Get-AccessToken's Breaking Change

[msJinLei]

Description

Change the default output access token of Get-AzAccessToken from plain text to SecureString.

If AZUREPS_OUTPUT_PLAINTEXT_AZACCESSTOKEN is set to true, returns plain text token. The feature is to avoid breaking change in Az.Functions

Mandatory Checklist

• Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

[Copilot]

Pull Request Overview

This PR updates the Get-AzAccessToken cmdlet to change its default output type from a plain text token (PSAccessToken) to a secure string token (PSSecureAccessToken) while introducing an environment variable to allow a plain text override for backward compatibility.

• Updated the breaking change record in BreakingChangeIssues.csv.
• Modified cmdlet output logic in GetAzureRmAccessToken.cs to conditionally return a plain text token based on an environment variable.
• Updated documentation, changelog, and tests to reflect the change.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/StaticAnalysis/Exceptions/Az.Accounts/BreakingChangeIssues.csv	Added entry for Get-AzAccessToken output type change.
src/Accounts/Authentication/Constants.cs	Introduced a new constant for the plain text output override.
src/Accounts/Accounts/help/Get-AzAccessToken.md	Revised help text to reflect that the output is now secure by default.
src/Accounts/Accounts/Token/GetAzureRmAccessToken.cs	Changed logic to return a secure token unless overridden by an environment variable.
src/Accounts/Accounts/ChangeLog.md	Documented the breaking change in the changelog.
src/Accounts/Accounts.Test/AccessTokenCmdletTest.cs	Updated tests for plain text output when the environment variable is set.

Comments suppressed due to low confidence (1)

src/Accounts/Accounts.Test/AccessTokenCmdletTest.cs:88

• The test covers the plain text output branch but does not verify the default secure token branch. Consider adding a test case for when the environment variable is unset to ensure the cmdlet returns a PSSecureAccessToken as expected.

Environment.SetEnvironmentVariable(Constants.AzPsOutputPlainTextAccessToken, bool.TrueString);

[isra-fel]

Overall it looks good w minor coomments

[Copilot]

Pull Request Overview

This PR implements a breaking change for Get-AzAccessToken by changing its default output from plain text to SecureString while retaining an option (via an environment variable) to return plain text if necessary.

• Updated breaking change records in the CSV file.
• Added a new constant for the environment variable to control output type.
• Modified the cmdlet implementation to conditionally output plain text or SecureString and updated documentation and tests accordingly.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/StaticAnalysis/Exceptions/Az.Accounts/BreakingChangeIssues.csv	Updated breaking change record for Get-AzAccessToken.
src/Accounts/Authentication/Constants.cs	Added constant for the environment variable controlling output type.
src/Accounts/Accounts/help/Get-AzAccessToken.md	Revised help documentation to reflect the breaking change and new parameter behavior.
src/Accounts/Accounts/Token/GetAzureRmAccessToken.cs	Adjusted cmdlet implementation to output SecureString by default with a plain text fallback.
src/Accounts/Accounts/ChangeLog.md	Noted the breaking change in the changelog.
src/Accounts/Accounts.Test/AccessTokenCmdletTest.cs	Added test coverage to verify plain text output when the environment variable is set.