@azure/msal-browser 3.28.0 → 3.30.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.28.0 2024-12-12 */
+/*! @azure/msal-browser v3.30.0 2025-08-05 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -312,7 +312,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -329,7 +329,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -378,7 +378,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -476,7 +476,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -728,7 +728,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -767,7 +767,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -958,12 +958,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.16.0";
+const version$1 = "14.16.1";
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -983,7 +983,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1044,7 +1044,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1081,7 +1081,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1408,7 +1408,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1462,7 +1462,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1600,7 +1600,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1697,7 +1697,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1897,7 +1897,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1937,7 +1937,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2016,7 +2016,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2031,7 +2031,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2053,7 +2053,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2066,7 +2066,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2309,7 +2309,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2356,7 +2356,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2520,7 +2520,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2660,23 +2660,23 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-const cacheUnknownErrorCode = "cache_error_unknown";
+const cacheQuotaExceeded = "cache_quota_exceeded";
+const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 const CacheErrorMessages = {
-    [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
-    [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+    [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+    [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
 };
 /**
  * Error thrown when there is an error with the cache
@@ -2686,16 +2686,34 @@ class CacheError extends Error {
         const message = errorMessage ||
             (CacheErrorMessages[errorCode]
                 ? CacheErrorMessages[errorCode]
-                : CacheErrorMessages[cacheUnknownErrorCode]);
+                : CacheErrorMessages[cacheErrorUnknown]);
         super(`${errorCode}: ${message}`);
         Object.setPrototypeOf(this, CacheError.prototype);
         this.name = "CacheError";
         this.errorCode = errorCode;
         this.errorMessage = message;
     }
+}
+/**
+ * Helper function to wrap browser errors in a CacheError object
+ * @param e
+ * @returns
+ */
+function createCacheError(e) {
+    if (!(e instanceof Error)) {
+        return new CacheError(cacheErrorUnknown);
+    }
+    if (e.name === "QuotaExceededError" ||
+        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+        e.message.includes("exceeded the quota")) {
+        return new CacheError(cacheQuotaExceeded);
+    }
+    else {
+        return new CacheError(e.name, e.message);
+    }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2717,14 +2735,14 @@ class CacheManager {
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    getAllAccounts(accountFilter) {
-        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
+    getAllAccounts(correlationId, accountFilter) {
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}, correlationId), correlationId, accountFilter);
     }
     /**
      * Gets first tenanted AccountInfo object found based on provided filters
      */
-    getAccountInfoFilteredBy(accountFilter) {
-        const allAccounts = this.getAllAccounts(accountFilter);
+    getAccountInfoFilteredBy(accountFilter, correlationId) {
+        const allAccounts = this.getAllAccounts(correlationId, accountFilter);
         if (allAccounts.length > 1) {
             // If one or more accounts are found, prioritize accounts that have an ID token
             const sortedAccounts = allAccounts.sort((account) => {
@@ -2745,8 +2763,8 @@ class CacheManager {
      * @param accountFilter
      * @returns
      */
-    getBaseAccountInfo(accountFilter) {
-        const accountEntities = this.getAccountsFilteredBy(accountFilter);
+    getBaseAccountInfo(accountFilter, correlationId) {
+        const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
         if (accountEntities.length > 0) {
             return accountEntities[0].getAccountInfo();
         }
@@ -2761,12 +2779,12 @@ class CacheManager {
      * @param accountFilter
      * @returns Array of AccountInfo objects that match account and tenant profile filters
      */
-    buildTenantProfiles(cachedAccounts, accountFilter) {
+    buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
         return cachedAccounts.flatMap((accountEntity) => {
-            return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+            return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
         });
     }
-    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
         let tenantedAccountInfo = null;
         let idTokenClaims;
         if (tenantProfileFilter) {
@@ -2774,7 +2792,7 @@ class CacheManager {
                 return null;
             }
         }
-        const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
+        const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
             idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
             if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
@@ -2786,7 +2804,7 @@ class CacheManager {
         tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
         return tenantedAccountInfo;
     }
-    getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+    getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
         const accountInfo = accountEntity.getAccountInfo();
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
@@ -2806,7 +2824,7 @@ class CacheManager {
         }
         const matchingTenantProfiles = [];
         searchTenantProfiles.forEach((tenantProfile) => {
-            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
             if (tenantedAccountInfo) {
                 matchingTenantProfiles.push(tenantedAccountInfo);
             }
@@ -2860,46 +2878,36 @@ class CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                this.setAccount(cacheRecord.account);
+                this.setAccount(cacheRecord.account, correlationId);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                this.setIdTokenCredential(cacheRecord.idToken);
+                this.setIdTokenCredential(cacheRecord.idToken, correlationId);
             }
             if (!!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false) {
-                await this.saveAccessToken(cacheRecord.accessToken);
+                await this.saveAccessToken(cacheRecord.accessToken, correlationId);
             }
             if (!!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false) {
-                this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
             }
             if (!!cacheRecord.appMetadata) {
-                this.setAppMetadata(cacheRecord.appMetadata);
+                this.setAppMetadata(cacheRecord.appMetadata, correlationId);
             }
         }
         catch (e) {
             this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-            if (e instanceof Error) {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
-                if (e.name === "QuotaExceededError" ||
-                    e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                    e.message.includes("exceeded the quota")) {
-                    this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
-                    throw new CacheError(cacheQuotaExceededErrorCode);
-                }
-                else {
-                    throw new CacheError(e.name, e.message);
-                }
+            if (e instanceof AuthError) {
+                throw e;
             }
             else {
-                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
-                throw new CacheError(cacheUnknownErrorCode);
+                throw createCacheError(e);
             }
         }
     }
@@ -2907,7 +2915,7 @@ class CacheManager {
      * saves access token credential
      * @param credential
      */
-    async saveAccessToken(credential) {
+    async saveAccessToken(credential, correlationId) {
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -2919,29 +2927,27 @@ class CacheManager {
         };
         const tokenKeys = this.getTokenKeys();
         const currentScopes = ScopeSet.fromString(credential.target);
-        const removedAccessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                 return;
             }
-            const tokenEntity = this.getAccessTokenCredential(key);
+            const tokenEntity = this.getAccessTokenCredential(key, correlationId);
             if (tokenEntity &&
                 this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                 const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             }
         });
-        await Promise.all(removedAccessTokens);
-        this.setAccessTokenCredential(credential);
+        this.setAccessTokenCredential(credential, correlationId);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
      * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
      * @param accountFilter - An object containing Account properties to filter by
      */
-    getAccountsFilteredBy(accountFilter) {
+    getAccountsFilteredBy(accountFilter, correlationId) {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
@@ -2949,7 +2955,7 @@ class CacheManager {
                 // Don't parse value if the key doesn't match the account filters
                 return;
             }
-            const entity = this.getAccount(cacheKey, this.commonLogger);
+            const entity = this.getAccount(cacheKey, correlationId, this.commonLogger);
             // Match base account fields
             if (!entity) {
                 return;
@@ -3175,11 +3181,11 @@ class CacheManager {
     /**
      * Removes all accounts and related tokens from cache.
      */
-    async removeAllAccounts() {
+    async removeAllAccounts(correlationId) {
         const allAccountKeys = this.getAccountKeys();
         const removedAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            removedAccounts.push(this.removeAccount(cacheKey));
+            removedAccounts.push(this.removeAccount(cacheKey, correlationId));
         });
         await Promise.all(removedAccounts);
     }
@@ -3187,38 +3193,41 @@ class CacheManager {
      * Removes the account and related tokens for a given account key
      * @param account
      */
-    async removeAccount(accountKey) {
-        const account = this.getAccount(accountKey, this.commonLogger);
+    async removeAccount(accountKey, correlationId) {
+        const account = this.getAccount(accountKey, correlationId, this.commonLogger);
         if (!account) {
             return;
         }
-        await this.removeAccountContext(account);
-        this.removeItem(accountKey);
+        await this.removeAccountContext(account, correlationId);
+        this.removeItem(accountKey, correlationId);
     }
     /**
      * Removes credentials associated with the provided account
      * @param account
      */
-    async removeAccountContext(account) {
+    async removeAccountContext(account, correlationId) {
         const allTokenKeys = this.getTokenKeys();
         const accountId = account.generateAccountId();
-        const removedCredentials = [];
         allTokenKeys.idToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             }
         });
         allTokenKeys.accessToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                removedCredentials.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
             }
         });
         allTokenKeys.refreshToken.forEach((key) => {
             if (key.indexOf(accountId) === 0) {
-                this.removeRefreshToken(key);
+                this.removeRefreshToken(key, correlationId);
+            }
+        });
+        this.getKeys().forEach((key) => {
+            if (key.includes(accountId)) {
+                this.removeItem(key, correlationId);
             }
         });
-        await Promise.all(removedCredentials);
     }
     /**
      * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
@@ -3228,7 +3237,7 @@ class CacheManager {
      * @param logger
      * @returns
      */
-    updateOutdatedCachedAccount(accountKey, accountEntity, logger) {
+    updateOutdatedCachedAccount(accountKey, accountEntity, correlationId, logger) {
         // Only update if account entity is defined and has no tenantProfiles object (is outdated)
         if (accountEntity && accountEntity.isSingleTenant()) {
             this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");
@@ -3239,7 +3248,7 @@ class CacheManager {
             // Get all account entities belonging to user
             const accountsToMerge = [];
             matchingAccountKeys.forEach((key) => {
-                const account = this.getCachedAccountEntity(key);
+                const account = this.getCachedAccountEntity(key, correlationId);
                 if (account) {
                     accountsToMerge.push(account);
                 }
@@ -3264,11 +3273,11 @@ class CacheManager {
             // Clear cache of legacy account objects that have been collpsed into tenant profiles
             matchingAccountKeys.forEach((key) => {
                 if (key !== newAccountKey) {
-                    this.removeOutdatedAccount(accountKey);
+                    this.removeOutdatedAccount(accountKey, correlationId);
                 }
             });
             // Cache updated account object
-            this.setAccount(updatedAccount);
+            this.setAccount(updatedAccount, correlationId);
             logger?.verbose("Updated an outdated account entity in the cache");
             return updatedAccount;
         }
@@ -3279,37 +3288,31 @@ class CacheManager {
      * returns a boolean if the given credential is removed
      * @param credential
      */
-    async removeAccessToken(key) {
-        const credential = this.getAccessTokenCredential(key);
-        if (!credential) {
+    removeAccessToken(key, correlationId) {
+        const credential = this.getAccessTokenCredential(key, correlationId);
+        this.removeItem(key, correlationId);
+        if (!credential ||
+            credential.credentialType.toLowerCase() !==
+                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+            credential.tokenType !== AuthenticationScheme.POP) {
             return;
         }
         // Remove Token Binding Key from key store for PoP Tokens Credentials
-        if (credential.credentialType.toLowerCase() ===
-            CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-            if (credential.tokenType === AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity = credential;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-                if (kid) {
-                    try {
-                        await this.cryptoImpl.removeTokenBindingKey(kid);
-                    }
-                    catch (error) {
-                        throw createClientAuthError(bindingKeyNotRemoved);
-                    }
-                }
-            }
+        const kid = credential.keyId;
+        if (kid) {
+            void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                this.commonLogger.error("Binding key could not be removed");
+            });
         }
-        return this.removeItem(key);
     }
     /**
      * Removes all app metadata objects from cache.
      */
-    removeAppMetadata() {
+    removeAppMetadata(correlationId) {
         const allCacheKeys = this.getKeys();
         allCacheKeys.forEach((cacheKey) => {
             if (this.isAppMetadata(cacheKey)) {
-                this.removeItem(cacheKey);
+                this.removeItem(cacheKey, correlationId);
             }
         });
         return true;
@@ -3318,9 +3321,9 @@ class CacheManager {
      * Retrieve AccountEntity from cache
      * @param account
      */
-    readAccountFromCache(account) {
+    readAccountFromCache(account, correlationId) {
         const accountKey = AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey, this.commonLogger);
+        return this.getAccount(accountKey, correlationId, this.commonLogger);
     }
     /**
      * Retrieve IdTokenEntity from cache
@@ -3330,7 +3333,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
+    getIdToken(account, correlationId, tokenKeys, targetRealm, performanceClient) {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter = {
             homeAccountId: account.homeAccountId,
@@ -3339,7 +3342,7 @@ class CacheManager {
             clientId: this.clientId,
             realm: targetRealm,
         };
-        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
         const numIdTokens = idTokenMap.size;
         if (numIdTokens < 1) {
             this.commonLogger.info("CacheManager:getIdToken - No token found");
@@ -3372,7 +3375,7 @@ class CacheManager {
             // Multiple tokens for a single tenant profile, remove all and return null
             this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
             tokensToBeRemoved.forEach((idToken, key) => {
-                this.removeIdToken(key);
+                this.removeIdToken(key, correlationId);
             });
             if (performanceClient && correlationId) {
                 performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
@@ -3387,7 +3390,7 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getIdTokensByFilter(filter, tokenKeys) {
+    getIdTokensByFilter(filter, correlationId, tokenKeys) {
         const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
         const idTokens = new Map();
         idTokenKeys.forEach((key) => {
@@ -3397,7 +3400,7 @@ class CacheManager {
             })) {
                 return;
             }
-            const idToken = this.getIdTokenCredential(key);
+            const idToken = this.getIdTokenCredential(key, correlationId);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                 idTokens.set(key, idToken);
             }
@@ -3426,15 +3429,15 @@ class CacheManager {
      * Removes idToken from the cache
      * @param key
      */
-    removeIdToken(key) {
-        this.removeItem(key);
+    removeIdToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Removes refresh token from the cache
      * @param key
      */
-    removeRefreshToken(key) {
-        this.removeItem(key);
+    removeRefreshToken(key, correlationId) {
+        this.removeItem(key, correlationId);
     }
     /**
      * Retrieve AccessTokenEntity from cache
@@ -3444,7 +3447,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
+    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient) {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -3474,7 +3477,7 @@ class CacheManager {
         accessTokenKeys.forEach((key) => {
             // Validate key
             if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(key, request.correlationId);
                 // Validate value
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
@@ -3490,10 +3493,10 @@ class CacheManager {
         else if (numAccessTokens > 1) {
             this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
             accessTokens.forEach((accessToken) => {
-                void this.removeAccessToken(generateCredentialKey(accessToken));
+                void this.removeAccessToken(generateCredentialKey(accessToken), request.correlationId);
             });
-            if (performanceClient && correlationId) {
-                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
+            if (performanceClient && request.correlationId) {
+                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, request.correlationId);
             }
             return null;
         }
@@ -3546,14 +3549,14 @@ class CacheManager {
      * @param filter
      * @returns
      */
-    getAccessTokensByFilter(filter) {
+    getAccessTokensByFilter(filter, correlationId) {
         const tokenKeys = this.getTokenKeys();
         const accessTokens = [];
         tokenKeys.accessToken.forEach((key) => {
             if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
                 return;
             }
-            const accessToken = this.getAccessTokenCredential(key);
+            const accessToken = this.getAccessTokenCredential(key, correlationId);
             if (accessToken &&
                 this.credentialMatchesFilter(accessToken, filter)) {
                 accessTokens.push(accessToken);
@@ -3569,7 +3572,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
+    getRefreshToken(account, familyRT, correlationId, tokenKeys, performanceClient) {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
         const refreshTokenFilter = {
@@ -3585,7 +3588,7 @@ class CacheManager {
         refreshTokenKeys.forEach((key) => {
             // Validate key
             if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                const refreshToken = this.getRefreshTokenCredential(key);
+                const refreshToken = this.getRefreshTokenCredential(key, correlationId);
                 // Validate value
                 if (refreshToken &&
                     this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
@@ -3944,7 +3947,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4043,7 +4046,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4053,7 +4056,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4103,7 +4106,7 @@ const X_CLIENT_EXTRA_SKU = "x-client-xtra-sku";
 const BROKER_CLIENT_ID = "brk_client_id";
 const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4170,7 +4173,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4578,7 +4581,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4590,7 +4593,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4600,7 +4603,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4610,7 +4613,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5097,7 +5100,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5193,7 +5196,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5302,7 +5305,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6141,7 +6144,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6172,7 +6175,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6191,7 +6194,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6211,12 +6214,12 @@ class ThrottlingUtils {
      * @param cacheManager
      * @param thumbprint
      */
-    static preProcess(cacheManager, thumbprint) {
+    static preProcess(cacheManager, thumbprint, correlationId) {
         const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
         const value = cacheManager.getThrottlingCache(key);
         if (value) {
             if (value.throttleTime < Date.now()) {
-                cacheManager.removeItem(key);
+                cacheManager.removeItem(key, correlationId);
                 return;
             }
             throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -6228,7 +6231,7 @@ class ThrottlingUtils {
      * @param thumbprint
      * @param response
      */
-    static postProcess(cacheManager, thumbprint, response) {
+    static postProcess(cacheManager, thumbprint, response, correlationId) {
         if (ThrottlingUtils.checkResponseStatus(response) ||
             ThrottlingUtils.checkResponseForRetryAfter(response)) {
             const thumbprintValue = {
@@ -6238,7 +6241,7 @@ class ThrottlingUtils {
                 errorMessage: response.body.error_description,
                 subError: response.body.suberror,
             };
-            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
+            cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
         }
     }
     /**
@@ -6285,11 +6288,11 @@ class ThrottlingUtils {
             sshKid: request.sshKid,
         };
         const key = this.generateThrottlingStorageKey(thumbprint);
-        cacheManager.removeItem(key);
+        cacheManager.removeItem(key, request.correlationId);
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6319,7 +6322,7 @@ function createNetworkError(error, httpStatus, responseHeaders) {
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6401,7 +6404,7 @@ class BaseClient {
      * @param correlationId - CorrelationId for telemetry
      */
     async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
         let response;
         try {
             response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
@@ -6436,7 +6439,7 @@ class BaseClient {
                 throw createClientAuthError(networkError);
             }
         }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
         return response;
     }
     /**
@@ -6469,7 +6472,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6495,7 +6498,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6583,7 +6586,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6655,7 +6658,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6739,7 +6742,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6766,7 +6769,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6926,13 +6929,13 @@ class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key, this.logger);
+                const account = this.cacheStorage.getAccount(key, request.correlationId, this.logger);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache, request.correlationId);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -6961,7 +6964,7 @@ class ResponseHandler {
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
             cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
             this.logger);
         }
         // AccessToken
@@ -7109,7 +7112,7 @@ class ResponseHandler {
         };
     }
 }
-function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
     logger?.verbose("setCachedAccount called");
     // Check if base account is already cached
     const accountKeys = cacheStorage.getAccountKeys();
@@ -7118,7 +7121,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     });
     let cachedAccount = null;
     if (baseAccountKey) {
-        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId, logger);
     }
     const baseAccount = cachedAccount ||
         AccountEntity.createAccount({
@@ -7143,7 +7146,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7161,7 +7164,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7603,7 +7606,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7676,7 +7679,7 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenWithCachedRefreshToken(request, foci) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
@@ -7704,7 +7707,7 @@ class RefreshTokenClient extends BaseClient {
                 // Remove bad refresh token from cache
                 this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
                 const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
             }
             throw e;
         }
@@ -7823,7 +7826,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7893,7 +7896,7 @@ class SilentFlowClient extends BaseClient {
         const requestTenantId = request.account.tenantId ||
             getTenantFromAuthorityString(request.authority);
         const tokenKeys = this.cacheManager.getTokenKeys();
-        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient);
         if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7913,9 +7916,9 @@ class SilentFlowClient extends BaseClient {
         }
         const environment = request.authority || this.authority.getPreferredCache();
         const cacheRecord = {
-            account: this.cacheManager.readAccountFromCache(request.account),
+            account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
             accessToken: cachedAccessToken,
-            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+            idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
             refreshToken: null,
             appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
         };
@@ -7959,7 +7962,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7974,7 +7977,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8032,7 +8035,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8171,7 +8174,7 @@ class ServerTelemetryManager {
         else {
             lastRequests.errors.push(SERVER_TELEM_CONSTANTS.UNKNOWN_ERROR);
         }
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return;
     }
     /**
@@ -8180,7 +8183,7 @@ class ServerTelemetryManager {
     incrementCacheHits() {
         const lastRequests = this.getLastRequests();
         lastRequests.cacheHits += 1;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         return lastRequests.cacheHits;
     }
     /**
@@ -8204,7 +8207,7 @@ class ServerTelemetryManager {
         const errorCount = lastRequests.errors.length;
         if (numErrorsFlushed === errorCount) {
             // All errors were sent on last request, clear Telemetry cache
-            this.cacheManager.removeItem(this.telemetryCacheKey);
+            this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
         }
         else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
@@ -8213,7 +8216,7 @@ class ServerTelemetryManager {
                 errors: lastRequests.errors.slice(numErrorsFlushed),
                 cacheHits: 0,
             };
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
         }
     }
     /**
@@ -8280,7 +8283,7 @@ class ServerTelemetryManager {
     setNativeBrokerErrorCode(errorCode) {
         const lastRequests = this.getLastRequests();
         lastRequests.nativeBrokerErrorCode = errorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     getNativeBrokerErrorCode() {
         return this.getLastRequests().nativeBrokerErrorCode;
@@ -8288,14 +8291,14 @@ class ServerTelemetryManager {
     clearNativeBrokerErrorCode() {
         const lastRequests = this.getLastRequests();
         delete lastRequests.nativeBrokerErrorCode;
-        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+        this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
     }
     static makeExtraSkuString(params) {
         return makeExtraSkuString(params);
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8303,7 +8306,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8328,7 +8331,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8368,7 +8371,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8447,7 +8450,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.16.0 2024-12-12 */
+/*! @azure/msal-common v14.16.1 2025-08-05 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9510,6 +9513,7 @@ const TemporaryCacheKeys = {
 const StaticCacheKeys = {
     ACCOUNT_KEYS: "msal.account.keys",
     TOKEN_KEYS: "msal.token.keys",
+    VERSION: "msal.version",
 };
 /**
  * Cache keys stored in-memory
@@ -9717,14 +9721,14 @@ const keygenAlgorithmOptions = {
 /**
  * Check whether browser crypto is available.
  */
-function validateCryptoAvailable() {
+function validateCryptoAvailable(skipValidateSubtleCrypto) {
     if (!window) {
         throw createBrowserAuthError(nonBrowserEnvironment);
     }
     if (!window.crypto) {
         throw createBrowserAuthError(cryptoNonExistent);
     }
-    if (!window.crypto.subtle) {
+    if (!skipValidateSubtleCrypto && !window.crypto.subtle) {
         throw createBrowserAuthError(cryptoNonExistent, SUBTLE_SUBERROR);
     }
 }
@@ -9939,7 +9943,9 @@ function isInPopup() {
  * Returns current window URL as redirect uri
  */
 function getCurrentUri() {
-    return window.location.href.split("?")[0].split("#")[0];
+    return typeof window !== "undefined" && window.location
+        ? window.location.href.split("?")[0].split("#")[0]
+        : "";
 }
 /**
  * Gets the homepage url for the current window location.
@@ -10366,7 +10372,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.28.0";
+const version = "3.30.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11153,10 +11159,10 @@ class AsyncMemoryStorage {
  * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
  */
 class CryptoOps {
-    constructor(logger, performanceClient) {
+    constructor(logger, performanceClient, skipValidateSubtleCrypto) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
-        validateCryptoAvailable();
+        validateCryptoAvailable(skipValidateSubtleCrypto ?? false);
         this.cache = new AsyncMemoryStorage(this.logger);
         this.performanceClient = performanceClient;
     }
@@ -11507,6 +11513,13 @@ class BrowserCacheManager extends CacheManager {
      * @param storeAuthStateInCookie
      */
     migrateCacheEntries() {
+        const previousVersion = this.browserStorage.getItem(StaticCacheKeys.VERSION);
+        if (previousVersion) {
+            this.logger.info(`MSAL.js was last initialized with version ${previousVersion}`);
+        }
+        if (previousVersion !== version) {
+            this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+        }
         const idTokenKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ID_TOKEN}`;
         const clientInfoKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.CLIENT_INFO}`;
         const errorKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ERROR}`;
@@ -11541,6 +11554,7 @@ class BrowserCacheManager extends CacheManager {
      */
     createKeyMaps() {
         this.logger.trace("BrowserCacheManager - createKeyMaps called.");
+        const correlationId = this.cryptoImpl.createNewGuid();
         const accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
         const tokenKeys = this.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
         if (accountKeys && tokenKeys) {
@@ -11562,8 +11576,8 @@ class BrowserCacheManager extends CacheManager {
                                     this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
                                     this.logger.tracePii(`BrowserCacheManager:createKeyMaps - idToken with key: ${key} found, saving key to token key map`);
                                     const idTokenEntity = credObj;
-                                    const newKey = this.updateCredentialCacheKey(key, idTokenEntity);
-                                    this.addTokenKey(newKey, CredentialType.ID_TOKEN);
+                                    const newKey = this.updateCredentialCacheKey(key, idTokenEntity, correlationId);
+                                    this.addTokenKey(newKey, CredentialType.ID_TOKEN, correlationId);
                                     return;
                                 }
                                 else {
@@ -11577,8 +11591,8 @@ class BrowserCacheManager extends CacheManager {
                                     this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
                                     this.logger.tracePii(`BrowserCacheManager:createKeyMaps - accessToken with key: ${key} found, saving key to token key map`);
                                     const accessTokenEntity = credObj;
-                                    const newKey = this.updateCredentialCacheKey(key, accessTokenEntity);
-                                    this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
+                                    const newKey = this.updateCredentialCacheKey(key, accessTokenEntity, correlationId);
+                                    this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN, correlationId);
                                     return;
                                 }
                                 else {
@@ -11591,8 +11605,8 @@ class BrowserCacheManager extends CacheManager {
                                     this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
                                     this.logger.tracePii(`BrowserCacheManager:createKeyMaps - refreshToken with key: ${key} found, saving key to token key map`);
                                     const refreshTokenEntity = credObj;
-                                    const newKey = this.updateCredentialCacheKey(key, refreshTokenEntity);
-                                    this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
+                                    const newKey = this.updateCredentialCacheKey(key, refreshTokenEntity, correlationId);
+                                    this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN, correlationId);
                                     return;
                                 }
                                 else {
@@ -11613,7 +11627,7 @@ class BrowserCacheManager extends CacheManager {
                         AccountEntity.isAccountEntity(accountObj)) {
                         this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
                         this.logger.tracePii(`BrowserCacheManager:createKeyMaps - account with key: ${key} found, saving key to account key map`);
-                        this.addAccountKeyToMap(key);
+                        this.addAccountKeyToMap(key, correlationId);
                     }
                 }
             }
@@ -11652,17 +11666,58 @@ class BrowserCacheManager extends CacheManager {
      * @param key
      * @param value
      */
-    setItem(key, value) {
-        this.browserStorage.setItem(key, value);
+    setItem(key, value, correlationId) {
+        let accessTokenKeys = [];
+        const maxRetries = 20;
+        for (let i = 0; i <= maxRetries; i++) {
+            try {
+                this.browserStorage.setItem(key, value);
+                if (i > 0) {
+                    // Finally update the token keys array with the tokens removed
+                    this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                }
+                break; // If setItem succeeds, exit the loop
+            }
+            catch (e) {
+                const cacheError = createCacheError(e);
+                if (cacheError.errorCode ===
+                    cacheQuotaExceeded &&
+                    i < maxRetries) {
+                    if (!accessTokenKeys.length) {
+                        if (key ===
+                            `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`) {
+                            // If we are currently trying to set the token keys, use the value we're trying to set
+                            accessTokenKeys = JSON.parse(value)
+                                .accessToken;
+                        }
+                        else {
+                            // If token keys have not been initialized, get them
+                            accessTokenKeys = this.getTokenKeys().accessToken;
+                        }
+                    }
+                    if (accessTokenKeys.length <= i) {
+                        // Nothing to remove, rethrow the error
+                        throw cacheError;
+                    }
+                    // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                    this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                    );
+                }
+                else {
+                    // If the error is not a quota exceeded error, rethrow it
+                    throw cacheError;
+                }
+            }
+        }
     }
     /**
      * fetch the account entity from the platform cache
      * @param accountKey
      */
-    getAccount(accountKey, logger) {
+    getAccount(accountKey, correlationId, logger) {
         this.logger.trace("BrowserCacheManager.getAccount called");
-        const accountEntity = this.getCachedAccountEntity(accountKey);
-        return this.updateOutdatedCachedAccount(accountKey, accountEntity, logger);
+        const accountEntity = this.getCachedAccountEntity(accountKey, correlationId);
+        return this.updateOutdatedCachedAccount(accountKey, accountEntity, correlationId, logger);
     }
     /**
      * Reads account from cache, deserializes it into an account entity and returns it.
@@ -11670,15 +11725,14 @@ class BrowserCacheManager extends CacheManager {
      * @param accountKey
      * @returns
      */
-    getCachedAccountEntity(accountKey) {
+    getCachedAccountEntity(accountKey, correlationId) {
         const serializedAccount = this.getItem(accountKey);
         if (!serializedAccount) {
-            this.removeAccountKeyFromMap(accountKey);
+            this.removeAccountKeyFromMap(accountKey, correlationId);
             return null;
         }
         const parsedAccount = this.validateAndParseJson(serializedAccount);
         if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
-            this.removeAccountKeyFromMap(accountKey);
             return null;
         }
         return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -11687,11 +11741,12 @@ class BrowserCacheManager extends CacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    setAccount(account) {
+    setAccount(account, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccount called");
         const key = account.generateAccountKey();
-        this.setItem(key, JSON.stringify(account));
-        this.addAccountKeyToMap(key);
+        account.lastUpdatedAt = Date.now().toString();
+        this.setItem(key, JSON.stringify(account), correlationId);
+        this.addAccountKeyToMap(key, correlationId);
     }
     /**
      * Returns the array of account keys currently cached
@@ -11710,14 +11765,14 @@ class BrowserCacheManager extends CacheManager {
      * Add a new account to the key map
      * @param key
      */
-    addAccountKeyToMap(key) {
+    addAccountKeyToMap(key, correlationId) {
         this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
         this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${key}`);
         const accountKeys = this.getAccountKeys();
         if (accountKeys.indexOf(key) === -1) {
             // Only add key if it does not already exist in the map
             accountKeys.push(key);
-            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
             this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
         }
         else {
@@ -11728,14 +11783,21 @@ class BrowserCacheManager extends CacheManager {
      * Remove an account from the key map
      * @param key
      */
-    removeAccountKeyFromMap(key) {
+    removeAccountKeyFromMap(key, correlationId) {
         this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
         this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${key}`);
         const accountKeys = this.getAccountKeys();
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+            if (accountKeys.length === 0) {
+                // If no keys left, remove the map
+                this.removeItem(StaticCacheKeys.ACCOUNT_KEYS);
+                return;
+            }
+            else {
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
+            }
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
         }
         else {
@@ -11746,41 +11808,60 @@ class BrowserCacheManager extends CacheManager {
      * Extends inherited removeAccount function to include removal of the account key from the map
      * @param key
      */
-    async removeAccount(key) {
-        void super.removeAccount(key);
-        this.removeAccountKeyFromMap(key);
+    async removeAccount(key, correlationId) {
+        void super.removeAccount(key, correlationId);
+        this.removeAccountKeyFromMap(key, correlationId);
     }
     /**
      * Remove account entity from the platform cache if it's outdated
      * @param accountKey
      */
-    removeOutdatedAccount(accountKey) {
+    removeOutdatedAccount(accountKey, correlationId) {
         this.removeItem(accountKey);
-        this.removeAccountKeyFromMap(accountKey);
+        this.removeAccountKeyFromMap(accountKey, correlationId);
     }
     /**
      * Removes given idToken from the cache and from the key map
      * @param key
      */
-    removeIdToken(key) {
-        super.removeIdToken(key);
-        this.removeTokenKey(key, CredentialType.ID_TOKEN);
+    removeIdToken(key, correlationId) {
+        super.removeIdToken(key, correlationId);
+        this.removeTokenKey(key, CredentialType.ID_TOKEN, correlationId);
     }
     /**
      * Removes given accessToken from the cache and from the key map
      * @param key
      */
-    async removeAccessToken(key) {
-        void super.removeAccessToken(key);
-        this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+    removeAccessToken(key, correlationId, updateTokenKeys = true) {
+        super.removeAccessToken(key, correlationId);
+        this.performanceClient?.incrementFields({ accessTokensRemoved: 1 }, correlationId);
+        updateTokenKeys &&
+            this.removeTokenKey(key, CredentialType.ACCESS_TOKEN, correlationId);
+    }
+    removeAccessTokenKeys(keys, correlationId) {
+        this.logger.trace("removeAccessTokenKey called");
+        const tokenKeys = this.getTokenKeys();
+        let keysRemoved = 0;
+        keys.forEach((key) => {
+            const accessRemoval = tokenKeys.accessToken.indexOf(key);
+            if (accessRemoval > -1) {
+                tokenKeys.accessToken.splice(accessRemoval, 1);
+                keysRemoved++;
+            }
+        });
+        if (keysRemoved > 0) {
+            this.logger.info(`removed ${keysRemoved} accessToken keys from tokenKeys map`);
+            this.setTokenKeys(tokenKeys, correlationId);
+            return;
+        }
     }
     /**
      * Removes given refreshToken from the cache and from the key map
      * @param key
      */
-    removeRefreshToken(key) {
-        super.removeRefreshToken(key);
-        this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+    removeRefreshToken(key, correlationId) {
+        super.removeRefreshToken(key, correlationId);
+        this.removeTokenKey(key, CredentialType.REFRESH_TOKEN, correlationId);
     }
     /**
      * Gets the keys for the cached tokens associated with this clientId
@@ -11810,12 +11891,30 @@ class BrowserCacheManager extends CacheManager {
             refreshToken: [],
         };
     }
+    /**
+     * Stores the token keys in the cache
+     * @param tokenKeys
+     * @param correlationId
+     * @returns
+     */
+    setTokenKeys(tokenKeys, correlationId) {
+        if (tokenKeys.idToken.length === 0 &&
+            tokenKeys.accessToken.length === 0 &&
+            tokenKeys.refreshToken.length === 0) {
+            // If no keys left, remove the map
+            this.removeItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
+            return;
+        }
+        else {
+            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys), correlationId);
+        }
+    }
     /**
      * Adds the given key to the token key map
      * @param key
      * @param type
      */
-    addTokenKey(key, type) {
+    addTokenKey(key, type, correlationId) {
         this.logger.trace("BrowserCacheManager addTokenKey called");
         const tokenKeys = this.getTokenKeys();
         switch (type) {
@@ -11826,10 +11925,12 @@ class BrowserCacheManager extends CacheManager {
                 }
                 break;
             case CredentialType.ACCESS_TOKEN:
-                if (tokenKeys.accessToken.indexOf(key) === -1) {
-                    this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
-                    tokenKeys.accessToken.push(key);
+                const index = tokenKeys.accessToken.indexOf(key);
+                if (index !== -1) {
+                    tokenKeys.accessToken.splice(index, 1); // Remove existing key before pushing to the end
                 }
+                this.logger.trace(`access token ${index === -1 ? "added to" : "updated in"} map`);
+                tokenKeys.accessToken.push(key);
                 break;
             case CredentialType.REFRESH_TOKEN:
                 if (tokenKeys.refreshToken.indexOf(key) === -1) {
@@ -11841,16 +11942,15 @@ class BrowserCacheManager extends CacheManager {
                 this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                 throw createClientAuthError(unexpectedCredentialType);
         }
-        this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+        this.setTokenKeys(tokenKeys, correlationId);
     }
     /**
      * Removes the given key from the token key map
      * @param key
      * @param type
      */
-    removeTokenKey(key, type) {
+    removeTokenKey(key, type, correlationId, tokenKeys = this.getTokenKeys()) {
         this.logger.trace("BrowserCacheManager removeTokenKey called");
-        const tokenKeys = this.getTokenKeys();
         switch (type) {
             case CredentialType.ID_TOKEN:
                 this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${key} from map`);
@@ -11889,23 +11989,22 @@ class BrowserCacheManager extends CacheManager {
                 this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                 throw createClientAuthError(unexpectedCredentialType);
         }
-        this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+        this.setTokenKeys(tokenKeys, correlationId);
     }
     /**
      * generates idToken entity from a string
      * @param idTokenKey
      */
-    getIdTokenCredential(idTokenKey) {
+    getIdTokenCredential(idTokenKey, correlationId) {
         const value = this.getItem(idTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+            this.removeIdToken(idTokenKey, correlationId);
             return null;
         }
         const parsedIdToken = this.validateAndParseJson(value);
         if (!parsedIdToken || !isIdTokenEntity(parsedIdToken)) {
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-            this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -11915,28 +12014,28 @@ class BrowserCacheManager extends CacheManager {
      * set IdToken credential to the platform cache
      * @param idToken
      */
-    setIdTokenCredential(idToken) {
+    setIdTokenCredential(idToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = generateCredentialKey(idToken);
-        this.setItem(idTokenKey, JSON.stringify(idToken));
-        this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+        idToken.lastUpdatedAt = Date.now().toString();
+        this.setItem(idTokenKey, JSON.stringify(idToken), correlationId);
+        this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN, correlationId);
     }
     /**
      * generates accessToken entity from a string
      * @param key
      */
-    getAccessTokenCredential(accessTokenKey) {
+    getAccessTokenCredential(accessTokenKey, correlationId) {
         const value = this.getItem(accessTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN, correlationId);
             return null;
         }
         const parsedAccessToken = this.validateAndParseJson(value);
         if (!parsedAccessToken ||
             !isAccessTokenEntity(parsedAccessToken)) {
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-            this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -11946,28 +12045,28 @@ class BrowserCacheManager extends CacheManager {
      * set accessToken credential to the platform cache
      * @param accessToken
      */
-    setAccessTokenCredential(accessToken) {
+    setAccessTokenCredential(accessToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         const accessTokenKey = generateCredentialKey(accessToken);
-        this.setItem(accessTokenKey, JSON.stringify(accessToken));
-        this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+        accessToken.lastUpdatedAt = Date.now().toString();
+        this.setItem(accessTokenKey, JSON.stringify(accessToken), correlationId);
+        this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN, correlationId);
     }
     /**
      * generates refreshToken entity from a string
      * @param refreshTokenKey
      */
-    getRefreshTokenCredential(refreshTokenKey) {
+    getRefreshTokenCredential(refreshTokenKey, correlationId) {
         const value = this.getItem(refreshTokenKey);
         if (!value) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN, correlationId);
             return null;
         }
         const parsedRefreshToken = this.validateAndParseJson(value);
         if (!parsedRefreshToken ||
             !isRefreshTokenEntity(parsedRefreshToken)) {
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-            this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
             return null;
         }
         this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -11977,11 +12076,12 @@ class BrowserCacheManager extends CacheManager {
      * set refreshToken credential to the platform cache
      * @param refreshToken
      */
-    setRefreshTokenCredential(refreshToken) {
+    setRefreshTokenCredential(refreshToken, correlationId) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         const refreshTokenKey = generateCredentialKey(refreshToken);
-        this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
-        this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+        refreshToken.lastUpdatedAt = Date.now().toString();
+        this.setItem(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
+        this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN, correlationId);
     }
     /**
      * fetch appMetadata entity from the platform cache
@@ -12006,10 +12106,10 @@ class BrowserCacheManager extends CacheManager {
      * set appMetadata entity to the platform cache
      * @param appMetadata
      */
-    setAppMetadata(appMetadata) {
+    setAppMetadata(appMetadata, correlationId) {
         this.logger.trace("BrowserCacheManager.setAppMetadata called");
         const appMetadataKey = generateAppMetadataKey(appMetadata);
-        this.setItem(appMetadataKey, JSON.stringify(appMetadata));
+        this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
     }
     /**
      * fetch server telemetry entity from the platform cache
@@ -12035,9 +12135,9 @@ class BrowserCacheManager extends CacheManager {
      * @param serverTelemetryKey
      * @param serverTelemetry
      */
-    setServerTelemetry(serverTelemetryKey, serverTelemetry) {
+    setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
         this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-        this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+        this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
     }
     /**
      *
@@ -12095,7 +12195,7 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Gets the active account
      */
-    getActiveAccount() {
+    getActiveAccount(correlationId) {
         const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         const activeAccountValueFilters = this.getItem(activeAccountKeyFilters);
         if (!activeAccountValueFilters) {
@@ -12109,11 +12209,11 @@ class BrowserCacheManager extends CacheManager {
             }
             const activeAccount = this.getAccountInfoFilteredBy({
                 localAccountId: activeAccountValueLocal,
-            });
+            }, correlationId);
             if (activeAccount) {
                 this.logger.trace("BrowserCacheManager.getActiveAccount: Legacy active account cache schema found");
                 this.logger.trace("BrowserCacheManager.getActiveAccount: Adding active account filters cache schema");
-                this.setActiveAccount(activeAccount);
+                this.setActiveAccount(activeAccount, correlationId);
                 return activeAccount;
             }
             return null;
@@ -12125,7 +12225,7 @@ class BrowserCacheManager extends CacheManager {
                 homeAccountId: activeAccountValueObj.homeAccountId,
                 localAccountId: activeAccountValueObj.localAccountId,
                 tenantId: activeAccountValueObj.tenantId,
-            });
+            }, correlationId);
         }
         this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
         return null;
@@ -12134,7 +12234,7 @@ class BrowserCacheManager extends CacheManager {
      * Sets the active account's localAccountId in cache
      * @param account
      */
-    setActiveAccount(account) {
+    setActiveAccount(account, correlationId) {
         const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
         const activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
         if (account) {
@@ -12143,9 +12243,10 @@ class BrowserCacheManager extends CacheManager {
                 homeAccountId: account.homeAccountId,
                 localAccountId: account.localAccountId,
                 tenantId: account.tenantId,
+                lastUpdatedAt: Date.now().toString(),
             };
-            this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
-            this.browserStorage.setItem(activeAccountKeyLocal, account.localAccountId);
+            this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
+            this.setItem(activeAccountKeyLocal, account.localAccountId, correlationId);
         }
         else {
             this.logger.verbose("setActiveAccount: No account passed, active account not set");
@@ -12177,9 +12278,9 @@ class BrowserCacheManager extends CacheManager {
      * @param throttlingCacheKey
      * @param throttlingCache
      */
-    setThrottlingCache(throttlingCacheKey, throttlingCache) {
+    setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
         this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-        this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+        this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
     }
     /**
      * Gets cache item with given key.
@@ -12255,10 +12356,10 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Clears all cache entries created by MSAL.
      */
-    async clear() {
+    async clear(correlationId) {
         // Removes all accounts and their credentials
-        await this.removeAllAccounts();
-        this.removeAppMetadata();
+        await this.removeAllAccounts(correlationId);
+        this.removeAppMetadata(correlationId);
         // Remove temp storage first to make sure any cookies are cleared
         this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
             if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
@@ -12284,19 +12385,19 @@ class BrowserCacheManager extends CacheManager {
     async clearTokensAndKeysWithClaims(performanceClient, correlationId) {
         performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
         const tokenKeys = this.getTokenKeys();
-        const removedAccessTokens = [];
+        let removedAccessTokens = 0;
         tokenKeys.accessToken.forEach((key) => {
             // if the access token has claims in its key, remove the token key and the token
-            const credential = this.getAccessTokenCredential(key);
+            const credential = this.getAccessTokenCredential(key, correlationId);
             if (credential?.requestedClaimsHash &&
                 key.includes(credential.requestedClaimsHash.toLowerCase())) {
-                removedAccessTokens.push(this.removeAccessToken(key));
+                this.removeAccessToken(key, correlationId);
+                removedAccessTokens++;
             }
         });
-        await Promise.all(removedAccessTokens);
         // warn if any access tokens are removed
-        if (removedAccessTokens.length > 0) {
-            this.logger.warning(`${removedAccessTokens.length} access tokens with claims in the cache keys have been removed from the cache.`);
+        if (removedAccessTokens > 0) {
+            this.logger.warning(`${removedAccessTokens} access tokens with claims in the cache keys have been removed from the cache.`);
         }
     }
     /**
@@ -12571,13 +12672,13 @@ class BrowserCacheManager extends CacheManager {
     /**
      * Updates a credential's cache key if the current cache key is outdated
      */
-    updateCredentialCacheKey(currentCacheKey, credential) {
+    updateCredentialCacheKey(currentCacheKey, credential, correlationId) {
         const updatedCacheKey = generateCredentialKey(credential);
         if (currentCacheKey !== updatedCacheKey) {
             const cacheItem = this.getItem(currentCacheKey);
             if (cacheItem) {
                 this.browserStorage.removeItem(currentCacheKey);
-                this.setItem(updatedCacheKey, cacheItem);
+                this.setItem(updatedCacheKey, cacheItem, correlationId);
                 this.logger.verbose(`Updated an outdated ${credential.credentialType} cache key`);
                 return updatedCacheKey;
             }
@@ -12612,7 +12713,7 @@ class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord);
+        return this.saveCacheRecord(cacheRecord, result.correlationId);
     }
     /**
      * saves a cache record
@@ -12620,9 +12721,9 @@ class BrowserCacheManager extends CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
         try {
-            await super.saveCacheRecord(cacheRecord, storeInCache, correlationId);
+            await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
         }
         catch (e) {
             if (e instanceof CacheError &&
@@ -12663,22 +12764,24 @@ const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
  * @param accountFilter - (Optional) filter to narrow down the accounts returned
  * @returns Array of AccountInfo objects in cache
  */
-function getAllAccounts(logger, browserStorage, isInBrowser, accountFilter) {
+function getAllAccounts(logger, browserStorage, isInBrowser, correlationId, accountFilter) {
     logger.verbose("getAllAccounts called");
-    return isInBrowser ? browserStorage.getAllAccounts(accountFilter) : [];
+    return isInBrowser
+        ? browserStorage.getAllAccounts(correlationId, accountFilter)
+        : [];
 }
 /**
  * Returns the first account found in the cache that matches the account filter passed in.
  * @param accountFilter
  * @returns The first account found in the cache matching the provided filter or null if no account could be found.
  */
-function getAccount(accountFilter, logger, browserStorage) {
+function getAccount(accountFilter, logger, browserStorage, correlationId) {
     logger.trace("getAccount called");
     if (Object.keys(accountFilter).length === 0) {
         logger.warning("getAccount: No accountFilter provided");
         return null;
     }
-    const account = browserStorage.getAccountInfoFilteredBy(accountFilter);
+    const account = browserStorage.getAccountInfoFilteredBy(accountFilter, correlationId);
     if (account) {
         logger.verbose("getAccount: Account matching provided filter found, returning");
         return account;
@@ -12696,7 +12799,7 @@ function getAccount(accountFilter, logger, browserStorage) {
  * @param username
  * @returns The account object stored in MSAL
  */
-function getAccountByUsername(username, logger, browserStorage) {
+function getAccountByUsername(username, logger, browserStorage, correlationId) {
     logger.trace("getAccountByUsername called");
     if (!username) {
         logger.warning("getAccountByUsername: No username provided");
@@ -12704,7 +12807,7 @@ function getAccountByUsername(username, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         username,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByUsername: Account matching username found, returning");
         logger.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${username}`);
@@ -12722,7 +12825,7 @@ function getAccountByUsername(username, logger, browserStorage) {
  * @param homeAccountId
  * @returns The account object stored in MSAL
  */
-function getAccountByHomeId(homeAccountId, logger, browserStorage) {
+function getAccountByHomeId(homeAccountId, logger, browserStorage, correlationId) {
     logger.trace("getAccountByHomeId called");
     if (!homeAccountId) {
         logger.warning("getAccountByHomeId: No homeAccountId provided");
@@ -12730,7 +12833,7 @@ function getAccountByHomeId(homeAccountId, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         homeAccountId,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
         logger.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${homeAccountId}`);
@@ -12748,7 +12851,7 @@ function getAccountByHomeId(homeAccountId, logger, browserStorage) {
  * @param localAccountId
  * @returns The account object stored in MSAL
  */
-function getAccountByLocalId(localAccountId, logger, browserStorage) {
+function getAccountByLocalId(localAccountId, logger, browserStorage, correlationId) {
     logger.trace("getAccountByLocalId called");
     if (!localAccountId) {
         logger.warning("getAccountByLocalId: No localAccountId provided");
@@ -12756,7 +12859,7 @@ function getAccountByLocalId(localAccountId, logger, browserStorage) {
     }
     const account = browserStorage.getAccountInfoFilteredBy({
         localAccountId,
-    });
+    }, correlationId);
     if (account) {
         logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
         logger.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${localAccountId}`);
@@ -12771,14 +12874,14 @@ function getAccountByLocalId(localAccountId, logger, browserStorage) {
  * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
  * @param account
  */
-function setActiveAccount(account, browserStorage) {
-    browserStorage.setActiveAccount(account);
+function setActiveAccount(account, browserStorage, correlationId) {
+    browserStorage.setActiveAccount(account, correlationId);
 }
 /**
  * Gets the currently active account
  */
-function getActiveAccount(browserStorage) {
-    return browserStorage.getActiveAccount();
+function getActiveAccount(browserStorage, correlationId) {
+    return browserStorage.getActiveAccount(correlationId);
 }
 
 /*
@@ -12896,13 +12999,13 @@ class BaseInteractionClient {
     }
     async clearCacheOnLogout(account) {
         if (account) {
-            if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(), false)) {
+            if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(this.correlationId), false)) {
                 this.logger.verbose("Setting active account to null");
-                this.browserStorage.setActiveAccount(null);
+                this.browserStorage.setActiveAccount(null, this.correlationId);
             }
             // Clear given account.
             try {
-                await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account));
+                await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), this.correlationId);
                 this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.");
             }
             catch (error) {
@@ -12913,7 +13016,7 @@ class BaseInteractionClient {
             try {
                 this.logger.verbose("No account provided in logout request, clearing all cache items.", this.correlationId);
                 // Clear all accounts and tokens
-                await this.browserStorage.clear();
+                await this.browserStorage.clear(this.correlationId);
                 // Clear any stray keys from IndexedDB
                 await this.browserCrypto.clearKeystore();
             }
@@ -13307,7 +13410,8 @@ class StandardInteractionClient extends BaseInteractionClient {
         if (request.loginHint || request.sid) {
             return validatedRequest;
         }
-        const account = request.account || this.browserStorage.getActiveAccount();
+        const account = request.account ||
+            this.browserStorage.getActiveAccount(this.correlationId);
         if (account) {
             this.logger.verbose("Setting validated request account", this.correlationId);
             this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
@@ -13580,7 +13684,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         // fetch the account from browser cache
         const account = this.browserStorage.getBaseAccountInfo({
             nativeAccountId,
-        });
+        }, request.correlationId);
         if (!account) {
             throw createClientAuthError(noAccountFound);
         }
@@ -13707,7 +13811,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
         const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
             nativeAccountId: request.accountId,
-        })?.homeAccountId;
+        }, this.correlationId)?.homeAccountId;
         if (homeAccountIdentifier !== cachedhomeAccountId &&
             response.account.id !== request.accountId) {
             // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
@@ -13717,7 +13821,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         const authority = await this.getDiscoveredAuthority({
             requestAuthority: request.authority,
         });
-        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+        const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
         idTokenClaims.tid, undefined, // auth code payload
         response.account.id, this.logger);
         // generate authenticationResult
@@ -13850,9 +13954,11 @@ class NativeInteractionClient extends BaseInteractionClient {
      */
     cacheAccount(accountEntity) {
         // Store the account info and hence `nativeAccountId` in browser cache
-        this.browserStorage.setAccount(accountEntity);
+        this.browserStorage.setAccount(accountEntity, this.correlationId);
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
+        this.browserStorage
+            .removeAccountContext(accountEntity, this.correlationId)
+            .catch((e) => {
             this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
         });
     }
@@ -13881,7 +13987,7 @@ class NativeInteractionClient extends BaseInteractionClient {
             idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
-        void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
+        void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.correlationId, request.storeInCache);
     }
     addTelemetryFromNativeResponse(response) {
         const mats = this.getMATSFromResponse(response);
@@ -14657,7 +14763,7 @@ class PopupClient extends StandardInteractionClient {
                 if (validRequest.account?.homeAccountId &&
                     validRequest.postLogoutRedirectUri &&
                     authClient.authority.protocolMode === ProtocolMode.OIDC) {
-                    void this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                    void this.browserStorage.removeAccount(validRequest.account?.homeAccountId, this.correlationId);
                     this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
                     if (mainWindowRedirectUri) {
                         const navigationOptions = {
@@ -15332,7 +15438,7 @@ class RedirectClient extends StandardInteractionClient {
                 }
                 catch {
                     if (validLogoutRequest.account?.homeAccountId) {
-                        void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                        void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId, this.correlationId);
                         this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
                         return;
                     }
@@ -15732,6 +15838,7 @@ class TokenCache {
         if (!this.isBrowserEnvironment) {
             throw createBrowserAuthError(nonBrowserEnvironment);
         }
+        const correlationId = request.correlationId || createNewGuid();
         const idTokenClaims = response.id_token
             ? extractTokenClaims(response.id_token, base64Decode)
             : undefined;
@@ -15745,10 +15852,10 @@ class TokenCache {
         const authority = request.authority
             ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
             : undefined;
-        const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", idTokenClaims, authority);
-        const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm);
-        const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options);
-        const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment);
+        const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
+        const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
+        const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
+        const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
         return this.generateAuthenticationResult(request, {
             account: cacheRecordAccount,
             idToken,
@@ -15765,11 +15872,11 @@ class TokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    loadAccount(request, clientInfo, idTokenClaims, authority) {
+    loadAccount(request, clientInfo, correlationId, idTokenClaims, authority) {
         this.logger.verbose("TokenCache - loading account");
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-            this.storage.setAccount(accountEntity);
+            this.storage.setAccount(accountEntity, correlationId);
             return accountEntity;
         }
         else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -15778,10 +15885,10 @@ class TokenCache {
         }
         const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
         const claimsTenantId = idTokenClaims?.tid;
-        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+        const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
-        this.storage.setAccount(cachedAccount);
+        this.storage.setAccount(cachedAccount, correlationId);
         return cachedAccount;
     }
     /**
@@ -15792,14 +15899,14 @@ class TokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    loadIdToken(response, homeAccountId, environment, tenantId) {
+    loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
             return null;
         }
         this.logger.verbose("TokenCache - loading id token");
         const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-        this.storage.setIdTokenCredential(idTokenEntity);
+        this.storage.setIdTokenCredential(idTokenEntity, correlationId);
         return idTokenEntity;
     }
     /**
@@ -15811,7 +15918,7 @@ class TokenCache {
      * @param tenantId
      * @returns `AccessTokenEntity`
      */
-    loadAccessToken(request, response, homeAccountId, environment, tenantId, options) {
+    loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
         if (!response.access_token) {
             this.logger.verbose("TokenCache - no access token found in response");
             return null;
@@ -15835,7 +15942,7 @@ class TokenCache {
             (response.ext_expires_in || response.expires_in) +
                 new Date().getTime() / 1000;
         const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-        this.storage.setAccessTokenCredential(accessTokenEntity);
+        this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
         return accessTokenEntity;
     }
     /**
@@ -15846,7 +15953,7 @@ class TokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    loadRefreshToken(response, homeAccountId, environment) {
+    loadRefreshToken(response, homeAccountId, environment, correlationId) {
         if (!response.refresh_token) {
             this.logger.verbose("TokenCache - no refresh token found in response");
             return null;
@@ -15854,7 +15961,7 @@ class TokenCache {
         this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
         response.refresh_token_expires_in);
-        this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
         return refreshTokenEntity;
     }
     /**
@@ -16763,7 +16870,8 @@ class StandardController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, accountFilter);
+        const correlationId = this.getRequestCorrelationId();
+        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, correlationId, accountFilter);
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
@@ -16771,7 +16879,8 @@ class StandardController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter) {
-        return getAccount(accountFilter, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching username.
@@ -16782,7 +16891,8 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username) {
-        return getAccountByUsername(username, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching homeAccountId.
@@ -16792,7 +16902,8 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId) {
-        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching localAccountId.
@@ -16802,20 +16913,23 @@ class StandardController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId) {
-        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
      * @param account
      */
     setActiveAccount(account) {
-        setActiveAccount(account, this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        setActiveAccount(account, this.browserStorage, correlationId);
     }
     /**
      * Gets the currently active account
      */
     getActiveAccount() {
-        return getActiveAccount(this.browserStorage);
+        const correlationId = this.getRequestCorrelationId();
+        return getActiveAccount(this.browserStorage, correlationId);
     }
     // #endregion
     /**
@@ -16828,7 +16942,7 @@ class StandardController {
         this.logger.verbose("hydrateCache called");
         // Account gets saved to browser storage regardless of native or not
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        this.browserStorage.setAccount(accountEntity);
+        this.browserStorage.setAccount(accountEntity, result.correlationId);
         if (result.fromNativeBroker) {
             this.logger.verbose("Response was from native broker, storing in-memory");
             // Tokens from native broker are stored in-memory
@@ -17601,7 +17715,7 @@ class NestedAppAuthController {
         this.performanceClient = this.config.telemetry.client;
         // Initialize the crypto class.
         this.browserCrypto = operatingContext.isBrowserEnvironment()
-            ? new CryptoOps(this.logger, this.performanceClient)
+            ? new CryptoOps(this.logger, this.performanceClient, true)
             : DEFAULT_CRYPTO_IMPLEMENTATION;
         // Initialize the browser storage class.
         this.browserStorage = this.operatingContext.isBrowserEnvironment()
@@ -17612,8 +17726,9 @@ class NestedAppAuthController {
         // Set the active account if available
         const accountContext = this.bridgeProxy.getAccountContext();
         if (accountContext) {
-            const cachedAccount = getAccount(accountContext, this.logger, this.browserStorage);
-            setActiveAccount(cachedAccount, this.browserStorage);
+            const correlationId = createNewGuid();
+            const cachedAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
+            setActiveAccount(cachedAccount, this.browserStorage, correlationId);
         }
     }
     /**
@@ -17666,7 +17781,7 @@ class NestedAppAuthController {
             };
             // cache the tokens in the response
             await this.hydrateCache(result, request);
-            this.browserStorage.setActiveAccount(result.account);
+            this.browserStorage.setActiveAccount(result.account, result.correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
             atPopupMeasurement.add({
                 accessTokenSize: result.accessToken.length,
@@ -17716,7 +17831,7 @@ class NestedAppAuthController {
             const result = this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp);
             // cache the tokens in the response
             await this.hydrateCache(result, request);
-            this.browserStorage.setActiveAccount(result.account);
+            this.browserStorage.setActiveAccount(result.account, result.correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, result);
             ssoSilentMeasurement?.add({
                 accessTokenSize: result.accessToken.length,
@@ -17787,10 +17902,11 @@ class NestedAppAuthController {
      * @returns
      */
     async acquireTokenFromCacheInternal(request) {
+        const correlationId = request.correlationId || createNewGuid();
         const accountContext = this.bridgeProxy.getAccountContext();
         let currentAccount = null;
         if (accountContext) {
-            const hubAccount = getAccount(accountContext, this.logger, this.browserStorage);
+            const hubAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
             // always prioritize for hub account context, the reqirement of `request.account` will be removed soon
             currentAccount = hubAccount || request.account;
         }
@@ -17802,7 +17918,7 @@ class NestedAppAuthController {
         this.logger.verbose("active account found, attempting to acquire token silently");
         const authRequest = {
             ...request,
-            correlationId: request.correlationId || this.browserCrypto.createNewGuid(),
+            correlationId: correlationId,
             authority: request.authority || currentAccount.environment,
             scopes: request.scopes?.length
                 ? request.scopes
@@ -17810,7 +17926,7 @@ class NestedAppAuthController {
         };
         // fetch access token and check for expiry
         const tokenKeys = this.browserStorage.getTokenKeys();
-        const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+        const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient);
         // If there is no access token, log it and return null
         if (!cachedAccessToken) {
             this.logger.verbose("No cached access token found");
@@ -17821,7 +17937,7 @@ class NestedAppAuthController {
             this.logger.verbose("Cached access token has expired");
             return Promise.resolve(null);
         }
-        const cachedIdToken = this.browserStorage.getIdToken(currentAccount, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+        const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId, this.performanceClient);
         if (!cachedIdToken) {
             this.logger.verbose("No cached id token found");
             return Promise.resolve(null);
@@ -17918,7 +18034,8 @@ class NestedAppAuthController {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), accountFilter);
+        const correlationId = createNewGuid();
+        return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), correlationId, accountFilter);
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
@@ -17926,7 +18043,8 @@ class NestedAppAuthController {
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
     getAccount(accountFilter) {
-        return getAccount(accountFilter, this.logger, this.browserStorage);
+        const correlationId = createNewGuid();
+        return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching username.
@@ -17937,7 +18055,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByUsername(username) {
-        return getAccountByUsername(username, this.logger, this.browserStorage);
+        const correlationId = createNewGuid();
+        return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching homeAccountId.
@@ -17947,7 +18066,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByHomeId(homeAccountId) {
-        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+        const correlationId = createNewGuid();
+        return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Returns the signed in account matching localAccountId.
@@ -17957,7 +18077,8 @@ class NestedAppAuthController {
      * @returns The account object stored in MSAL
      */
     getAccountByLocalId(localAccountId) {
-        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+        const correlationId = createNewGuid();
+        return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
     }
     /**
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
@@ -17968,13 +18089,15 @@ class NestedAppAuthController {
          * StandardController uses this to allow the developer to set the active account
          * in the nested app auth scenario the active account is controlled by the app hosting the nested app
          */
-        return setActiveAccount(account, this.browserStorage);
+        const correlationId = createNewGuid();
+        return setActiveAccount(account, this.browserStorage, correlationId);
     }
     /**
      * Gets the currently active account
      */
     getActiveAccount() {
-        return getActiveAccount(this.browserStorage);
+        const correlationId = createNewGuid();
+        return getActiveAccount(this.browserStorage, correlationId);
     }
     // #endregion
     handleRedirectPromise(hash // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -18056,7 +18179,7 @@ class NestedAppAuthController {
     async hydrateCache(result, request) {
         this.logger.verbose("hydrateCache called");
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        this.browserStorage.setAccount(accountEntity);
+        this.browserStorage.setAccount(accountEntity, result.correlationId);
         return this.browserStorage.hydrateCache(result, request);
     }
 }