[Radhika Gupta (rads-1996)]

Description

• Define routing-only Microsoft Entra audience selection and reject unsupported custom authentication policies.
• Enforce routed redirect trust boundaries and preserve accepted destination paths.
• Document shared credential/header risks and unsupported authentication configurations.
• Preserve regular single-endpoint behavior; add regression coverage.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[azure-sdk-automation]

The sdk-api-review-ready label cannot create a review PR for this working PR because its branch is in a fork repository. Prefer a working branch in the registered upstream repository, or reach out to the ARH maintainers for help. Fork reviews are supported through the Azure SDK CLI (azsdk apireview create), but the fork requires its own ARH registration and the review PR is created in the fork rather than the upstream repository.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

Changes to token-audience selection and credential-bearing redirect trust boundaries require human security review under repository guidance before approval.

No open issues 🎉

What changed in this PR

This PR isolates Microsoft Entra authentication for multi-endpoint exports in the Azure Monitor OpenTelemetry exporter while preserving single-endpoint behavior.

Changes:

• Adds routing-specific audience configuration and rejects custom authentication policies in routing mode.
• Restricts routed redirects to trusted destinations and preserves accepted redirect paths.
• Documents shared credential risks and adds regression coverage for authentication and redirects.

File	Description
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​tests/​test_base_exporter.py	Tests custom authentication policy handling with and without routing.
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​tests/​logs/​test_logs.py	Covers audience selection, credential isolation, redirect boundaries, and legacy behavior.
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​README.md	Documents routed authentication setup, restrictions, and credential risks.
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​CHANGELOG.md	Records authentication isolation and redirect fixes.
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​azure/​monitor/​opentelemetry/​exporter/​export/​_base.py	Integrates routing-specific audiences, policy validation, and trusted redirect handling.
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​azure/​monitor/​opentelemetry/​exporter/​_routing.py	Adds redirect trust validation and complete redirect URL preservation.
sdk/​monitor/​azure-monitor-opentelemetry-exporter/​azure/​monitor/​opentelemetry/​exporter/​_constants.py	Defines the routed audience environment variable.

_{Review effort: Balanced}