[Parinith (parinith-web)]

Fixes #3788

Description

AzureAuth accepted a tenant_id argument and stored it as self._tenant_id, but never used it, so tokens were always requested for the default tenant. This is inconsistent with get_access_token_from_azure_cli, which does honor tenant_id.

DefaultAzureCredential rejects a tenant_id constructor argument (it raises TypeError), but its get_token method accepts tenant_id and forwards it to each credential in the chain. AzureAuth._set_default_token now passes tenant_id to get_token when it is non-empty. When tenant_id is empty (the default), the call is unchanged, so existing behavior is not affected. The tenant_id docstring is also clarified.

This is not a breaking change.

Tests and Documentation

• Added test_get_token_forwards_tenant_id and test_get_token_omits_tenant_id_when_not_set in tests/unit/auth/test_azure_auth.py. The first fails on the old code and passes with the fix.
• pytest tests/unit/auth/test_azure_auth.py passes locally (36 passed, 4 skipped).
• Verified with mocks only, not against a real multi-tenant Azure account.
• No documentation pages or notebooks changed, so JupyText was not needed.

[Copilot]

🟢 Approval recommended

The Azure tenant-ID forwarding change has no active review issues.

No open issues 🎉

What changed in this PR

Fixes #3788 by making AzureAuth forward a non-empty tenant_id when requesting an Azure access token, while preserving default behavior when no tenant is specified.

Changes:

• Passes the configured tenant ID to DefaultAzureCredential.get_token.
• Clarifies the tenant_id parameter documentation.
• Adds mock-based tests for tenant forwarding and omission.

File	Description
tests/​unit/​auth/​test_azure_auth.py	Adds tests for token requests with and without a tenant ID.
pyrit/​auth/​azure_auth.py	Forwards the tenant ID during token acquisition and clarifies its documented behavior.

_{Review effort: Balanced}