MSAL configuration to call downstream service when running under Workload identity

[tomikiss]

We are trying to find a way how to configure dotnet service using the injected federated credentials from workload identity.

Without workload identity we were using standard oauth flow:
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd")) .EnableTokenAcquisitionToCallDownstreamApi() .AddInMemoryTokenCaches();
And usage to fetch token using ITokenAcquisition:
var scopedITokenAcquisition = scope.ServiceProvider.GetRequiredService<ITokenAcquisition>(); return await scopedITokenAcquisition.GetAuthenticationResultForAppAsync($"{apiscope}");

Is there anyway / preferred way to configure MSAL to use the injected federated token to authenticate between services?

Workload identity inject the following variables - which is handled all other service connecting to azure services but we haven't found anyway to configure MSAL such to use this tokens to call downstream.
AZURE_AUTHORITY_HOST AZURE_CLIENT_ID AZURE_FEDERATED_TOKEN_FILE AZURE_TENANT_ID