
378✅ **Implement `IDisposable`** correctly for HttpClient
379✅ **Test locally first** before deploying to Azure
380 
381---
382 
383## 💬 Quick Chat Commands
384 
385Copy and paste these directly into VS Code Copilot Chat:
386 
387@msal-mtls-pop-guidance What can you tell me about mTLS PoP?
388 
389@msal-mtls-pop-vanilla Show me how to get started in 5 minutes
390 
391@msal-mtls-pop-fic-two-leg Show me the complete end-to-end flow
392 
393@workspace How do I choose between vanilla and FIC flows?
394 
395Code
396 
397---
398 
399## 📚 Available Helper Classes
400 
401### Vanilla Flow
402- `VanillaMsiMtlsPop.cs` - MSI token acquisition wrapper
403- `MtlsPopTokenAcquirer.cs` - Generic token acquisition
404- `ResourceCaller.cs` - HTTP client configuration and API calls
405 
406### FIC Two-Leg Flow
407- `FicLeg1Acquirer.cs` - Leg 1 token acquisition
408- `FicAssertionProvider.cs` - Client assertion generation
409- `FicLeg2Exchanger.cs` - Leg 2 token exchange
410- `ResourceCaller.cs` - HTTP client configuration and API calls
411 
412---
413 
414## 🔗 Related Resources
415 
416- **PR #5733**: This implementation
417- **Integration Tests**: `ClientCredentialsMtlsPopTests.cs`
418- **MSAL.NET Docs**: Official documentation
419- **Credential Guard**: Windows security feature
420- **mTLS Spec**: RFC 8705 OAUTH 2.0 Mutual-TLS Client Authentication
421 
422---
423 
424## ❓ Still Have Questions?
425 
426Use the **Question Bank** above to discover answers. Most questions are already covered in one of the three skills!
427 
428**Happy exploring!** 🚀
429