[Do not review] Agent ID support through minimal changes by Avery-Dunn · Pull Request #6008 · AzureAD/microsoft-authentication-library-for-dotnet

Avery-Dunn · 2026-05-14T16:35:43Z

Not yet ready for review, just exploring potential alternatives to: #5883

Currently adds:

WithClientIdOverride: a new request level parameter, to help test whether using the correct client ID in the cache key is enough to avoid the agent ID flow's cache collision risks
- AgentIdentityCacheIsolationTests: new unit test class covering:
  - TwoUsers_SameAgent_NoCacheCollision_Test: Two different users through the same agent have distinct cache entries (different HomeAccountId), silent calls return the correct user's token
  - TwoAgents_SameUser_NoCacheCollision_Test: Same user through two different agents has distinct cache entries (different ClientId in key), silent calls return the correct agent's token
  - AgentUserToken_DoesNotCollide_WithBlueprintUserToken_Test: A user token acquired via agent (with override) doesn't collide with the same user+scope acquired directly by the blueprint (without override)
- Agentic: Extra integration tests covering:
  - SingleCca_AgentUserIdentity_WithCacheHit_Test: Full 3-leg flow works end-to-end, all legs cache correctly, silent works, force-refresh works
  - SingleCca_AgentUserIdentity_AppTokenCacheIsolation_Test: Leg 1 and Leg 2 target the same scope but produce different tokens in different cache partitions

…parameter

Copilot

Pull request overview

This PR explores a minimal agent identity approach by adding a per-request client ID override that affects token requests and cache partitioning, plus integration coverage for single-CCA agent identity flows.

Changes:

Adds ClientIdOverride plumbing through common request parameters, token requests, cache saves/lookups, and app-token cache keys.
Exposes WithClientIdOverride on confidential-client token builders and silent acquisition builders.
Adds integration tests for single-CCA agent identity cache behavior and updates public API manifests.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`tests/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/Agentic.cs`	Adds integration tests for single-CCA agent identity flows using client ID override.
`src/client/Microsoft.Identity.Client/TokenCache.ITokenCacheInternal.cs`	Uses effective client ID for token save/filter/account lookup paths.
`src/client/Microsoft.Identity.Client/TokenCache.cs`	Uses effective client ID when deleting overlapping access tokens and matching RTs to accounts.
`src/client/Microsoft.Identity.Client/PublicApi/netstandard2.0/PublicAPI.Unshipped.txt`	Adds public API entries for the new override methods.
`src/client/Microsoft.Identity.Client/PublicApi/net8.0/PublicAPI.Unshipped.txt`	Adds public API entries for the new override methods.
`src/client/Microsoft.Identity.Client/PublicApi/net8.0-ios/PublicAPI.Unshipped.txt`	Adds mobile public API entry for silent override.
`src/client/Microsoft.Identity.Client/PublicApi/net8.0-android/PublicAPI.Unshipped.txt`	Adds mobile public API entry for silent override.
`src/client/Microsoft.Identity.Client/PublicApi/net472/PublicAPI.Unshipped.txt`	Adds public API entries for the new override methods.
`src/client/Microsoft.Identity.Client/PublicApi/net462/PublicAPI.Unshipped.txt`	Adds public API entries for the new override methods.
`src/client/Microsoft.Identity.Client/OAuth2/TokenClient.cs`	Sends effective client ID in token request body.
`src/client/Microsoft.Identity.Client/Internal/Requests/AuthenticationRequestParameters.cs`	Adds effective client ID request property.
`src/client/Microsoft.Identity.Client/Cache/CacheKeyFactory.cs`	Uses effective client ID for app-token cache keys.
`src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenCommonParameters.cs`	Adds common client ID override storage.
`src/client/Microsoft.Identity.Client/ApiConfig/AcquireTokenSilentParameterBuilder.cs`	Adds silent-acquisition override API.
`src/client/Microsoft.Identity.Client/ApiConfig/AbstractConfidentialClientAcquireTokenParameterBuilder.cs`	Adds confidential-client override API.

@@ -3,3 +3,4 @@ Microsoft.Identity.Client.AuthScheme.IAuthenticationOperation3.AfterCredentialEv
 Microsoft.Identity.Client.AuthScheme.CredentialEvaluationContext
 Microsoft.Identity.Client.AuthScheme.CredentialEvaluationContext.CredentialEvaluationContext(System.Security.Cryptography.X509Certificates.X509Certificate2 mtlsCertificate) -> void
 Microsoft.Identity.Client.AuthScheme.CredentialEvaluationContext.MtlsCertificate.get -> System.Security.Cryptography.X509Certificates.X509Certificate2


@@ -3,3 +3,4 @@ Microsoft.Identity.Client.AuthScheme.IAuthenticationOperation3.AfterCredentialEv
 Microsoft.Identity.Client.AuthScheme.CredentialEvaluationContext
 Microsoft.Identity.Client.AuthScheme.CredentialEvaluationContext.CredentialEvaluationContext(System.Security.Cryptography.X509Certificates.X509Certificate2 mtlsCertificate) -> void
 Microsoft.Identity.Client.AuthScheme.CredentialEvaluationContext.MtlsCertificate.get -> System.Security.Cryptography.X509Certificates.X509Certificate2


+        public T WithClientIdOverride(string clientId)
+        {
+            ValidateUseOfExperimentalFeature();
+            CommonParameters.ClientIdOverride = clientId ?? throw new ArgumentNullException(nameof(clientId));


+                    "WithClientIdOverride is only supported on confidential client applications.");
+            }
+
+            CommonParameters.ClientIdOverride = clientId ?? throw new ArgumentNullException(nameof(clientId));


                msalIdTokenCacheItem = new MsalIdTokenCacheItem(
                    instanceDiscoveryMetadata.PreferredCache,
-                    requestParams.AppConfig.ClientId,
+                    requestParams.EffectiveClientId,


                msalRefreshTokenCacheItem = new MsalRefreshTokenCacheItem(
                                    instanceDiscoveryMetadata.PreferredCache,
-                                    requestParams.AppConfig.ClientId,
+                                    requestParams.EffectiveClientId,


            if (filterByClientId)
            {
                refreshTokenCacheItems.FilterWithLogging(item =>
-                    string.Equals(item.ClientId, ClientId, StringComparison.OrdinalIgnoreCase),
+                    string.Equals(item.ClientId, requestParameters.EffectiveClientId, StringComparison.OrdinalIgnoreCase),


The net8.0-ios and net8.0-android PublicAPI.Unshipped.txt files were missing the declaration for AbstractConfidentialClientAcquireTokenParameterBuilder<T>.WithClientIdOverride, causing build failures in CI (LibsAndSamples.sln). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…eAD/microsoft-authentication-library-for-dotnet into avdunn/agent-id-support-alt

bgavrilMS · 2026-05-21T19:21:32Z

+            string t1Token = leg1Result.AccessToken;
+            var leg2Result = await cca
+                .AcquireTokenForClient([TokenExchangeUrl])
+                .WithClientIdOverride(AgentIdentity)


At this rate, we will move everything to the request. That's the ADAL way. Let's think more about an abstraction.

bgavrilMS · 2026-05-21T19:23:02Z

+            var leg2Result = await cca
+                .AcquireTokenForClient([TokenExchangeUrl])
+                .WithClientIdOverride(AgentIdentity)
+                .OnBeforeTokenRequest(data =>


You could have used WithClientAssertion ? The problem with this approach is the expiration of the t1token

First draft of agent ID support through minimal WithClientIdOverride …

865d072

…parameter

Copilot AI review requested due to automatic review settings May 14, 2026 16:35

Merge branch 'main' into avdunn/agent-id-support-alt

9763c2a

Copilot started reviewing on behalf of Avery-Dunn May 14, 2026 16:40 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

Avery-Dunn and others added 3 commits May 14, 2026 09:54

Merge branch 'avdunn/agent-id-support-alt' of https://github.com/Azur…

5213a48

…eAD/microsoft-authentication-library-for-dotnet into avdunn/agent-id-support-alt

Improve test coverage of WithClientIdOverride

87e94d6

Copilot AI review requested due to automatic review settings May 14, 2026 17:38

Copilot started reviewing on behalf of Avery-Dunn May 14, 2026 17:51 View session

bgavrilMS reviewed May 21, 2026

View reviewed changes

Avery-Dunn mentioned this pull request May 26, 2026

[Do not review] Agent ID support through existing behavior #6029

Closed

Avery-Dunn closed this Jun 4, 2026

Avery-Dunn mentioned this pull request Jun 5, 2026

Use MSAL's recent UserFIC API for agentic flows AzureAD/microsoft-identity-web#3842

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Do not review] Agent ID support through minimal changes#6008

[Do not review] Agent ID support through minimal changes#6008
Avery-Dunn wants to merge 5 commits into
mainfrom
avdunn/agent-id-support-alt

Avery-Dunn commented May 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

bgavrilMS May 21, 2026

Uh oh!

bgavrilMS May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Avery-Dunn commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

bgavrilMS May 21, 2026

Choose a reason for hiding this comment

Uh oh!

bgavrilMS May 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Avery-Dunn commented May 14, 2026 •

edited

Loading