Recent CodeQL scans found two issues:

• SM05136: Use of a weak, unapproved or risky cryptographic algorithm, hash or signature
  • This is due to the use of SHA-1 hashing in ADFS scenarios
  • All other scenarios have moved to SHA-256, however ADFS still requires SHA-1 and therefore we must keep this code in place until ADFS is updated.
• SM03767: Unsafe hostname verification
  • This is due to disabling hostname verification of a specific certificate in Service Fabric scenarios
  • We expect the connection to work against a specific certificate in a Service Fabric environment only, so it's safe to disable the hostname verification for this scenario