Appconfig provider ff endpoint (#48700)

* Load feature flags from the dedicated feature flag resource endpoint in the provider

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add tests.md doc link and fix recordings push command

* Update recordings tag and apply black formatting fix

* addressed comments

* Fix null-value handling in entra_id_sample and clean up refresh sample sentinel/watch-key logic and timing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Make refresh_sample_feature_flags.py self-contained by creating its own my_json key and looking up Beta by id instead of a fragile index

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Enhance feature flag processing and clarify provider test instructions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* updated release date

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: yuanqu72

sdk/appconfiguration/azure-appconfiguration-provider/CHANGELOG.md

@@ -1,11 +1,15 @@
 # Release History
 
-## 2.5.1 (Unreleased)
+## 2.6.0b1 (2026-08-25)
 
 ### Features Added
 
+- Enhanced feature flags created via the dedicated feature flag resource endpoint (`FeatureFlagClient`/`FeatureFlag` in `azure-appconfiguration`) are now loaded automatically alongside key-value based feature flags whenever `feature_flag_enabled=True`. Both kinds are merged into the same `feature_management.feature_flags` list, with resource-based feature flags taking precedence over key-value based ones when they share the same name. No new `load()` options are required to opt in, and existing `feature_flag_selectors` filter both kinds.
+
 ### Breaking Changes
 
+- Raised the minimum supported Python version to 3.10, matching the minimum required by `azure-appconfiguration>=1.10.0b1`. Dropped support for Python 3.7, 3.8, and 3.9.
+
 ### Bugs Fixed
 
 - Fixed a resource leak where replica clients that were no longer part of the auto-failover set were not closed during client refresh.
@@ -17,6 +21,7 @@
 ### Other Changes
 
 - Bumped minimum dependency on `azure-core` to `>=1.31.0`.
+- Bumped minimum dependency on `azure-appconfiguration` to `>=1.10.0b1` for `FeatureFlagClient`/`FeatureFlag` support.
 
 ## 2.5.0 (2026-05-22)
 

sdk/appconfiguration/azure-appconfiguration-provider/README.md

@@ -158,13 +158,11 @@ The provider can be configured to refresh configurations from the store on a set
 import os
 from azure.appconfiguration.provider import load, WatchKey
 
-connection_string = os.environ["APPCONFIGURATION_CONNECTION_STRING"]
-
 config = load(
     endpoint=endpoint,
     credential=credential,
     refresh_on=[WatchKey("Sentinel")],
-    refresh_interval=60,
+    refresh_interval=30,
     **kwargs,
 )
 ```
@@ -361,14 +359,12 @@ To enable refresh for feature flags you need to enable refresh. This will allow
 import os
 from azure.appconfiguration.provider import load, WatchKey
 
-connection_string = os.environ["APPCONFIGURATION_CONNECTION_STRING"]
-
 config = load(
     endpoint=endpoint,
     credential=credential,
     refresh_on=[WatchKey("message")],
     refresh_on_feature_flags=True,
-    refresh_interval=60,
+    refresh_interval=30,
     feature_flag_enabled=True,
     feature_flag_refresh_enabled=True,
     **kwargs,
@@ -377,6 +373,47 @@ config = load(
 
 <!-- END SNIPPET -->
 
+### Loading Enhanced Feature Flags
+
+Feature flags can also be created using the dedicated feature flag endpoint (via `FeatureFlagClient`/`FeatureFlag` in `azure-appconfiguration`), instead of as key-value configuration settings. These are referred to as enhanced feature flags. No additional `load()` options are required to load them — it happens automatically whenever `feature_flag_enabled=True`, and they are merged into the same `feature_management.feature_flags` list as key-value based feature flags, with enhanced feature flags taking precedence when both share the same name (`id` for feature flag).
+
+<!-- SNIPPET:enhanced_feature_flag_sample.enhanced_feature_flag_loading -->
+
+```python
+from azure.appconfiguration.provider import load
+
+# Feature flags loaded from the enhanced feature flag endpoint are merged into the same
+# feature_management.feature_flags list as key-value based feature flags.
+config = load(endpoint=endpoint, credential=credential, feature_flag_enabled=True, **kwargs)
+feature_flags = config["feature_management"]["feature_flags"]
+enhanced_flag_beta = next(flag for flag in feature_flags if flag.get("id") == "EnhancedFeatureBeta")
+print(enhanced_flag_beta["enabled"])
+```
+
+<!-- END SNIPPET -->
+
+`FeatureFlagSelector` is the dedicated selector type for filtering enhanced feature flags by name, label, or tags, and is the recommended way to select enhanced feature flags.
+
+<!-- SNIPPET:enhanced_feature_flag_sample.enhanced_feature_flag_selector_with_feature_flag_selector -->
+
+```python
+from azure.appconfiguration.provider import load, FeatureFlagSelector
+
+# FeatureFlagSelector is the dedicated selector type for filtering enhanced feature flags.
+config = load(
+    endpoint=endpoint,
+    credential=credential,
+    feature_flag_enabled=True,
+    feature_flag_selectors=[FeatureFlagSelector(name_filter="Enhanced*")],
+    **kwargs,
+)
+feature_flags = config["feature_management"]["feature_flags"]
+enhanced_flag_beta = next(flag for flag in feature_flags if flag.get("id") == "EnhancedFeatureBeta")
+print(enhanced_flag_beta["enabled"])
+```
+
+<!-- END SNIPPET -->
+
 ## JSON Content Type
 
 Configuration settings with a JSON content type (e.g., `application/json`) are automatically deserialized into their corresponding Python objects when loaded by the provider.
@@ -405,8 +442,10 @@ from azure.appconfiguration.provider import load
 
 
 def my_mapper(setting):
-    # Transform the setting as needed
-    setting.value = setting.value.strip()
+    # Transform the setting as needed. Some settings may have a None value, so guard against that
+    # before calling string methods on it.
+    if setting.value is not None:
+        setting.value = setting.value.strip()
 
 
 config = load(endpoint=endpoint, credential=credential, configuration_mapper=my_mapper, **kwargs)
@@ -469,6 +508,12 @@ This library uses the standard [logging](https://docs.python.org/3/library/loggi
 * **Configuration not refreshing** — Make sure you are calling `config.refresh()` periodically (e.g., before each request in a web app). The provider does not auto-refresh in the background.
 * **Startup failures** — If the store is unreachable during startup, the provider will retry until `startup_timeout` (default 100 seconds) is exceeded. Increase this value if your store is expected to have high latency.
 
+## Testing
+
+(This content is for `azure-appconfiguration-provider` package developer only)
+
+See [tests/tests.md](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/appconfiguration/azure-appconfiguration-provider/tests/tests.md) for instructions on running unit and integration tests, working with recordings, and setting up environment variables for local testing.
+
 ## Next steps
 
 Check out our Django and Flask examples to see how to use the provider in a web application.

sdk/appconfiguration/azure-appconfiguration-provider/api.md

@@ -8,7 +8,7 @@ namespace azure.appconfiguration.provider
             *, 
             feature_flag_enabled: bool = False, 
             feature_flag_refresh_enabled: bool = False, 
-            feature_flag_selectors: Optional[List[SettingSelector]] = ..., 
+            feature_flag_selectors: Optional[Union[List[SettingSelector], List[FeatureFlagSelector]]] = ..., 
             key_vault_options: Optional[AzureAppConfigurationKeyVaultOptions] = ..., 
             keyvault_client_configs: Optional[Mapping[str, JSON]] = ..., 
             keyvault_credential: Optional[TokenCredential] = ..., 
@@ -31,7 +31,7 @@ namespace azure.appconfiguration.provider
             connection_string: str, 
             feature_flag_enabled: bool = False, 
             feature_flag_refresh_enabled: bool = False, 
-            feature_flag_selectors: Optional[List[SettingSelector]] = ..., 
+            feature_flag_selectors: Optional[Union[List[SettingSelector], List[FeatureFlagSelector]]] = ..., 
             key_vault_options: Optional[AzureAppConfigurationKeyVaultOptions] = ..., 
             keyvault_client_configs: Optional[Mapping[str, JSON]] = ..., 
             keyvault_credential: Optional[TokenCredential] = ..., 
@@ -68,6 +68,17 @@ namespace azure.appconfiguration.provider
         def refresh(self, **kwargs) -> None: ...
 
 
+    class azure.appconfiguration.provider.FeatureFlagSelector:
+
+        def __init__(
+                self, 
+                *, 
+                label_filter: Optional[str] = NULL_CHAR, 
+                name_filter: Optional[str] = ..., 
+                tag_filters: Optional[List[str]] = ...
+            ): ...
+
+
     class azure.appconfiguration.provider.SettingSelector:
 
         def __init__(
@@ -94,7 +105,7 @@ namespace azure.appconfiguration.provider.aio
             *, 
             feature_flag_enabled: bool = False, 
             feature_flag_refresh_enabled: bool = False, 
-            feature_flag_selectors: Optional[List[SettingSelector]] = ..., 
+            feature_flag_selectors: Optional[Union[List[SettingSelector], List[FeatureFlagSelector]]] = ..., 
             key_vault_options: Optional[AzureAppConfigurationKeyVaultOptions] = ..., 
             keyvault_client_configs: Optional[Mapping[str, JSON]] = ..., 
             keyvault_credential: Optional[AsyncTokenCredential] = ..., 
@@ -117,7 +128,7 @@ namespace azure.appconfiguration.provider.aio
             connection_string: str, 
             feature_flag_enabled: bool = False, 
             feature_flag_refresh_enabled: bool = False, 
-            feature_flag_selectors: Optional[List[SettingSelector]] = ..., 
+            feature_flag_selectors: Optional[Union[List[SettingSelector], List[FeatureFlagSelector]]] = ..., 
             key_vault_options: Optional[AzureAppConfigurationKeyVaultOptions] = ..., 
             keyvault_client_configs: Optional[Mapping[str, JSON]] = ..., 
             keyvault_credential: Optional[AsyncTokenCredential] = ..., 

sdk/appconfiguration/azure-appconfiguration-provider/assets.json

@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "python",
   "TagPrefix": "python/appconfiguration/azure-appconfiguration-provider",
-  "Tag": "python/appconfiguration/azure-appconfiguration-provider_34a63910b7"
+  "Tag": "python/appconfiguration/azure-appconfiguration-provider_d3ca89ab22"
 }

sdk/appconfiguration/azure-appconfiguration-provider/azure/appconfiguration/provider/__init__.py

@@ -7,6 +7,7 @@
 from ._azureappconfigurationprovider import AzureAppConfigurationProvider
 from ._models import (
     AzureAppConfigurationKeyVaultOptions,
+    FeatureFlagSelector,
     SettingSelector,
     WatchKey,
 )
@@ -18,6 +19,7 @@
     "load",
     "AzureAppConfigurationProvider",
     "AzureAppConfigurationKeyVaultOptions",
+    "FeatureFlagSelector",
     "SettingSelector",
     "WatchKey",
 ]