fix: add tenantId filter to getNativeAccountId for multi-tenant scenarios

[lalimasharda]

Problem

In multi-tenant scenarios, \getNativeAccountId()\ filters cached accounts only by \loginHint\ and \sid. When the same user has accounts in multiple tenants with the same \loginHint, the wrong tenant's
ativeAccountId\ is returned from the cache.

Solution

Added an optional \ enantId\ (GUID) field to \PopupRequest, \RedirectRequest, and \SsoSilentRequest. When provided, \getNativeAccountId()\ passes it into the \AccountFilter\ used by \getAccount(), so the cache lookup also matches on \ enantId.

Why \ enantId\ on the request (not parsed from authority)?

The authority URL may contain either a tenant GUID or a domain name (e.g. \contoso.onmicrosoft.com), but cached accounts store \ enantId\ as a GUID. Parsing the authority string would fail to match when a domain name is used. By accepting an explicit \ enantId\ GUID from the caller, we avoid this mismatch.

Design Points

• Non-breaking: \ enantId\ is optional; omitting it preserves existing behavior
• No msal-common changes: \AccountFilter\ already supports \ enantId\
• Minimal surface: 1 line change in \StandardController.ts, plus the type additions

Changes

File	Change
\src/request/PopupRequest.ts\	Added optional \ enantId\ field
\src/request/RedirectRequest.ts\	Added optional \ enantId\ field
\src/request/SsoSilentRequest.ts\	Added optional \ enantId\ field
\src/controllers/StandardController.ts\	Pass \
equest.tenantId\ into \AccountFilter\ in \getNativeAccountId()\
\ est/app/PublicClientApplication.spec.ts\	Added test for multi-tenant filtering; updated existing assertion
\�piReview/msal-browser.api.md\	Auto-updated API review

Testing

• All 1650 existing msal-browser tests pass
• New test verifies \ enantId\ is passed through to \getAccountsFilteredBy\
• Build, lint, and format checks pass

[Copilot]

Pull request overview

This PR addresses incorrect nativeAccountId selection in multi-tenant scenarios by allowing callers to provide an explicit tenantId (GUID) on interactive/sso request objects and threading it into the cached account lookup performed by StandardController.getNativeAccountId().

Changes:

• Added optional tenantId?: string to PopupRequest, RedirectRequest, and SsoSilentRequest.
• Updated StandardController.getNativeAccountId() to pass request.tenantId into the AccountFilter used by getAccount().
• Expanded unit test coverage around getNativeAccountId() behavior and updated the API review file.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
lib/msal-browser/src/controllers/StandardController.ts	Passes request.tenantId into the AccountFilter for native account id resolution.
lib/msal-browser/src/request/PopupRequest.ts	Adds optional tenantId to the popup request type.
lib/msal-browser/src/request/RedirectRequest.ts	Adds optional tenantId to the redirect request type.
lib/msal-browser/src/request/SsoSilentRequest.ts	Adds optional tenantId to the ssoSilent request type.
lib/msal-browser/test/app/PublicClientApplication.spec.ts	Adds/updates tests validating tenantId propagation into account filtering.
lib/msal-browser/apiReview/msal-browser.api.md	Updates extracted API surface to include the new tenantId request property.

[lalimasharda]

I think that should be okay because we would return the first account that matches with the tenantId passed in.