dotnet · dotnet-maestro · Oct 1, 2026 · Oct 1, 2026
diff --git a/eng/Version.Details.props b/eng/Version.Details.props
@@ -6,8 +6,8 @@ This file should be imported by eng/Versions.props
 <Project>
   <PropertyGroup>
     <!-- dotnet-dotnet dependencies -->
-    <MicrosoftDotNetArcadeSdkPackageVersion>12.0.0-beta.26461.114</MicrosoftDotNetArcadeSdkPackageVersion>
-    <SystemCommandLinePackageVersion>4.0.0-alpha.1.26461.114</SystemCommandLinePackageVersion>
+    <MicrosoftDotNetArcadeSdkPackageVersion>12.0.0-beta.26480.102</MicrosoftDotNetArcadeSdkPackageVersion>
+    <SystemCommandLinePackageVersion>4.0.0-alpha.1.26480.102</SystemCommandLinePackageVersion>
   </PropertyGroup>
   <!--Property group for alternate package version names-->
   <PropertyGroup>

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
@@ -1,16 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Dependencies>
-  <Source Mapping="scenario-tests" Uri="https://github.com/dotnet/dotnet" Sha="7cfa7a8277e6c63b36482018162a9c2dd8922a96" BarId="331745" />
+  <Source Mapping="scenario-tests" Uri="https://github.com/dotnet/dotnet" Sha="a2f466a2ccc2851d3c665f764a36b0cb59dd18b8" BarId="334576" />
   <ProductDependencies>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="System.CommandLine" Version="4.0.0-alpha.1.26461.114">
+    <Dependency Name="System.CommandLine" Version="4.0.0-alpha.1.26480.102">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>7cfa7a8277e6c63b36482018162a9c2dd8922a96</Sha>
+      <Sha>a2f466a2ccc2851d3c665f764a36b0cb59dd18b8</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="12.0.0-beta.26461.114">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="12.0.0-beta.26480.102">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>7cfa7a8277e6c63b36482018162a9c2dd8922a96</Sha>
+      <Sha>a2f466a2ccc2851d3c665f764a36b0cb59dd18b8</Sha>
     </Dependency>
   </ToolsetDependencies>
 </Dependencies>
diff --git a/eng/common/build.ps1 b/eng/common/build.ps1
@@ -8,7 +8,7 @@ Param(
   [bool] $warnAsError = $true,
   [string] $warnNotAsError = '',
   [bool] $nodeReuse = $true,
-  [bool][Alias('mt')]$msbuildMultiThreaded = $false,
+  [bool][Alias('mt')]$msbuildMultiThreaded = $true,
   [switch] $buildCheck = $false,
   [switch][Alias('r')]$restore,
   [switch] $deployDeps,
@@ -181,6 +181,10 @@ try {
     if (-not $PSBoundParameters.ContainsKey('nodeReuse')) {
       $nodeReuse = $false
     }
+    # MSBuild's multi-threaded mode isn't run on CI unless it was explicitly requested via -msbuildMultiThreaded.
+    if (-not $PSBoundParameters.ContainsKey('msbuildMultiThreaded')) {
+      $msbuildMultiThreaded = $false
+    }
   }
 
   if (-not [string]::IsNullOrEmpty($binaryLogName)) {

diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml
@@ -52,11 +52,23 @@ parameters:
   type: string
   default: https://helix.dot.net/
 
-# Helix API access token forwarded to the tool via the HELIX_ACCESSTOKEN environment variable.
+# Helix API access token forwarded via HELIX_ACCESSTOKEN. Not forwarded when
+# useEntraAuthentication is true.
 - name: helixAccessToken
   type: string
   default: ''
 
+# Use a refreshable Entra credential instead of a PAT or anonymous access.
+- name: useEntraAuthentication
+  type: boolean
+  default: false
+
+# Workload identity federation service connection name authorized for Helix. Required when
+# useEntraAuthentication is true.
+- name: azureSubscription
+  type: string
+  default: ''
+
 # Polling interval in seconds (--polling-interval-seconds).
 - name: pollingIntervalSeconds
   type: number
@@ -82,13 +94,12 @@ parameters:
   type: boolean
   default: false
 
-# When true, test results are reported to Azure DevOps using the fully qualified test name
-# (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as
-# well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display;
-# primarily useful for frameworks like MSTest whose display name is only the method name.
+# When true (the default), test results are reported to Azure DevOps using the fully qualified test
+# name (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as
+# well (--use-fully-qualified-test-name). Set to false to preserve framework-provided display names.
 - name: useFullyQualifiedTestName
   type: boolean
-  default: false
+  default: true
 
 # Controls per-test output attachments. Defaults to Failed.
 - name: testResultAttachmentMode
@@ -124,6 +135,20 @@ jobs:
   displayName: Monitor Helix Jobs
   timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
   continueOnError: ${{ parameters.continueOnError }}
+  variables:
+    HELIX_MONITOR_BASE_URI: ${{ parameters.helixBaseUri }}
+    HELIX_MONITOR_USE_ENTRA_AUTHENTICATION: ${{ parameters.useEntraAuthentication }}
+    HELIX_MONITOR_POLLING_INTERVAL_SECONDS: ${{ parameters.pollingIntervalSeconds }}
+    HELIX_MONITOR_FAIL_ON_FAILED_TESTS: ${{ parameters.failWorkItemsWithFailedTests }}
+    HELIX_MONITOR_ALLOW_NO_HELIX_JOBS: ${{ parameters.allowNoHelixJobs }}
+    HELIX_MONITOR_USE_FULLY_QUALIFIED_TEST_NAME: ${{ parameters.useFullyQualifiedTestName }}
+    HELIX_MONITOR_TIMEOUT_IN_MINUTES: ${{ parameters.timeoutInMinutes }}
+    HELIX_MONITOR_TEST_RESULT_UPLOAD_PARALLELISM: ${{ parameters.testResultUploadParallelism }}
+    HELIX_MONITOR_ORGANIZATION: ${{ parameters.organization }}
+    HELIX_MONITOR_REPOSITORY: ${{ parameters.repository }}
+    HELIX_MONITOR_TEST_RESULT_ATTACHMENT_MODE: ${{ parameters.testResultAttachmentMode }}
+    HELIX_MONITOR_TOOL_NUPKG_ARTIFACT_NAME: ${{ parameters.toolNupkgArtifactName }}
+    HELIX_MONITOR_TOOL_COMMAND: ${{ parameters.toolCommand }}
   ${{ if ne(length(parameters.dependsOn), 0) }}:
     dependsOn: ${{ parameters.dependsOn }}
   ${{ if ne(parameters.condition, '') }}:
@@ -141,6 +166,10 @@ jobs:
   - checkout: self
     fetchDepth: 1
 
+  - ${{ if and(eq(parameters.useEntraAuthentication, true), eq(parameters.azureSubscription, '')) }}:
+    - pwsh: throw "azureSubscription must be set when useEntraAuthentication is true."
+      displayName: Validate Helix Entra authentication
+
   - ${{ if ne(parameters.toolNupkgArtifactName, '') }}:
     - task: DownloadPipelineArtifact@2
       displayName: Download Helix Job Monitor artifact
@@ -209,70 +238,26 @@ jobs:
     - bash: ./eng/common/dotnet.sh tool restore
       displayName: Restore Helix Job Monitor
 
-  - bash: |
-      set -euo pipefail
-
-      toolArgs=(
-        --helix-base-uri              '${{ parameters.helixBaseUri }}'
-        --polling-interval-seconds    '${{ parameters.pollingIntervalSeconds }}'
-        --fail-on-failed-tests        '${{ parameters.failWorkItemsWithFailedTests }}'
-        --allow-no-helix-jobs         '${{ parameters.allowNoHelixJobs }}'
-        --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}'
-        --max-wait-minutes            "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully.
-        --stage-name                  '$(System.StageName)'
-        --stage-attempt               '$(System.StageAttempt)'
-        --job-attempt                 '$(System.JobAttempt)'
-        --test-result-upload-parallelism '${{ parameters.testResultUploadParallelism }}'
-      )
-
-      organization='${{ parameters.organization }}'
-      repository='${{ parameters.repository }}'
-      testResultAttachmentMode='${{ parameters.testResultAttachmentMode }}'
-
-      # Fall back to Azure DevOps-provided environment variables when the caller did not
-      # supply organization / repository explicitly. BUILD_REPOSITORY_NAME is typically
-      # 'owner/repo' for GitHub-backed builds and 'owner-repo' for internal builds.
-      if [ -z "$organization" ] || [ -z "$repository" ]; then
-        buildRepoName="${BUILD_REPOSITORY_NAME:-}"
-        if [ -n "$buildRepoName" ] && [[ "$buildRepoName" == */* ]]; then
-          repoOwner="${buildRepoName%%/*}"
-          repoName="${buildRepoName#*/}"
-        elif [ -n "$buildRepoName" ] && [[ "$buildRepoName" == *-* ]]; then
-          repoOwner="${buildRepoName%%-*}"
-          repoName="${buildRepoName#*-}"
-        fi
-
-        if [ -n "${repoOwner:-}" ] && [ -n "${repoName:-}" ]; then
-          if [ -z "$organization" ]; then organization="$repoOwner"; fi
-          if [ -z "$repository" ];   then repository="$repoName";   fi
-        fi
-      fi
-
-      if [ -n "$organization" ]; then toolArgs+=( --organization "$organization" ); fi
-      if [ -n "$repository" ];   then toolArgs+=( --repository   "$repository" );   fi
-      if [ -n "$testResultAttachmentMode" ]; then
-        toolArgs+=( --test-result-attachment-mode "$testResultAttachmentMode" )
-      fi
-
-      # Build.Reason and Build.SourceBranch are required to derive the Helix source filter
-      # the same way the Helix SDK submitter does (PR -> 'pr', internal -> 'official',
-      # otherwise -> 'ci'). Without these, manually-queued / scheduled / CI builds would
-      # be looked up under the wrong source prefix and find zero jobs.
-      toolArgs+=( --build-reason  "$(Build.Reason)" )
-      toolArgs+=( --source-branch "$(Build.SourceBranch)" )
-
-      if [ -n '${{ parameters.toolNupkgArtifactName }}' ]; then
-        # Tool was installed from a local nupkg; run the DLL via the repo-local dotnet.
-        export DOTNET_ROOT="$(Build.SourcesDirectory)/.dotnet"
-        ./eng/common/dotnet.sh exec "$(HelixJobMonitorDll)" "${toolArgs[@]}"
-      else
-        # Tool was restored from the local .config/dotnet-tools.json manifest; invoke it
-        # through the manifest from the repo root.
-        pushd "$BUILD_SOURCESDIRECTORY" > /dev/null
-        trap 'popd > /dev/null' EXIT
-        ./eng/common/dotnet.sh tool run '${{ parameters.toolCommand }}' -- "${toolArgs[@]}"
-      fi
-    displayName: Monitor Helix Jobs
-    env:
-      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-      HELIX_ACCESSTOKEN: ${{ parameters.helixAccessToken }}
+  - ${{ if eq(parameters.useEntraAuthentication, true) }}:
+    - task: AzureCLI@2
+      displayName: Monitor Helix Jobs
+      inputs:
+        azureSubscription: ${{ parameters.azureSubscription }}
+        keepAzSessionActive: true
+        scriptType: bash
+        scriptLocation: inlineScript
+        inlineScript: |
+          set -euo pipefail
+
+          # AzureCLI@2 replaces SYSTEM_ACCESSTOKEN with the service connection token.
+          export SYSTEM_ACCESSTOKEN="$HELIX_AZDO_ACCESSTOKEN"
+          bash "$BUILD_SOURCESDIRECTORY/eng/common/run-helix-job-monitor.sh"
+      env:
+        HELIX_AZDO_ACCESSTOKEN: $(System.AccessToken)
+
+  - ${{ if eq(parameters.useEntraAuthentication, false) }}:
+    - bash: bash "$BUILD_SOURCESDIRECTORY/eng/common/run-helix-job-monitor.sh"
+      displayName: Monitor Helix Jobs
+      env:
+        SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+        HELIX_ACCESSTOKEN: ${{ parameters.helixAccessToken }}
diff --git a/eng/common/core-templates/job/job.yml b/eng/common/core-templates/job/job.yml
@@ -126,7 +126,8 @@ jobs:
     - name: MSBUILDDEBUGPATH
       value: $(Build.ArtifactStagingDirectory)/AstredCapture/binlogs
 
-  # DotNet-HelixApi-Access provides 'HelixApiAccessToken' for internal builds
+  # DotNet-HelixApi-Access provides 'HelixApiAccessToken' for internal builds.
+  # Entra-enabled Helix templates do not forward this value to their processes.
   - ${{ if and(eq(parameters.enableTelemetry, 'true'), eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
     - group: DotNet-HelixApi-Access
 

diff --git a/eng/common/core-templates/stages/renovate.yml b/eng/common/core-templates/stages/renovate.yml
@@ -60,7 +60,7 @@ parameters:
 
 # Renovate version used in the container image tag.
 - name: renovateVersion
-  default: 43
+  default: 44
   type: number
 
 # Pool configuration for SDL analysis.

diff --git a/eng/common/core-templates/steps/astred-artifacts.yml b/eng/common/core-templates/steps/astred-artifacts.yml
@@ -21,7 +21,7 @@ steps:
     FeedUrl: 'https://pkgs.dev.azure.com/dnceng/_packaging/dotnet-internal-FoSSE/nuget/v3/index.json'
 
 - pwsh: |
-    $ErrorActionPreference = 'Continue'
+    $ErrorActionPreference = 'Stop'
     $apjOut = Join-Path $env:ASTRED_CAPTURE_PATH 'apj'
     New-Item -ItemType Directory -Force -Path $apjOut | Out-Null
 
@@ -34,10 +34,13 @@ steps:
 
     $project = Join-Path $apjOut '.astred.project.json'
     $binlogPaths = @($binlogs.FullName)
+    $responseFile = Join-Path $apjOut 'binlogs.rsp'
+    $binlogPaths | ForEach-Object { '"{0}"' -f $_ } |
+      Set-Content -LiteralPath $responseFile -Encoding utf8
     Write-Host "astproj: processing $($binlogPaths.Count) binlog(s)"
-    astred astproj -nofolders @binlogPaths "-o:$project"
+    astred astproj -nofolders "@$responseFile" "-o:$project"
     if ($LASTEXITCODE -ne 0) {
-      Write-Host "##vso[task.logissue type=warning]astproj failed (exit $LASTEXITCODE)"
+      throw "astproj failed (exit $LASTEXITCODE)"
     }
   displayName: Generate Astred Project Files
   workingDirectory: ${{ parameters.sourcesPath }}