Adding support for cloud-specific authentication token.

src/azure-cli/azure/cli/command_modules/appconfig/_credential.py

@@ -0,0 +1,17 @@
+from azure.core.credentials import TokenCredential
+from azure.cli.core.auth.util import resource_to_scopes
+
+# Enable passing in custom token audience that takes precedence over SDK's hardcoded audience.
+# Users can configure an audience based on their cloud.
+class AppConfigurationCliCredential(TokenCredential):
+
+    def __init__(self, credential: TokenCredential, resource: str = None):
+        self._impl = credential
+        self._resource = resource
+
+    def get_token(self, *scopes, **kwargs):
+
+        if self._resource is not None:
+            scopes = resource_to_scopes(self._resource)
+
+        return self._impl.get_token(*scopes, **kwargs)

src/azure-cli/azure/cli/command_modules/appconfig/_utils.py

@@ -177,10 +177,18 @@ def get_appconfig_data_client(cmd, name, connection_string, auth_mode, endpoint)
                 raise CLIError(str(ex) + "\nYou may be able to resolve this issue by providing App Configuration endpoint instead of name.")
 
         from azure.cli.core._profile import Profile
+        from azure.cli.core.cloud import get_active_cloud
+        from ._credential import AppConfigurationCliCredential
         profile = Profile(cli_ctx=cmd.cli_ctx)
         cred, _, _ = profile.get_login_credentials()
+
+        current_cloud = get_active_cloud(cmd.cli_ctx)
+        token_audience = None
+        if hasattr(current_cloud.endpoints, "appconfig_auth_token_audience"):
+            token_audience = current_cloud.endpoints.appconfig_auth_token_audience
+
         try:
-            azconfig_client = AzureAppConfigurationClient(credential=cred,
+            azconfig_client = AzureAppConfigurationClient(credential=AppConfigurationCliCredential(cred._credential, token_audience),
                                                           base_url=endpoint,
                                                           user_agent=HttpHeaders.USER_AGENT)
         except (ValueError, TypeError) as ex: