@azure/msal-browser 3.28.0 → 3.30.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.28.0 2024-12-12 */
+/*! @azure/msal-browser v3.30.0 2025-08-05 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -316,7 +316,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -333,7 +333,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -382,7 +382,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -480,7 +480,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -732,7 +732,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -771,7 +771,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -962,12 +962,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.16.0";
+    const version$1 = "14.16.1";
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -987,7 +987,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1048,7 +1048,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1085,7 +1085,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1412,7 +1412,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1466,7 +1466,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1604,7 +1604,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1701,7 +1701,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1901,7 +1901,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1941,7 +1941,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2020,7 +2020,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2035,7 +2035,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2057,7 +2057,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2070,7 +2070,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2313,7 +2313,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2360,7 +2360,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2524,7 +2524,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2664,23 +2664,23 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
-    const cacheUnknownErrorCode = "cache_error_unknown";
+    const cacheQuotaExceeded = "cache_quota_exceeded";
+    const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     const CacheErrorMessages = {
-        [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
-        [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+        [cacheQuotaExceeded]: "Exceeded cache storage capacity.",
+        [cacheErrorUnknown]: "Unexpected error occurred when using cache storage.",
     };
     /**
      * Error thrown when there is an error with the cache
@@ -2690,16 +2690,34 @@
             const message = errorMessage ||
                 (CacheErrorMessages[errorCode]
                     ? CacheErrorMessages[errorCode]
-                    : CacheErrorMessages[cacheUnknownErrorCode]);
+                    : CacheErrorMessages[cacheErrorUnknown]);
             super(`${errorCode}: ${message}`);
             Object.setPrototypeOf(this, CacheError.prototype);
             this.name = "CacheError";
             this.errorCode = errorCode;
             this.errorMessage = message;
         }
+    }
+    /**
+     * Helper function to wrap browser errors in a CacheError object
+     * @param e
+     * @returns
+     */
+    function createCacheError(e) {
+        if (!(e instanceof Error)) {
+            return new CacheError(cacheErrorUnknown);
+        }
+        if (e.name === "QuotaExceededError" ||
+            e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+            e.message.includes("exceeded the quota")) {
+            return new CacheError(cacheQuotaExceeded);
+        }
+        else {
+            return new CacheError(e.name, e.message);
+        }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2721,14 +2739,14 @@
          * @param accountFilter - (Optional) filter to narrow down the accounts returned
          * @returns Array of AccountInfo objects in cache
          */
-        getAllAccounts(accountFilter) {
-            return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
+        getAllAccounts(correlationId, accountFilter) {
+            return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}, correlationId), correlationId, accountFilter);
         }
         /**
          * Gets first tenanted AccountInfo object found based on provided filters
          */
-        getAccountInfoFilteredBy(accountFilter) {
-            const allAccounts = this.getAllAccounts(accountFilter);
+        getAccountInfoFilteredBy(accountFilter, correlationId) {
+            const allAccounts = this.getAllAccounts(correlationId, accountFilter);
             if (allAccounts.length > 1) {
                 // If one or more accounts are found, prioritize accounts that have an ID token
                 const sortedAccounts = allAccounts.sort((account) => {
@@ -2749,8 +2767,8 @@
          * @param accountFilter
          * @returns
          */
-        getBaseAccountInfo(accountFilter) {
-            const accountEntities = this.getAccountsFilteredBy(accountFilter);
+        getBaseAccountInfo(accountFilter, correlationId) {
+            const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
             if (accountEntities.length > 0) {
                 return accountEntities[0].getAccountInfo();
             }
@@ -2765,12 +2783,12 @@
          * @param accountFilter
          * @returns Array of AccountInfo objects that match account and tenant profile filters
          */
-        buildTenantProfiles(cachedAccounts, accountFilter) {
+        buildTenantProfiles(cachedAccounts, correlationId, accountFilter) {
             return cachedAccounts.flatMap((accountEntity) => {
-                return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+                return this.getTenantProfilesFromAccountEntity(accountEntity, correlationId, accountFilter?.tenantId, accountFilter);
             });
         }
-        getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+        getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter) {
             let tenantedAccountInfo = null;
             let idTokenClaims;
             if (tenantProfileFilter) {
@@ -2778,7 +2796,7 @@
                     return null;
                 }
             }
-            const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
+            const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
             if (idToken) {
                 idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
                 if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
@@ -2790,7 +2808,7 @@
             tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims, idToken?.secret);
             return tenantedAccountInfo;
         }
-        getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+        getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
             const accountInfo = accountEntity.getAccountInfo();
             let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
             const tokenKeys = this.getTokenKeys();
@@ -2810,7 +2828,7 @@
             }
             const matchingTenantProfiles = [];
             searchTenantProfiles.forEach((tenantProfile) => {
-                const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+                const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, correlationId, tenantProfileFilter);
                 if (tenantedAccountInfo) {
                     matchingTenantProfiles.push(tenantedAccountInfo);
                 }
@@ -2864,46 +2882,36 @@
          * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
          */
-        async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+        async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
             if (!cacheRecord) {
                 throw createClientAuthError(invalidCacheRecord);
             }
             try {
                 if (!!cacheRecord.account) {
-                    this.setAccount(cacheRecord.account);
+                    this.setAccount(cacheRecord.account, correlationId);
                 }
                 if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                    this.setIdTokenCredential(cacheRecord.idToken);
+                    this.setIdTokenCredential(cacheRecord.idToken, correlationId);
                 }
                 if (!!cacheRecord.accessToken &&
                     storeInCache?.accessToken !== false) {
-                    await this.saveAccessToken(cacheRecord.accessToken);
+                    await this.saveAccessToken(cacheRecord.accessToken, correlationId);
                 }
                 if (!!cacheRecord.refreshToken &&
                     storeInCache?.refreshToken !== false) {
-                    this.setRefreshTokenCredential(cacheRecord.refreshToken);
+                    this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
                 }
                 if (!!cacheRecord.appMetadata) {
-                    this.setAppMetadata(cacheRecord.appMetadata);
+                    this.setAppMetadata(cacheRecord.appMetadata, correlationId);
                 }
             }
             catch (e) {
                 this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
-                if (e instanceof Error) {
-                    this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
-                    if (e.name === "QuotaExceededError" ||
-                        e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
-                        e.message.includes("exceeded the quota")) {
-                        this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
-                        throw new CacheError(cacheQuotaExceededErrorCode);
-                    }
-                    else {
-                        throw new CacheError(e.name, e.message);
-                    }
+                if (e instanceof AuthError) {
+                    throw e;
                 }
                 else {
-                    this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
-                    throw new CacheError(cacheUnknownErrorCode);
+                    throw createCacheError(e);
                 }
             }
         }
@@ -2911,7 +2919,7 @@
          * saves access token credential
          * @param credential
          */
-        async saveAccessToken(credential) {
+        async saveAccessToken(credential, correlationId) {
             const accessTokenFilter = {
                 clientId: credential.clientId,
                 credentialType: credential.credentialType,
@@ -2923,29 +2931,27 @@
             };
             const tokenKeys = this.getTokenKeys();
             const currentScopes = ScopeSet.fromString(credential.target);
-            const removedAccessTokens = [];
             tokenKeys.accessToken.forEach((key) => {
                 if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                     return;
                 }
-                const tokenEntity = this.getAccessTokenCredential(key);
+                const tokenEntity = this.getAccessTokenCredential(key, correlationId);
                 if (tokenEntity &&
                     this.credentialMatchesFilter(tokenEntity, accessTokenFilter)) {
                     const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
                     if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                        removedAccessTokens.push(this.removeAccessToken(key));
+                        this.removeAccessToken(key, correlationId);
                     }
                 }
             });
-            await Promise.all(removedAccessTokens);
-            this.setAccessTokenCredential(credential);
+            this.setAccessTokenCredential(credential, correlationId);
         }
         /**
          * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
          * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
          * @param accountFilter - An object containing Account properties to filter by
          */
-        getAccountsFilteredBy(accountFilter) {
+        getAccountsFilteredBy(accountFilter, correlationId) {
             const allAccountKeys = this.getAccountKeys();
             const matchingAccounts = [];
             allAccountKeys.forEach((cacheKey) => {
@@ -2953,7 +2959,7 @@
                     // Don't parse value if the key doesn't match the account filters
                     return;
                 }
-                const entity = this.getAccount(cacheKey, this.commonLogger);
+                const entity = this.getAccount(cacheKey, correlationId, this.commonLogger);
                 // Match base account fields
                 if (!entity) {
                     return;
@@ -3179,11 +3185,11 @@
         /**
          * Removes all accounts and related tokens from cache.
          */
-        async removeAllAccounts() {
+        async removeAllAccounts(correlationId) {
             const allAccountKeys = this.getAccountKeys();
             const removedAccounts = [];
             allAccountKeys.forEach((cacheKey) => {
-                removedAccounts.push(this.removeAccount(cacheKey));
+                removedAccounts.push(this.removeAccount(cacheKey, correlationId));
             });
             await Promise.all(removedAccounts);
         }
@@ -3191,38 +3197,41 @@
          * Removes the account and related tokens for a given account key
          * @param account
          */
-        async removeAccount(accountKey) {
-            const account = this.getAccount(accountKey, this.commonLogger);
+        async removeAccount(accountKey, correlationId) {
+            const account = this.getAccount(accountKey, correlationId, this.commonLogger);
             if (!account) {
                 return;
             }
-            await this.removeAccountContext(account);
-            this.removeItem(accountKey);
+            await this.removeAccountContext(account, correlationId);
+            this.removeItem(accountKey, correlationId);
         }
         /**
          * Removes credentials associated with the provided account
          * @param account
          */
-        async removeAccountContext(account) {
+        async removeAccountContext(account, correlationId) {
             const allTokenKeys = this.getTokenKeys();
             const accountId = account.generateAccountId();
-            const removedCredentials = [];
             allTokenKeys.idToken.forEach((key) => {
                 if (key.indexOf(accountId) === 0) {
-                    this.removeIdToken(key);
+                    this.removeIdToken(key, correlationId);
                 }
             });
             allTokenKeys.accessToken.forEach((key) => {
                 if (key.indexOf(accountId) === 0) {
-                    removedCredentials.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
                 }
             });
             allTokenKeys.refreshToken.forEach((key) => {
                 if (key.indexOf(accountId) === 0) {
-                    this.removeRefreshToken(key);
+                    this.removeRefreshToken(key, correlationId);
+                }
+            });
+            this.getKeys().forEach((key) => {
+                if (key.includes(accountId)) {
+                    this.removeItem(key, correlationId);
                 }
             });
-            await Promise.all(removedCredentials);
         }
         /**
          * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
@@ -3232,7 +3241,7 @@
          * @param logger
          * @returns
          */
-        updateOutdatedCachedAccount(accountKey, accountEntity, logger) {
+        updateOutdatedCachedAccount(accountKey, accountEntity, correlationId, logger) {
             // Only update if account entity is defined and has no tenantProfiles object (is outdated)
             if (accountEntity && accountEntity.isSingleTenant()) {
                 this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");
@@ -3243,7 +3252,7 @@
                 // Get all account entities belonging to user
                 const accountsToMerge = [];
                 matchingAccountKeys.forEach((key) => {
-                    const account = this.getCachedAccountEntity(key);
+                    const account = this.getCachedAccountEntity(key, correlationId);
                     if (account) {
                         accountsToMerge.push(account);
                     }
@@ -3268,11 +3277,11 @@
                 // Clear cache of legacy account objects that have been collpsed into tenant profiles
                 matchingAccountKeys.forEach((key) => {
                     if (key !== newAccountKey) {
-                        this.removeOutdatedAccount(accountKey);
+                        this.removeOutdatedAccount(accountKey, correlationId);
                     }
                 });
                 // Cache updated account object
-                this.setAccount(updatedAccount);
+                this.setAccount(updatedAccount, correlationId);
                 logger?.verbose("Updated an outdated account entity in the cache");
                 return updatedAccount;
             }
@@ -3283,37 +3292,31 @@
          * returns a boolean if the given credential is removed
          * @param credential
          */
-        async removeAccessToken(key) {
-            const credential = this.getAccessTokenCredential(key);
-            if (!credential) {
+        removeAccessToken(key, correlationId) {
+            const credential = this.getAccessTokenCredential(key, correlationId);
+            this.removeItem(key, correlationId);
+            if (!credential ||
+                credential.credentialType.toLowerCase() !==
+                    CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase() ||
+                credential.tokenType !== AuthenticationScheme.POP) {
                 return;
             }
             // Remove Token Binding Key from key store for PoP Tokens Credentials
-            if (credential.credentialType.toLowerCase() ===
-                CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()) {
-                if (credential.tokenType === AuthenticationScheme.POP) {
-                    const accessTokenWithAuthSchemeEntity = credential;
-                    const kid = accessTokenWithAuthSchemeEntity.keyId;
-                    if (kid) {
-                        try {
-                            await this.cryptoImpl.removeTokenBindingKey(kid);
-                        }
-                        catch (error) {
-                            throw createClientAuthError(bindingKeyNotRemoved);
-                        }
-                    }
-                }
+            const kid = credential.keyId;
+            if (kid) {
+                void this.cryptoImpl.removeTokenBindingKey(kid).catch(() => {
+                    this.commonLogger.error("Binding key could not be removed");
+                });
             }
-            return this.removeItem(key);
         }
         /**
          * Removes all app metadata objects from cache.
          */
-        removeAppMetadata() {
+        removeAppMetadata(correlationId) {
             const allCacheKeys = this.getKeys();
             allCacheKeys.forEach((cacheKey) => {
                 if (this.isAppMetadata(cacheKey)) {
-                    this.removeItem(cacheKey);
+                    this.removeItem(cacheKey, correlationId);
                 }
             });
             return true;
@@ -3322,9 +3325,9 @@
          * Retrieve AccountEntity from cache
          * @param account
          */
-        readAccountFromCache(account) {
+        readAccountFromCache(account, correlationId) {
             const accountKey = AccountEntity.generateAccountCacheKey(account);
-            return this.getAccount(accountKey, this.commonLogger);
+            return this.getAccount(accountKey, correlationId, this.commonLogger);
         }
         /**
          * Retrieve IdTokenEntity from cache
@@ -3334,7 +3337,7 @@
          * @param performanceClient {?IPerformanceClient}
          * @param correlationId {?string}
          */
-        getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
+        getIdToken(account, correlationId, tokenKeys, targetRealm, performanceClient) {
             this.commonLogger.trace("CacheManager - getIdToken called");
             const idTokenFilter = {
                 homeAccountId: account.homeAccountId,
@@ -3343,7 +3346,7 @@
                 clientId: this.clientId,
                 realm: targetRealm,
             };
-            const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+            const idTokenMap = this.getIdTokensByFilter(idTokenFilter, correlationId, tokenKeys);
             const numIdTokens = idTokenMap.size;
             if (numIdTokens < 1) {
                 this.commonLogger.info("CacheManager:getIdToken - No token found");
@@ -3376,7 +3379,7 @@
                 // Multiple tokens for a single tenant profile, remove all and return null
                 this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
                 tokensToBeRemoved.forEach((idToken, key) => {
-                    this.removeIdToken(key);
+                    this.removeIdToken(key, correlationId);
                 });
                 if (performanceClient && correlationId) {
                     performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
@@ -3391,7 +3394,7 @@
          * @param filter
          * @returns
          */
-        getIdTokensByFilter(filter, tokenKeys) {
+        getIdTokensByFilter(filter, correlationId, tokenKeys) {
             const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
             const idTokens = new Map();
             idTokenKeys.forEach((key) => {
@@ -3401,7 +3404,7 @@
                 })) {
                     return;
                 }
-                const idToken = this.getIdTokenCredential(key);
+                const idToken = this.getIdTokenCredential(key, correlationId);
                 if (idToken && this.credentialMatchesFilter(idToken, filter)) {
                     idTokens.set(key, idToken);
                 }
@@ -3430,15 +3433,15 @@
          * Removes idToken from the cache
          * @param key
          */
-        removeIdToken(key) {
-            this.removeItem(key);
+        removeIdToken(key, correlationId) {
+            this.removeItem(key, correlationId);
         }
         /**
          * Removes refresh token from the cache
          * @param key
          */
-        removeRefreshToken(key) {
-            this.removeItem(key);
+        removeRefreshToken(key, correlationId) {
+            this.removeItem(key, correlationId);
         }
         /**
          * Retrieve AccessTokenEntity from cache
@@ -3448,7 +3451,7 @@
          * @param performanceClient {?IPerformanceClient}
          * @param correlationId {?string}
          */
-        getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
+        getAccessToken(account, request, tokenKeys, targetRealm, performanceClient) {
             this.commonLogger.trace("CacheManager - getAccessToken called");
             const scopes = ScopeSet.createSearchScopes(request.scopes);
             const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -3478,7 +3481,7 @@
             accessTokenKeys.forEach((key) => {
                 // Validate key
                 if (this.accessTokenKeyMatchesFilter(key, accessTokenFilter, true)) {
-                    const accessToken = this.getAccessTokenCredential(key);
+                    const accessToken = this.getAccessTokenCredential(key, request.correlationId);
                     // Validate value
                     if (accessToken &&
                         this.credentialMatchesFilter(accessToken, accessTokenFilter)) {
@@ -3494,10 +3497,10 @@
             else if (numAccessTokens > 1) {
                 this.commonLogger.info("CacheManager:getAccessToken - Multiple access tokens found, clearing them");
                 accessTokens.forEach((accessToken) => {
-                    void this.removeAccessToken(generateCredentialKey(accessToken));
+                    void this.removeAccessToken(generateCredentialKey(accessToken), request.correlationId);
                 });
-                if (performanceClient && correlationId) {
-                    performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
+                if (performanceClient && request.correlationId) {
+                    performanceClient.addFields({ multiMatchedAT: accessTokens.length }, request.correlationId);
                 }
                 return null;
             }
@@ -3550,14 +3553,14 @@
          * @param filter
          * @returns
          */
-        getAccessTokensByFilter(filter) {
+        getAccessTokensByFilter(filter, correlationId) {
             const tokenKeys = this.getTokenKeys();
             const accessTokens = [];
             tokenKeys.accessToken.forEach((key) => {
                 if (!this.accessTokenKeyMatchesFilter(key, filter, true)) {
                     return;
                 }
-                const accessToken = this.getAccessTokenCredential(key);
+                const accessToken = this.getAccessTokenCredential(key, correlationId);
                 if (accessToken &&
                     this.credentialMatchesFilter(accessToken, filter)) {
                     accessTokens.push(accessToken);
@@ -3573,7 +3576,7 @@
          * @param performanceClient {?IPerformanceClient}
          * @param correlationId {?string}
          */
-        getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
+        getRefreshToken(account, familyRT, correlationId, tokenKeys, performanceClient) {
             this.commonLogger.trace("CacheManager - getRefreshToken called");
             const id = familyRT ? THE_FAMILY_ID : undefined;
             const refreshTokenFilter = {
@@ -3589,7 +3592,7 @@
             refreshTokenKeys.forEach((key) => {
                 // Validate key
                 if (this.refreshTokenKeyMatchesFilter(key, refreshTokenFilter)) {
-                    const refreshToken = this.getRefreshTokenCredential(key);
+                    const refreshToken = this.getRefreshTokenCredential(key, correlationId);
                     // Validate value
                     if (refreshToken &&
                         this.credentialMatchesFilter(refreshToken, refreshTokenFilter)) {
@@ -3948,7 +3951,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4047,7 +4050,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4057,7 +4060,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4107,7 +4110,7 @@
     const BROKER_CLIENT_ID = "brk_client_id";
     const BROKER_REDIRECT_URI = "brk_redirect_uri";
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4174,7 +4177,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4582,7 +4585,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4594,7 +4597,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4604,7 +4607,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4614,7 +4617,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5101,7 +5104,7 @@
         "multiMatchedRT",
     ]);
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5197,7 +5200,7 @@
         };
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5306,7 +5309,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6145,7 +6148,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6176,7 +6179,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6195,7 +6198,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6215,12 +6218,12 @@
          * @param cacheManager
          * @param thumbprint
          */
-        static preProcess(cacheManager, thumbprint) {
+        static preProcess(cacheManager, thumbprint, correlationId) {
             const key = ThrottlingUtils.generateThrottlingStorageKey(thumbprint);
             const value = cacheManager.getThrottlingCache(key);
             if (value) {
                 if (value.throttleTime < Date.now()) {
-                    cacheManager.removeItem(key);
+                    cacheManager.removeItem(key, correlationId);
                     return;
                 }
                 throw new ServerError(value.errorCodes?.join(" ") || Constants.EMPTY_STRING, value.errorMessage, value.subError);
@@ -6232,7 +6235,7 @@
          * @param thumbprint
          * @param response
          */
-        static postProcess(cacheManager, thumbprint, response) {
+        static postProcess(cacheManager, thumbprint, response, correlationId) {
             if (ThrottlingUtils.checkResponseStatus(response) ||
                 ThrottlingUtils.checkResponseForRetryAfter(response)) {
                 const thumbprintValue = {
@@ -6242,7 +6245,7 @@
                     errorMessage: response.body.error_description,
                     subError: response.body.suberror,
                 };
-                cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue);
+                cacheManager.setThrottlingCache(ThrottlingUtils.generateThrottlingStorageKey(thumbprint), thumbprintValue, correlationId);
             }
         }
         /**
@@ -6289,11 +6292,11 @@
                 sshKid: request.sshKid,
             };
             const key = this.generateThrottlingStorageKey(thumbprint);
-            cacheManager.removeItem(key);
+            cacheManager.removeItem(key, request.correlationId);
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6323,7 +6326,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6405,7 +6408,7 @@
          * @param correlationId - CorrelationId for telemetry
          */
         async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-            ThrottlingUtils.preProcess(this.cacheManager, thumbprint);
+            ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
             let response;
             try {
                 response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
@@ -6440,7 +6443,7 @@
                     throw createClientAuthError(networkError);
                 }
             }
-            ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response);
+            ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
             return response;
         }
         /**
@@ -6473,7 +6476,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6499,7 +6502,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6587,7 +6590,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6659,7 +6662,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6743,7 +6746,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6770,7 +6773,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6930,13 +6933,13 @@
                     !forceCacheRefreshTokenResponse &&
                     cacheRecord.account) {
                     const key = cacheRecord.account.generateAccountKey();
-                    const account = this.cacheStorage.getAccount(key, this.logger);
+                    const account = this.cacheStorage.getAccount(key, request.correlationId, this.logger);
                     if (!account) {
                         this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                         return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                     }
                 }
-                await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache, request.correlationId);
+                await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
             }
             finally {
                 if (this.persistencePlugin &&
@@ -6965,7 +6968,7 @@
             let cachedAccount;
             if (serverTokenResponse.id_token && !!idTokenClaims) {
                 cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
-                cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+                cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, this.cryptoObj.base64Decode, request.correlationId, idTokenClaims, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
                 this.logger);
             }
             // AccessToken
@@ -7113,7 +7116,7 @@
             };
         }
     }
-    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+    function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
         logger?.verbose("setCachedAccount called");
         // Check if base account is already cached
         const accountKeys = cacheStorage.getAccountKeys();
@@ -7122,7 +7125,7 @@
         });
         let cachedAccount = null;
         if (baseAccountKey) {
-            cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+            cachedAccount = cacheStorage.getAccount(baseAccountKey, correlationId, logger);
         }
         const baseAccount = cachedAccount ||
             AccountEntity.createAccount({
@@ -7147,7 +7150,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7165,7 +7168,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7607,7 +7610,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7680,7 +7683,7 @@
         async acquireTokenWithCachedRefreshToken(request, foci) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
             // fetches family RT or application RT based on FOCI value
-            const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
+            const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined, this.performanceClient);
             if (!refreshToken) {
                 throw createInteractionRequiredAuthError(noTokensFound);
             }
@@ -7708,7 +7711,7 @@
                     // Remove bad refresh token from cache
                     this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
                     const badRefreshTokenKey = generateCredentialKey(refreshToken);
-                    this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+                    this.cacheManager.removeRefreshToken(badRefreshTokenKey, request.correlationId);
                 }
                 throw e;
             }
@@ -7827,7 +7830,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7897,7 +7900,7 @@
             const requestTenantId = request.account.tenantId ||
                 getTenantFromAuthorityString(request.authority);
             const tokenKeys = this.cacheManager.getTokenKeys();
-            const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+            const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient);
             if (!cachedAccessToken) {
                 // must refresh due to non-existent access_token
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7917,9 +7920,9 @@
             }
             const environment = request.authority || this.authority.getPreferredCache();
             const cacheRecord = {
-                account: this.cacheManager.readAccountFromCache(request.account),
+                account: this.cacheManager.readAccountFromCache(request.account, request.correlationId),
                 accessToken: cachedAccessToken,
-                idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+                idToken: this.cacheManager.getIdToken(request.account, request.correlationId, tokenKeys, requestTenantId, this.performanceClient),
                 refreshToken: null,
                 appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
             };
@@ -7963,7 +7966,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7978,7 +7981,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8036,7 +8039,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8175,7 +8178,7 @@
             else {
                 lastRequests.errors.push(SERVER_TELEM_CONSTANTS.UNKNOWN_ERROR);
             }
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             return;
         }
         /**
@@ -8184,7 +8187,7 @@
         incrementCacheHits() {
             const lastRequests = this.getLastRequests();
             lastRequests.cacheHits += 1;
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
             return lastRequests.cacheHits;
         }
         /**
@@ -8208,7 +8211,7 @@
             const errorCount = lastRequests.errors.length;
             if (numErrorsFlushed === errorCount) {
                 // All errors were sent on last request, clear Telemetry cache
-                this.cacheManager.removeItem(this.telemetryCacheKey);
+                this.cacheManager.removeItem(this.telemetryCacheKey, this.correlationId);
             }
             else {
                 // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
@@ -8217,7 +8220,7 @@
                     errors: lastRequests.errors.slice(numErrorsFlushed),
                     cacheHits: 0,
                 };
-                this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
+                this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity, this.correlationId);
             }
         }
         /**
@@ -8284,7 +8287,7 @@
         setNativeBrokerErrorCode(errorCode) {
             const lastRequests = this.getLastRequests();
             lastRequests.nativeBrokerErrorCode = errorCode;
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
         getNativeBrokerErrorCode() {
             return this.getLastRequests().nativeBrokerErrorCode;
@@ -8292,14 +8295,14 @@
         clearNativeBrokerErrorCode() {
             const lastRequests = this.getLastRequests();
             delete lastRequests.nativeBrokerErrorCode;
-            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests);
+            this.cacheManager.setServerTelemetry(this.telemetryCacheKey, lastRequests, this.correlationId);
         }
         static makeExtraSkuString(params) {
             return makeExtraSkuString(params);
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8307,7 +8310,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8332,7 +8335,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8372,7 +8375,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8451,7 +8454,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.16.0 2024-12-12 */
+    /*! @azure/msal-common v14.16.1 2025-08-05 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9514,6 +9517,7 @@
     const StaticCacheKeys = {
         ACCOUNT_KEYS: "msal.account.keys",
         TOKEN_KEYS: "msal.token.keys",
+        VERSION: "msal.version",
     };
     /**
      * Cache keys stored in-memory
@@ -9721,14 +9725,14 @@
     /**
      * Check whether browser crypto is available.
      */
-    function validateCryptoAvailable() {
+    function validateCryptoAvailable(skipValidateSubtleCrypto) {
         if (!window) {
             throw createBrowserAuthError(nonBrowserEnvironment);
         }
         if (!window.crypto) {
             throw createBrowserAuthError(cryptoNonExistent);
         }
-        if (!window.crypto.subtle) {
+        if (!skipValidateSubtleCrypto && !window.crypto.subtle) {
             throw createBrowserAuthError(cryptoNonExistent, SUBTLE_SUBERROR);
         }
     }
@@ -9943,7 +9947,9 @@
      * Returns current window URL as redirect uri
      */
     function getCurrentUri() {
-        return window.location.href.split("?")[0].split("#")[0];
+        return typeof window !== "undefined" && window.location
+            ? window.location.href.split("?")[0].split("#")[0]
+            : "";
     }
     /**
      * Gets the homepage url for the current window location.
@@ -10370,7 +10376,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.28.0";
+    const version = "3.30.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11157,10 +11163,10 @@
      * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
      */
     class CryptoOps {
-        constructor(logger, performanceClient) {
+        constructor(logger, performanceClient, skipValidateSubtleCrypto) {
             this.logger = logger;
             // Browser crypto needs to be validated first before any other classes can be set.
-            validateCryptoAvailable();
+            validateCryptoAvailable(skipValidateSubtleCrypto ?? false);
             this.cache = new AsyncMemoryStorage(this.logger);
             this.performanceClient = performanceClient;
         }
@@ -11511,6 +11517,13 @@
          * @param storeAuthStateInCookie
          */
         migrateCacheEntries() {
+            const previousVersion = this.browserStorage.getItem(StaticCacheKeys.VERSION);
+            if (previousVersion) {
+                this.logger.info(`MSAL.js was last initialized with version ${previousVersion}`);
+            }
+            if (previousVersion !== version) {
+                this.browserStorage.setItem(StaticCacheKeys.VERSION, version);
+            }
             const idTokenKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ID_TOKEN}`;
             const clientInfoKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.CLIENT_INFO}`;
             const errorKey = `${Constants.CACHE_PREFIX}.${PersistentCacheKeys.ERROR}`;
@@ -11545,6 +11558,7 @@
          */
         createKeyMaps() {
             this.logger.trace("BrowserCacheManager - createKeyMaps called.");
+            const correlationId = this.cryptoImpl.createNewGuid();
             const accountKeys = this.getItem(StaticCacheKeys.ACCOUNT_KEYS);
             const tokenKeys = this.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
             if (accountKeys && tokenKeys) {
@@ -11566,8 +11580,8 @@
                                         this.logger.trace("BrowserCacheManager:createKeyMaps - idToken found, saving key to token key map");
                                         this.logger.tracePii(`BrowserCacheManager:createKeyMaps - idToken with key: ${key} found, saving key to token key map`);
                                         const idTokenEntity = credObj;
-                                        const newKey = this.updateCredentialCacheKey(key, idTokenEntity);
-                                        this.addTokenKey(newKey, CredentialType.ID_TOKEN);
+                                        const newKey = this.updateCredentialCacheKey(key, idTokenEntity, correlationId);
+                                        this.addTokenKey(newKey, CredentialType.ID_TOKEN, correlationId);
                                         return;
                                     }
                                     else {
@@ -11581,8 +11595,8 @@
                                         this.logger.trace("BrowserCacheManager:createKeyMaps - accessToken found, saving key to token key map");
                                         this.logger.tracePii(`BrowserCacheManager:createKeyMaps - accessToken with key: ${key} found, saving key to token key map`);
                                         const accessTokenEntity = credObj;
-                                        const newKey = this.updateCredentialCacheKey(key, accessTokenEntity);
-                                        this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN);
+                                        const newKey = this.updateCredentialCacheKey(key, accessTokenEntity, correlationId);
+                                        this.addTokenKey(newKey, CredentialType.ACCESS_TOKEN, correlationId);
                                         return;
                                     }
                                     else {
@@ -11595,8 +11609,8 @@
                                         this.logger.trace("BrowserCacheManager:createKeyMaps - refreshToken found, saving key to token key map");
                                         this.logger.tracePii(`BrowserCacheManager:createKeyMaps - refreshToken with key: ${key} found, saving key to token key map`);
                                         const refreshTokenEntity = credObj;
-                                        const newKey = this.updateCredentialCacheKey(key, refreshTokenEntity);
-                                        this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN);
+                                        const newKey = this.updateCredentialCacheKey(key, refreshTokenEntity, correlationId);
+                                        this.addTokenKey(newKey, CredentialType.REFRESH_TOKEN, correlationId);
                                         return;
                                     }
                                     else {
@@ -11617,7 +11631,7 @@
                             AccountEntity.isAccountEntity(accountObj)) {
                             this.logger.trace("BrowserCacheManager:createKeyMaps - account found, saving key to account key map");
                             this.logger.tracePii(`BrowserCacheManager:createKeyMaps - account with key: ${key} found, saving key to account key map`);
-                            this.addAccountKeyToMap(key);
+                            this.addAccountKeyToMap(key, correlationId);
                         }
                     }
                 }
@@ -11656,17 +11670,58 @@
          * @param key
          * @param value
          */
-        setItem(key, value) {
-            this.browserStorage.setItem(key, value);
+        setItem(key, value, correlationId) {
+            let accessTokenKeys = [];
+            const maxRetries = 20;
+            for (let i = 0; i <= maxRetries; i++) {
+                try {
+                    this.browserStorage.setItem(key, value);
+                    if (i > 0) {
+                        // Finally update the token keys array with the tokens removed
+                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId);
+                    }
+                    break; // If setItem succeeds, exit the loop
+                }
+                catch (e) {
+                    const cacheError = createCacheError(e);
+                    if (cacheError.errorCode ===
+                        cacheQuotaExceeded &&
+                        i < maxRetries) {
+                        if (!accessTokenKeys.length) {
+                            if (key ===
+                                `${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`) {
+                                // If we are currently trying to set the token keys, use the value we're trying to set
+                                accessTokenKeys = JSON.parse(value)
+                                    .accessToken;
+                            }
+                            else {
+                                // If token keys have not been initialized, get them
+                                accessTokenKeys = this.getTokenKeys().accessToken;
+                            }
+                        }
+                        if (accessTokenKeys.length <= i) {
+                            // Nothing to remove, rethrow the error
+                            throw cacheError;
+                        }
+                        // When cache quota is exceeded, start removing access tokens until we can successfully set the item
+                        this.removeAccessToken(accessTokenKeys[i], correlationId, false // Don't save token keys yet, do it at the end
+                        );
+                    }
+                    else {
+                        // If the error is not a quota exceeded error, rethrow it
+                        throw cacheError;
+                    }
+                }
+            }
         }
         /**
          * fetch the account entity from the platform cache
          * @param accountKey
          */
-        getAccount(accountKey, logger) {
+        getAccount(accountKey, correlationId, logger) {
             this.logger.trace("BrowserCacheManager.getAccount called");
-            const accountEntity = this.getCachedAccountEntity(accountKey);
-            return this.updateOutdatedCachedAccount(accountKey, accountEntity, logger);
+            const accountEntity = this.getCachedAccountEntity(accountKey, correlationId);
+            return this.updateOutdatedCachedAccount(accountKey, accountEntity, correlationId, logger);
         }
         /**
          * Reads account from cache, deserializes it into an account entity and returns it.
@@ -11674,15 +11729,14 @@
          * @param accountKey
          * @returns
          */
-        getCachedAccountEntity(accountKey) {
+        getCachedAccountEntity(accountKey, correlationId) {
             const serializedAccount = this.getItem(accountKey);
             if (!serializedAccount) {
-                this.removeAccountKeyFromMap(accountKey);
+                this.removeAccountKeyFromMap(accountKey, correlationId);
                 return null;
             }
             const parsedAccount = this.validateAndParseJson(serializedAccount);
             if (!parsedAccount || !AccountEntity.isAccountEntity(parsedAccount)) {
-                this.removeAccountKeyFromMap(accountKey);
                 return null;
             }
             return CacheManager.toObject(new AccountEntity(), parsedAccount);
@@ -11691,11 +11745,12 @@
          * set account entity in the platform cache
          * @param account
          */
-        setAccount(account) {
+        setAccount(account, correlationId) {
             this.logger.trace("BrowserCacheManager.setAccount called");
             const key = account.generateAccountKey();
-            this.setItem(key, JSON.stringify(account));
-            this.addAccountKeyToMap(key);
+            account.lastUpdatedAt = Date.now().toString();
+            this.setItem(key, JSON.stringify(account), correlationId);
+            this.addAccountKeyToMap(key, correlationId);
         }
         /**
          * Returns the array of account keys currently cached
@@ -11714,14 +11769,14 @@
          * Add a new account to the key map
          * @param key
          */
-        addAccountKeyToMap(key) {
+        addAccountKeyToMap(key, correlationId) {
             this.logger.trace("BrowserCacheManager.addAccountKeyToMap called");
             this.logger.tracePii(`BrowserCacheManager.addAccountKeyToMap called with key: ${key}`);
             const accountKeys = this.getAccountKeys();
             if (accountKeys.indexOf(key) === -1) {
                 // Only add key if it does not already exist in the map
                 accountKeys.push(key);
-                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
                 this.logger.verbose("BrowserCacheManager.addAccountKeyToMap account key added");
             }
             else {
@@ -11732,14 +11787,21 @@
          * Remove an account from the key map
          * @param key
          */
-        removeAccountKeyFromMap(key) {
+        removeAccountKeyFromMap(key, correlationId) {
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap called");
             this.logger.tracePii(`BrowserCacheManager.removeAccountKeyFromMap called with key: ${key}`);
             const accountKeys = this.getAccountKeys();
             const removalIndex = accountKeys.indexOf(key);
             if (removalIndex > -1) {
                 accountKeys.splice(removalIndex, 1);
-                this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys));
+                if (accountKeys.length === 0) {
+                    // If no keys left, remove the map
+                    this.removeItem(StaticCacheKeys.ACCOUNT_KEYS);
+                    return;
+                }
+                else {
+                    this.setItem(StaticCacheKeys.ACCOUNT_KEYS, JSON.stringify(accountKeys), correlationId);
+                }
                 this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
             }
             else {
@@ -11750,41 +11812,60 @@
          * Extends inherited removeAccount function to include removal of the account key from the map
          * @param key
          */
-        async removeAccount(key) {
-            void super.removeAccount(key);
-            this.removeAccountKeyFromMap(key);
+        async removeAccount(key, correlationId) {
+            void super.removeAccount(key, correlationId);
+            this.removeAccountKeyFromMap(key, correlationId);
         }
         /**
          * Remove account entity from the platform cache if it's outdated
          * @param accountKey
          */
-        removeOutdatedAccount(accountKey) {
+        removeOutdatedAccount(accountKey, correlationId) {
             this.removeItem(accountKey);
-            this.removeAccountKeyFromMap(accountKey);
+            this.removeAccountKeyFromMap(accountKey, correlationId);
         }
         /**
          * Removes given idToken from the cache and from the key map
          * @param key
          */
-        removeIdToken(key) {
-            super.removeIdToken(key);
-            this.removeTokenKey(key, CredentialType.ID_TOKEN);
+        removeIdToken(key, correlationId) {
+            super.removeIdToken(key, correlationId);
+            this.removeTokenKey(key, CredentialType.ID_TOKEN, correlationId);
         }
         /**
          * Removes given accessToken from the cache and from the key map
          * @param key
          */
-        async removeAccessToken(key) {
-            void super.removeAccessToken(key);
-            this.removeTokenKey(key, CredentialType.ACCESS_TOKEN);
+        removeAccessToken(key, correlationId, updateTokenKeys = true) {
+            super.removeAccessToken(key, correlationId);
+            this.performanceClient?.incrementFields({ accessTokensRemoved: 1 }, correlationId);
+            updateTokenKeys &&
+                this.removeTokenKey(key, CredentialType.ACCESS_TOKEN, correlationId);
+        }
+        removeAccessTokenKeys(keys, correlationId) {
+            this.logger.trace("removeAccessTokenKey called");
+            const tokenKeys = this.getTokenKeys();
+            let keysRemoved = 0;
+            keys.forEach((key) => {
+                const accessRemoval = tokenKeys.accessToken.indexOf(key);
+                if (accessRemoval > -1) {
+                    tokenKeys.accessToken.splice(accessRemoval, 1);
+                    keysRemoved++;
+                }
+            });
+            if (keysRemoved > 0) {
+                this.logger.info(`removed ${keysRemoved} accessToken keys from tokenKeys map`);
+                this.setTokenKeys(tokenKeys, correlationId);
+                return;
+            }
         }
         /**
          * Removes given refreshToken from the cache and from the key map
          * @param key
          */
-        removeRefreshToken(key) {
-            super.removeRefreshToken(key);
-            this.removeTokenKey(key, CredentialType.REFRESH_TOKEN);
+        removeRefreshToken(key, correlationId) {
+            super.removeRefreshToken(key, correlationId);
+            this.removeTokenKey(key, CredentialType.REFRESH_TOKEN, correlationId);
         }
         /**
          * Gets the keys for the cached tokens associated with this clientId
@@ -11814,12 +11895,30 @@
                 refreshToken: [],
             };
         }
+        /**
+         * Stores the token keys in the cache
+         * @param tokenKeys
+         * @param correlationId
+         * @returns
+         */
+        setTokenKeys(tokenKeys, correlationId) {
+            if (tokenKeys.idToken.length === 0 &&
+                tokenKeys.accessToken.length === 0 &&
+                tokenKeys.refreshToken.length === 0) {
+                // If no keys left, remove the map
+                this.removeItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`);
+                return;
+            }
+            else {
+                this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys), correlationId);
+            }
+        }
         /**
          * Adds the given key to the token key map
          * @param key
          * @param type
          */
-        addTokenKey(key, type) {
+        addTokenKey(key, type, correlationId) {
             this.logger.trace("BrowserCacheManager addTokenKey called");
             const tokenKeys = this.getTokenKeys();
             switch (type) {
@@ -11830,10 +11929,12 @@
                     }
                     break;
                 case CredentialType.ACCESS_TOKEN:
-                    if (tokenKeys.accessToken.indexOf(key) === -1) {
-                        this.logger.info("BrowserCacheManager: addTokenKey - accessToken added to map");
-                        tokenKeys.accessToken.push(key);
+                    const index = tokenKeys.accessToken.indexOf(key);
+                    if (index !== -1) {
+                        tokenKeys.accessToken.splice(index, 1); // Remove existing key before pushing to the end
                     }
+                    this.logger.trace(`access token ${index === -1 ? "added to" : "updated in"} map`);
+                    tokenKeys.accessToken.push(key);
                     break;
                 case CredentialType.REFRESH_TOKEN:
                     if (tokenKeys.refreshToken.indexOf(key) === -1) {
@@ -11845,16 +11946,15 @@
                     this.logger.error(`BrowserCacheManager:addTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                     throw createClientAuthError(unexpectedCredentialType);
             }
-            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+            this.setTokenKeys(tokenKeys, correlationId);
         }
         /**
          * Removes the given key from the token key map
          * @param key
          * @param type
          */
-        removeTokenKey(key, type) {
+        removeTokenKey(key, type, correlationId, tokenKeys = this.getTokenKeys()) {
             this.logger.trace("BrowserCacheManager removeTokenKey called");
-            const tokenKeys = this.getTokenKeys();
             switch (type) {
                 case CredentialType.ID_TOKEN:
                     this.logger.infoPii(`BrowserCacheManager: removeTokenKey - attempting to remove idToken with key: ${key} from map`);
@@ -11893,23 +11993,22 @@
                     this.logger.error(`BrowserCacheManager:removeTokenKey - CredentialType provided invalid. CredentialType: ${type}`);
                     throw createClientAuthError(unexpectedCredentialType);
             }
-            this.setItem(`${StaticCacheKeys.TOKEN_KEYS}.${this.clientId}`, JSON.stringify(tokenKeys));
+            this.setTokenKeys(tokenKeys, correlationId);
         }
         /**
          * generates idToken entity from a string
          * @param idTokenKey
          */
-        getIdTokenCredential(idTokenKey) {
+        getIdTokenCredential(idTokenKey, correlationId) {
             const value = this.getItem(idTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-                this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+                this.removeIdToken(idTokenKey, correlationId);
                 return null;
             }
             const parsedIdToken = this.validateAndParseJson(value);
             if (!parsedIdToken || !isIdTokenEntity(parsedIdToken)) {
                 this.logger.trace("BrowserCacheManager.getIdTokenCredential: called, no cache hit");
-                this.removeTokenKey(idTokenKey, CredentialType.ID_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getIdTokenCredential: cache hit");
@@ -11919,28 +12018,28 @@
          * set IdToken credential to the platform cache
          * @param idToken
          */
-        setIdTokenCredential(idToken) {
+        setIdTokenCredential(idToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
             const idTokenKey = generateCredentialKey(idToken);
-            this.setItem(idTokenKey, JSON.stringify(idToken));
-            this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN);
+            idToken.lastUpdatedAt = Date.now().toString();
+            this.setItem(idTokenKey, JSON.stringify(idToken), correlationId);
+            this.addTokenKey(idTokenKey, CredentialType.ID_TOKEN, correlationId);
         }
         /**
          * generates accessToken entity from a string
          * @param key
          */
-        getAccessTokenCredential(accessTokenKey) {
+        getAccessTokenCredential(accessTokenKey, correlationId) {
             const value = this.getItem(accessTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN, correlationId);
                 return null;
             }
             const parsedAccessToken = this.validateAndParseJson(value);
             if (!parsedAccessToken ||
                 !isAccessTokenEntity(parsedAccessToken)) {
                 this.logger.trace("BrowserCacheManager.getAccessTokenCredential: called, no cache hit");
-                this.removeTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getAccessTokenCredential: cache hit");
@@ -11950,28 +12049,28 @@
          * set accessToken credential to the platform cache
          * @param accessToken
          */
-        setAccessTokenCredential(accessToken) {
+        setAccessTokenCredential(accessToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
             const accessTokenKey = generateCredentialKey(accessToken);
-            this.setItem(accessTokenKey, JSON.stringify(accessToken));
-            this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN);
+            accessToken.lastUpdatedAt = Date.now().toString();
+            this.setItem(accessTokenKey, JSON.stringify(accessToken), correlationId);
+            this.addTokenKey(accessTokenKey, CredentialType.ACCESS_TOKEN, correlationId);
         }
         /**
          * generates refreshToken entity from a string
          * @param refreshTokenKey
          */
-        getRefreshTokenCredential(refreshTokenKey) {
+        getRefreshTokenCredential(refreshTokenKey, correlationId) {
             const value = this.getItem(refreshTokenKey);
             if (!value) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN, correlationId);
                 return null;
             }
             const parsedRefreshToken = this.validateAndParseJson(value);
             if (!parsedRefreshToken ||
                 !isRefreshTokenEntity(parsedRefreshToken)) {
                 this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: called, no cache hit");
-                this.removeTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getRefreshTokenCredential: cache hit");
@@ -11981,11 +12080,12 @@
          * set refreshToken credential to the platform cache
          * @param refreshToken
          */
-        setRefreshTokenCredential(refreshToken) {
+        setRefreshTokenCredential(refreshToken, correlationId) {
             this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
             const refreshTokenKey = generateCredentialKey(refreshToken);
-            this.setItem(refreshTokenKey, JSON.stringify(refreshToken));
-            this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN);
+            refreshToken.lastUpdatedAt = Date.now().toString();
+            this.setItem(refreshTokenKey, JSON.stringify(refreshToken), correlationId);
+            this.addTokenKey(refreshTokenKey, CredentialType.REFRESH_TOKEN, correlationId);
         }
         /**
          * fetch appMetadata entity from the platform cache
@@ -12010,10 +12110,10 @@
          * set appMetadata entity to the platform cache
          * @param appMetadata
          */
-        setAppMetadata(appMetadata) {
+        setAppMetadata(appMetadata, correlationId) {
             this.logger.trace("BrowserCacheManager.setAppMetadata called");
             const appMetadataKey = generateAppMetadataKey(appMetadata);
-            this.setItem(appMetadataKey, JSON.stringify(appMetadata));
+            this.setItem(appMetadataKey, JSON.stringify(appMetadata), correlationId);
         }
         /**
          * fetch server telemetry entity from the platform cache
@@ -12039,9 +12139,9 @@
          * @param serverTelemetryKey
          * @param serverTelemetry
          */
-        setServerTelemetry(serverTelemetryKey, serverTelemetry) {
+        setServerTelemetry(serverTelemetryKey, serverTelemetry, correlationId) {
             this.logger.trace("BrowserCacheManager.setServerTelemetry called");
-            this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry));
+            this.setItem(serverTelemetryKey, JSON.stringify(serverTelemetry), correlationId);
         }
         /**
          *
@@ -12099,7 +12199,7 @@
         /**
          * Gets the active account
          */
-        getActiveAccount() {
+        getActiveAccount(correlationId) {
             const activeAccountKeyFilters = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
             const activeAccountValueFilters = this.getItem(activeAccountKeyFilters);
             if (!activeAccountValueFilters) {
@@ -12113,11 +12213,11 @@
                 }
                 const activeAccount = this.getAccountInfoFilteredBy({
                     localAccountId: activeAccountValueLocal,
-                });
+                }, correlationId);
                 if (activeAccount) {
                     this.logger.trace("BrowserCacheManager.getActiveAccount: Legacy active account cache schema found");
                     this.logger.trace("BrowserCacheManager.getActiveAccount: Adding active account filters cache schema");
-                    this.setActiveAccount(activeAccount);
+                    this.setActiveAccount(activeAccount, correlationId);
                     return activeAccount;
                 }
                 return null;
@@ -12129,7 +12229,7 @@
                     homeAccountId: activeAccountValueObj.homeAccountId,
                     localAccountId: activeAccountValueObj.localAccountId,
                     tenantId: activeAccountValueObj.tenantId,
-                });
+                }, correlationId);
             }
             this.logger.trace("BrowserCacheManager.getActiveAccount: No active account found");
             return null;
@@ -12138,7 +12238,7 @@
          * Sets the active account's localAccountId in cache
          * @param account
          */
-        setActiveAccount(account) {
+        setActiveAccount(account, correlationId) {
             const activeAccountKey = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT_FILTERS);
             const activeAccountKeyLocal = this.generateCacheKey(PersistentCacheKeys.ACTIVE_ACCOUNT);
             if (account) {
@@ -12147,9 +12247,10 @@
                     homeAccountId: account.homeAccountId,
                     localAccountId: account.localAccountId,
                     tenantId: account.tenantId,
+                    lastUpdatedAt: Date.now().toString(),
                 };
-                this.browserStorage.setItem(activeAccountKey, JSON.stringify(activeAccountValue));
-                this.browserStorage.setItem(activeAccountKeyLocal, account.localAccountId);
+                this.setItem(activeAccountKey, JSON.stringify(activeAccountValue), correlationId);
+                this.setItem(activeAccountKeyLocal, account.localAccountId, correlationId);
             }
             else {
                 this.logger.verbose("setActiveAccount: No account passed, active account not set");
@@ -12181,9 +12282,9 @@
          * @param throttlingCacheKey
          * @param throttlingCache
          */
-        setThrottlingCache(throttlingCacheKey, throttlingCache) {
+        setThrottlingCache(throttlingCacheKey, throttlingCache, correlationId) {
             this.logger.trace("BrowserCacheManager.setThrottlingCache called");
-            this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache));
+            this.setItem(throttlingCacheKey, JSON.stringify(throttlingCache), correlationId);
         }
         /**
          * Gets cache item with given key.
@@ -12259,10 +12360,10 @@
         /**
          * Clears all cache entries created by MSAL.
          */
-        async clear() {
+        async clear(correlationId) {
             // Removes all accounts and their credentials
-            await this.removeAllAccounts();
-            this.removeAppMetadata();
+            await this.removeAllAccounts(correlationId);
+            this.removeAppMetadata(correlationId);
             // Remove temp storage first to make sure any cookies are cleared
             this.temporaryCacheStorage.getKeys().forEach((cacheKey) => {
                 if (cacheKey.indexOf(Constants.CACHE_PREFIX) !== -1 ||
@@ -12288,19 +12389,19 @@
         async clearTokensAndKeysWithClaims(performanceClient, correlationId) {
             performanceClient.addQueueMeasurement(PerformanceEvents.ClearTokensAndKeysWithClaims, correlationId);
             const tokenKeys = this.getTokenKeys();
-            const removedAccessTokens = [];
+            let removedAccessTokens = 0;
             tokenKeys.accessToken.forEach((key) => {
                 // if the access token has claims in its key, remove the token key and the token
-                const credential = this.getAccessTokenCredential(key);
+                const credential = this.getAccessTokenCredential(key, correlationId);
                 if (credential?.requestedClaimsHash &&
                     key.includes(credential.requestedClaimsHash.toLowerCase())) {
-                    removedAccessTokens.push(this.removeAccessToken(key));
+                    this.removeAccessToken(key, correlationId);
+                    removedAccessTokens++;
                 }
             });
-            await Promise.all(removedAccessTokens);
             // warn if any access tokens are removed
-            if (removedAccessTokens.length > 0) {
-                this.logger.warning(`${removedAccessTokens.length} access tokens with claims in the cache keys have been removed from the cache.`);
+            if (removedAccessTokens > 0) {
+                this.logger.warning(`${removedAccessTokens} access tokens with claims in the cache keys have been removed from the cache.`);
             }
         }
         /**
@@ -12575,13 +12676,13 @@
         /**
          * Updates a credential's cache key if the current cache key is outdated
          */
-        updateCredentialCacheKey(currentCacheKey, credential) {
+        updateCredentialCacheKey(currentCacheKey, credential, correlationId) {
             const updatedCacheKey = generateCredentialKey(credential);
             if (currentCacheKey !== updatedCacheKey) {
                 const cacheItem = this.getItem(currentCacheKey);
                 if (cacheItem) {
                     this.browserStorage.removeItem(currentCacheKey);
-                    this.setItem(updatedCacheKey, cacheItem);
+                    this.setItem(updatedCacheKey, cacheItem, correlationId);
                     this.logger.verbose(`Updated an outdated ${credential.credentialType} cache key`);
                     return updatedCacheKey;
                 }
@@ -12616,7 +12717,7 @@
                 idToken: idTokenEntity,
                 accessToken: accessTokenEntity,
             };
-            return this.saveCacheRecord(cacheRecord);
+            return this.saveCacheRecord(cacheRecord, result.correlationId);
         }
         /**
          * saves a cache record
@@ -12624,9 +12725,9 @@
          * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
          */
-        async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+        async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
             try {
-                await super.saveCacheRecord(cacheRecord, storeInCache, correlationId);
+                await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
             }
             catch (e) {
                 if (e instanceof CacheError &&
@@ -12667,22 +12768,24 @@
      * @param accountFilter - (Optional) filter to narrow down the accounts returned
      * @returns Array of AccountInfo objects in cache
      */
-    function getAllAccounts(logger, browserStorage, isInBrowser, accountFilter) {
+    function getAllAccounts(logger, browserStorage, isInBrowser, correlationId, accountFilter) {
         logger.verbose("getAllAccounts called");
-        return isInBrowser ? browserStorage.getAllAccounts(accountFilter) : [];
+        return isInBrowser
+            ? browserStorage.getAllAccounts(correlationId, accountFilter)
+            : [];
     }
     /**
      * Returns the first account found in the cache that matches the account filter passed in.
      * @param accountFilter
      * @returns The first account found in the cache matching the provided filter or null if no account could be found.
      */
-    function getAccount(accountFilter, logger, browserStorage) {
+    function getAccount(accountFilter, logger, browserStorage, correlationId) {
         logger.trace("getAccount called");
         if (Object.keys(accountFilter).length === 0) {
             logger.warning("getAccount: No accountFilter provided");
             return null;
         }
-        const account = browserStorage.getAccountInfoFilteredBy(accountFilter);
+        const account = browserStorage.getAccountInfoFilteredBy(accountFilter, correlationId);
         if (account) {
             logger.verbose("getAccount: Account matching provided filter found, returning");
             return account;
@@ -12700,7 +12803,7 @@
      * @param username
      * @returns The account object stored in MSAL
      */
-    function getAccountByUsername(username, logger, browserStorage) {
+    function getAccountByUsername(username, logger, browserStorage, correlationId) {
         logger.trace("getAccountByUsername called");
         if (!username) {
             logger.warning("getAccountByUsername: No username provided");
@@ -12708,7 +12811,7 @@
         }
         const account = browserStorage.getAccountInfoFilteredBy({
             username,
-        });
+        }, correlationId);
         if (account) {
             logger.verbose("getAccountByUsername: Account matching username found, returning");
             logger.verbosePii(`getAccountByUsername: Returning signed-in accounts matching username: ${username}`);
@@ -12726,7 +12829,7 @@
      * @param homeAccountId
      * @returns The account object stored in MSAL
      */
-    function getAccountByHomeId(homeAccountId, logger, browserStorage) {
+    function getAccountByHomeId(homeAccountId, logger, browserStorage, correlationId) {
         logger.trace("getAccountByHomeId called");
         if (!homeAccountId) {
             logger.warning("getAccountByHomeId: No homeAccountId provided");
@@ -12734,7 +12837,7 @@
         }
         const account = browserStorage.getAccountInfoFilteredBy({
             homeAccountId,
-        });
+        }, correlationId);
         if (account) {
             logger.verbose("getAccountByHomeId: Account matching homeAccountId found, returning");
             logger.verbosePii(`getAccountByHomeId: Returning signed-in accounts matching homeAccountId: ${homeAccountId}`);
@@ -12752,7 +12855,7 @@
      * @param localAccountId
      * @returns The account object stored in MSAL
      */
-    function getAccountByLocalId(localAccountId, logger, browserStorage) {
+    function getAccountByLocalId(localAccountId, logger, browserStorage, correlationId) {
         logger.trace("getAccountByLocalId called");
         if (!localAccountId) {
             logger.warning("getAccountByLocalId: No localAccountId provided");
@@ -12760,7 +12863,7 @@
         }
         const account = browserStorage.getAccountInfoFilteredBy({
             localAccountId,
-        });
+        }, correlationId);
         if (account) {
             logger.verbose("getAccountByLocalId: Account matching localAccountId found, returning");
             logger.verbosePii(`getAccountByLocalId: Returning signed-in accounts matching localAccountId: ${localAccountId}`);
@@ -12775,14 +12878,14 @@
      * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
      * @param account
      */
-    function setActiveAccount(account, browserStorage) {
-        browserStorage.setActiveAccount(account);
+    function setActiveAccount(account, browserStorage, correlationId) {
+        browserStorage.setActiveAccount(account, correlationId);
     }
     /**
      * Gets the currently active account
      */
-    function getActiveAccount(browserStorage) {
-        return browserStorage.getActiveAccount();
+    function getActiveAccount(browserStorage, correlationId) {
+        return browserStorage.getActiveAccount(correlationId);
     }
 
     /*
@@ -12900,13 +13003,13 @@
         }
         async clearCacheOnLogout(account) {
             if (account) {
-                if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(), false)) {
+                if (AccountEntity.accountInfoIsEqual(account, this.browserStorage.getActiveAccount(this.correlationId), false)) {
                     this.logger.verbose("Setting active account to null");
-                    this.browserStorage.setActiveAccount(null);
+                    this.browserStorage.setActiveAccount(null, this.correlationId);
                 }
                 // Clear given account.
                 try {
-                    await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account));
+                    await this.browserStorage.removeAccount(AccountEntity.generateAccountCacheKey(account), this.correlationId);
                     this.logger.verbose("Cleared cache items belonging to the account provided in the logout request.");
                 }
                 catch (error) {
@@ -12917,7 +13020,7 @@
                 try {
                     this.logger.verbose("No account provided in logout request, clearing all cache items.", this.correlationId);
                     // Clear all accounts and tokens
-                    await this.browserStorage.clear();
+                    await this.browserStorage.clear(this.correlationId);
                     // Clear any stray keys from IndexedDB
                     await this.browserCrypto.clearKeystore();
                 }
@@ -13311,7 +13414,8 @@
             if (request.loginHint || request.sid) {
                 return validatedRequest;
             }
-            const account = request.account || this.browserStorage.getActiveAccount();
+            const account = request.account ||
+                this.browserStorage.getActiveAccount(this.correlationId);
             if (account) {
                 this.logger.verbose("Setting validated request account", this.correlationId);
                 this.logger.verbosePii(`Setting validated request account: ${account.homeAccountId}`, this.correlationId);
@@ -13584,7 +13688,7 @@
             // fetch the account from browser cache
             const account = this.browserStorage.getBaseAccountInfo({
                 nativeAccountId,
-            });
+            }, request.correlationId);
             if (!account) {
                 throw createClientAuthError(noAccountFound);
             }
@@ -13711,7 +13815,7 @@
             const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
             const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
                 nativeAccountId: request.accountId,
-            })?.homeAccountId;
+            }, this.correlationId)?.homeAccountId;
             if (homeAccountIdentifier !== cachedhomeAccountId &&
                 response.account.id !== request.accountId) {
                 // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
@@ -13721,7 +13825,7 @@
             const authority = await this.getDiscoveredAuthority({
                 requestAuthority: request.authority,
             });
-            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, idTokenClaims, response.client_info, undefined, // environment
+            const baseAccount = buildAccountToCache(this.browserStorage, authority, homeAccountIdentifier, base64Decode, this.correlationId, idTokenClaims, response.client_info, undefined, // environment
             idTokenClaims.tid, undefined, // auth code payload
             response.account.id, this.logger);
             // generate authenticationResult
@@ -13854,9 +13958,11 @@
          */
         cacheAccount(accountEntity) {
             // Store the account info and hence `nativeAccountId` in browser cache
-            this.browserStorage.setAccount(accountEntity);
+            this.browserStorage.setAccount(accountEntity, this.correlationId);
             // Remove any existing cached tokens for this account in browser storage
-            this.browserStorage.removeAccountContext(accountEntity).catch((e) => {
+            this.browserStorage
+                .removeAccountContext(accountEntity, this.correlationId)
+                .catch((e) => {
                 this.logger.error(`Error occurred while removing account context from browser storage. ${e}`);
             });
         }
@@ -13885,7 +13991,7 @@
                 idToken: cachedIdToken,
                 accessToken: cachedAccessToken,
             };
-            void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
+            void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.correlationId, request.storeInCache);
         }
         addTelemetryFromNativeResponse(response) {
             const mats = this.getMATSFromResponse(response);
@@ -14661,7 +14767,7 @@
                     if (validRequest.account?.homeAccountId &&
                         validRequest.postLogoutRedirectUri &&
                         authClient.authority.protocolMode === ProtocolMode.OIDC) {
-                        void this.browserStorage.removeAccount(validRequest.account?.homeAccountId);
+                        void this.browserStorage.removeAccount(validRequest.account?.homeAccountId, this.correlationId);
                         this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
                         if (mainWindowRedirectUri) {
                             const navigationOptions = {
@@ -15336,7 +15442,7 @@
                     }
                     catch {
                         if (validLogoutRequest.account?.homeAccountId) {
-                            void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId);
+                            void this.browserStorage.removeAccount(validLogoutRequest.account?.homeAccountId, this.correlationId);
                             this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, exports.InteractionType.Redirect, validLogoutRequest);
                             return;
                         }
@@ -15736,6 +15842,7 @@
             if (!this.isBrowserEnvironment) {
                 throw createBrowserAuthError(nonBrowserEnvironment);
             }
+            const correlationId = request.correlationId || createNewGuid();
             const idTokenClaims = response.id_token
                 ? extractTokenClaims(response.id_token, base64Decode)
                 : undefined;
@@ -15749,10 +15856,10 @@
             const authority = request.authority
                 ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
                 : undefined;
-            const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", idTokenClaims, authority);
-            const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm);
-            const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options);
-            const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment);
+            const cacheRecordAccount = this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
+            const idToken = this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
+            const accessToken = this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
+            const refreshToken = this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
             return this.generateAuthenticationResult(request, {
                 account: cacheRecordAccount,
                 idToken,
@@ -15769,11 +15876,11 @@
          * @param requestHomeAccountId
          * @returns `AccountEntity`
          */
-        loadAccount(request, clientInfo, idTokenClaims, authority) {
+        loadAccount(request, clientInfo, correlationId, idTokenClaims, authority) {
             this.logger.verbose("TokenCache - loading account");
             if (request.account) {
                 const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-                this.storage.setAccount(accountEntity);
+                this.storage.setAccount(accountEntity, correlationId);
                 return accountEntity;
             }
             else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -15782,10 +15889,10 @@
             }
             const homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authority.authorityType, this.logger, this.cryptoObj, idTokenClaims);
             const claimsTenantId = idTokenClaims?.tid;
-            const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
+            const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
             undefined, // nativeAccountId
             this.logger);
-            this.storage.setAccount(cachedAccount);
+            this.storage.setAccount(cachedAccount, correlationId);
             return cachedAccount;
         }
         /**
@@ -15796,14 +15903,14 @@
          * @param tenantId
          * @returns `IdTokenEntity`
          */
-        loadIdToken(response, homeAccountId, environment, tenantId) {
+        loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
             if (!response.id_token) {
                 this.logger.verbose("TokenCache - no id token found in response");
                 return null;
             }
             this.logger.verbose("TokenCache - loading id token");
             const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-            this.storage.setIdTokenCredential(idTokenEntity);
+            this.storage.setIdTokenCredential(idTokenEntity, correlationId);
             return idTokenEntity;
         }
         /**
@@ -15815,7 +15922,7 @@
          * @param tenantId
          * @returns `AccessTokenEntity`
          */
-        loadAccessToken(request, response, homeAccountId, environment, tenantId, options) {
+        loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
             if (!response.access_token) {
                 this.logger.verbose("TokenCache - no access token found in response");
                 return null;
@@ -15839,7 +15946,7 @@
                 (response.ext_expires_in || response.expires_in) +
                     new Date().getTime() / 1000;
             const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-            this.storage.setAccessTokenCredential(accessTokenEntity);
+            this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
             return accessTokenEntity;
         }
         /**
@@ -15850,7 +15957,7 @@
          * @param environment
          * @returns `RefreshTokenEntity`
          */
-        loadRefreshToken(response, homeAccountId, environment) {
+        loadRefreshToken(response, homeAccountId, environment, correlationId) {
             if (!response.refresh_token) {
                 this.logger.verbose("TokenCache - no refresh token found in response");
                 return null;
@@ -15858,7 +15965,7 @@
             this.logger.verbose("TokenCache - loading refresh token");
             const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
             response.refresh_token_expires_in);
-            this.storage.setRefreshTokenCredential(refreshTokenEntity);
+            this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
             return refreshTokenEntity;
         }
         /**
@@ -16767,7 +16874,8 @@
          * @returns Array of AccountInfo objects in cache
          */
         getAllAccounts(accountFilter) {
-            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, accountFilter);
+            const correlationId = this.getRequestCorrelationId();
+            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnvironment, correlationId, accountFilter);
         }
         /**
          * Returns the first account found in the cache that matches the account filter passed in.
@@ -16775,7 +16883,8 @@
          * @returns The first account found in the cache matching the provided filter or null if no account could be found.
          */
         getAccount(accountFilter) {
-            return getAccount(accountFilter, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching username.
@@ -16786,7 +16895,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByUsername(username) {
-            return getAccountByUsername(username, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching homeAccountId.
@@ -16796,7 +16906,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByHomeId(homeAccountId) {
-            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching localAccountId.
@@ -16806,20 +16917,23 @@
          * @returns The account object stored in MSAL
          */
         getAccountByLocalId(localAccountId) {
-            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
          * @param account
          */
         setActiveAccount(account) {
-            setActiveAccount(account, this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            setActiveAccount(account, this.browserStorage, correlationId);
         }
         /**
          * Gets the currently active account
          */
         getActiveAccount() {
-            return getActiveAccount(this.browserStorage);
+            const correlationId = this.getRequestCorrelationId();
+            return getActiveAccount(this.browserStorage, correlationId);
         }
         // #endregion
         /**
@@ -16832,7 +16946,7 @@
             this.logger.verbose("hydrateCache called");
             // Account gets saved to browser storage regardless of native or not
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            this.browserStorage.setAccount(accountEntity);
+            this.browserStorage.setAccount(accountEntity, result.correlationId);
             if (result.fromNativeBroker) {
                 this.logger.verbose("Response was from native broker, storing in-memory");
                 // Tokens from native broker are stored in-memory
@@ -17605,7 +17719,7 @@
             this.performanceClient = this.config.telemetry.client;
             // Initialize the crypto class.
             this.browserCrypto = operatingContext.isBrowserEnvironment()
-                ? new CryptoOps(this.logger, this.performanceClient)
+                ? new CryptoOps(this.logger, this.performanceClient, true)
                 : DEFAULT_CRYPTO_IMPLEMENTATION;
             // Initialize the browser storage class.
             this.browserStorage = this.operatingContext.isBrowserEnvironment()
@@ -17616,8 +17730,9 @@
             // Set the active account if available
             const accountContext = this.bridgeProxy.getAccountContext();
             if (accountContext) {
-                const cachedAccount = getAccount(accountContext, this.logger, this.browserStorage);
-                setActiveAccount(cachedAccount, this.browserStorage);
+                const correlationId = createNewGuid();
+                const cachedAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
+                setActiveAccount(cachedAccount, this.browserStorage, correlationId);
             }
         }
         /**
@@ -17670,7 +17785,7 @@
                 };
                 // cache the tokens in the response
                 await this.hydrateCache(result, request);
-                this.browserStorage.setActiveAccount(result.account);
+                this.browserStorage.setActiveAccount(result.account, result.correlationId);
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Popup, result);
                 atPopupMeasurement.add({
                     accessTokenSize: result.accessToken.length,
@@ -17720,7 +17835,7 @@
                 const result = this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp);
                 // cache the tokens in the response
                 await this.hydrateCache(result, request);
-                this.browserStorage.setActiveAccount(result.account);
+                this.browserStorage.setActiveAccount(result.account, result.correlationId);
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, result);
                 ssoSilentMeasurement?.add({
                     accessTokenSize: result.accessToken.length,
@@ -17791,10 +17906,11 @@
          * @returns
          */
         async acquireTokenFromCacheInternal(request) {
+            const correlationId = request.correlationId || createNewGuid();
             const accountContext = this.bridgeProxy.getAccountContext();
             let currentAccount = null;
             if (accountContext) {
-                const hubAccount = getAccount(accountContext, this.logger, this.browserStorage);
+                const hubAccount = getAccount(accountContext, this.logger, this.browserStorage, correlationId);
                 // always prioritize for hub account context, the reqirement of `request.account` will be removed soon
                 currentAccount = hubAccount || request.account;
             }
@@ -17806,7 +17922,7 @@
             this.logger.verbose("active account found, attempting to acquire token silently");
             const authRequest = {
                 ...request,
-                correlationId: request.correlationId || this.browserCrypto.createNewGuid(),
+                correlationId: correlationId,
                 authority: request.authority || currentAccount.environment,
                 scopes: request.scopes?.length
                     ? request.scopes
@@ -17814,7 +17930,7 @@
             };
             // fetch access token and check for expiry
             const tokenKeys = this.browserStorage.getTokenKeys();
-            const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+            const cachedAccessToken = this.browserStorage.getAccessToken(currentAccount, authRequest, tokenKeys, currentAccount.tenantId, this.performanceClient);
             // If there is no access token, log it and return null
             if (!cachedAccessToken) {
                 this.logger.verbose("No cached access token found");
@@ -17825,7 +17941,7 @@
                 this.logger.verbose("Cached access token has expired");
                 return Promise.resolve(null);
             }
-            const cachedIdToken = this.browserStorage.getIdToken(currentAccount, tokenKeys, currentAccount.tenantId, this.performanceClient, authRequest.correlationId);
+            const cachedIdToken = this.browserStorage.getIdToken(currentAccount, authRequest.correlationId, tokenKeys, currentAccount.tenantId, this.performanceClient);
             if (!cachedIdToken) {
                 this.logger.verbose("No cached id token found");
                 return Promise.resolve(null);
@@ -17922,7 +18038,8 @@
          * @returns Array of AccountInfo objects in cache
          */
         getAllAccounts(accountFilter) {
-            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), accountFilter);
+            const correlationId = createNewGuid();
+            return getAllAccounts(this.logger, this.browserStorage, this.isBrowserEnv(), correlationId, accountFilter);
         }
         /**
          * Returns the first account found in the cache that matches the account filter passed in.
@@ -17930,7 +18047,8 @@
          * @returns The first account found in the cache matching the provided filter or null if no account could be found.
          */
         getAccount(accountFilter) {
-            return getAccount(accountFilter, this.logger, this.browserStorage);
+            const correlationId = createNewGuid();
+            return getAccount(accountFilter, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching username.
@@ -17941,7 +18059,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByUsername(username) {
-            return getAccountByUsername(username, this.logger, this.browserStorage);
+            const correlationId = createNewGuid();
+            return getAccountByUsername(username, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching homeAccountId.
@@ -17951,7 +18070,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByHomeId(homeAccountId) {
-            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage);
+            const correlationId = createNewGuid();
+            return getAccountByHomeId(homeAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Returns the signed in account matching localAccountId.
@@ -17961,7 +18081,8 @@
          * @returns The account object stored in MSAL
          */
         getAccountByLocalId(localAccountId) {
-            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage);
+            const correlationId = createNewGuid();
+            return getAccountByLocalId(localAccountId, this.logger, this.browserStorage, correlationId);
         }
         /**
          * Sets the account to use as the active account. If no account is passed to the acquireToken APIs, then MSAL will use this active account.
@@ -17972,13 +18093,15 @@
              * StandardController uses this to allow the developer to set the active account
              * in the nested app auth scenario the active account is controlled by the app hosting the nested app
              */
-            return setActiveAccount(account, this.browserStorage);
+            const correlationId = createNewGuid();
+            return setActiveAccount(account, this.browserStorage, correlationId);
         }
         /**
          * Gets the currently active account
          */
         getActiveAccount() {
-            return getActiveAccount(this.browserStorage);
+            const correlationId = createNewGuid();
+            return getActiveAccount(this.browserStorage, correlationId);
         }
         // #endregion
         handleRedirectPromise(hash // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -18060,7 +18183,7 @@
         async hydrateCache(result, request) {
             this.logger.verbose("hydrateCache called");
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            this.browserStorage.setAccount(accountEntity);
+            this.browserStorage.setAccount(accountEntity, result.correlationId);
             return this.browserStorage.hydrateCache(result, request);
         }
     }