@azure/msal-browser 4.25.0 → 4.26.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.25.0 2025-10-09 */
+/*! @azure/msal-browser v4.26.0 2025-10-29 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -279,7 +279,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -296,7 +296,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -345,7 +345,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -443,7 +443,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -695,7 +695,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -734,7 +734,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -925,12 +925,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.13.0";
+const version$1 = "15.13.1";
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -950,7 +950,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1006,7 +1006,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1149,7 +1149,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1246,7 +1246,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1441,7 +1441,47 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Function to build a client info object from server clientInfo string
+ * @param rawClientInfo
+ * @param crypto
+ */
+function buildClientInfo(rawClientInfo, base64Decode) {
+    if (!rawClientInfo) {
+        throw createClientAuthError(clientInfoEmptyError);
+    }
+    try {
+        const decodedClientInfo = base64Decode(rawClientInfo);
+        return JSON.parse(decodedClientInfo);
+    }
+    catch (e) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+}
+/**
+ * Function to build a client info object from cached homeAccountId string
+ * @param homeAccountId
+ */
+function buildClientInfoFromHomeAccountId(homeAccountId) {
+    if (!homeAccountId) {
+        throw createClientAuthError(clientInfoDecodingError);
+    }
+    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+    return {
+        uid: clientInfoParts[0],
+        utid: clientInfoParts.length < 2
+            ? Constants.EMPTY_STRING
+            : clientInfoParts[1],
+    };
+}
+
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1523,7 +1563,289 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Authority types supported by MSAL.
+ */
+const AuthorityType = {
+    Default: 0,
+    Adfs: 1,
+    Dsts: 2,
+    Ciam: 3,
+};
+
+/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
+    }
+    return null;
+}
+
+/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Protocol modes supported by MSAL.
+ */
+const ProtocolMode = {
+    /**
+     * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
+     */
+    AAD: "AAD",
+    /**
+     * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
+     * Support is limited for this mode.
+     */
+    OIDC: "OIDC",
+    /**
+     * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
+     */
+    EAR: "EAR",
+};
+
+/*! @azure/msal-common v15.13.1 2025-10-29 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
+ *
+ * Key : Value Schema
+ *
+ * Key: <home_account_id>-<environment>-<realm*>
+ *
+ * Value Schema:
+ * {
+ *      homeAccountId: home account identifier for the auth scheme,
+ *      environment: entity that issued the token, represented as a full host
+ *      realm: Full tenant or organizational identifier that the account belongs to
+ *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
+ *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
+ *      authorityType: Accounts authority type as a string
+ *      name: Full name for the account, including given name and family name,
+ *      lastModificationTime: last time this entity was modified in the cache
+ *      lastModificationApp:
+ *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
+ * }
+ * @internal
+ */
+class AccountEntity {
+    /**
+     * Returns the AccountInfo interface for this account.
+     */
+    static getAccountInfo(accountEntity) {
+        return {
+            homeAccountId: accountEntity.homeAccountId,
+            environment: accountEntity.environment,
+            tenantId: accountEntity.realm,
+            username: accountEntity.username,
+            localAccountId: accountEntity.localAccountId,
+            loginHint: accountEntity.loginHint,
+            name: accountEntity.name,
+            nativeAccountId: accountEntity.nativeAccountId,
+            authorityType: accountEntity.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map((accountEntity.tenantProfiles || []).map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })),
+            dataBoundary: accountEntity.dataBoundary,
+        };
+    }
+    /**
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     */
+    isSingleTenant() {
+        return !this.tenantProfiles;
+    }
+    /**
+     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+     * @param accountDetails
+     */
+    static createAccount(accountDetails, authority, base64Decode) {
+        const account = new AccountEntity();
+        if (authority.authorityType === AuthorityType.Adfs) {
+            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+        }
+        else if (authority.protocolMode === ProtocolMode.OIDC) {
+            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        }
+        else {
+            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+        }
+        let clientInfo;
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+            if (clientInfo.xms_tdbr) {
+                account.dataBoundary =
+                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+            }
+        }
+        account.clientInfo = accountDetails.clientInfo;
+        account.homeAccountId = accountDetails.homeAccountId;
+        account.nativeAccountId = accountDetails.nativeAccountId;
+        const env = accountDetails.environment ||
+            (authority && authority.getPreferredCache());
+        if (!env) {
+            throw createClientAuthError(invalidCacheEnvironment);
+        }
+        account.environment = env;
+        // non AAD scenarios can have empty realm
+        account.realm =
+            clientInfo?.utid ||
+                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+                "";
+        // How do you account for MSA CID here?
+        account.localAccountId =
+            clientInfo?.uid ||
+                accountDetails.idTokenClaims?.oid ||
+                accountDetails.idTokenClaims?.sub ||
+                "";
+        /*
+         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+         * In most cases it will contain a single email. This field should not be relied upon if a custom
+         * policy is configured to return more than 1 email.
+         */
+        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+            accountDetails.idTokenClaims?.upn;
+        const email = accountDetails.idTokenClaims?.emails
+            ? accountDetails.idTokenClaims.emails[0]
+            : null;
+        account.username = preferredUsername || email || "";
+        account.loginHint = accountDetails.idTokenClaims?.login_hint;
+        account.name = accountDetails.idTokenClaims?.name || "";
+        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+        account.msGraphHost = accountDetails.msGraphHost;
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
+        }
+        else {
+            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
+            account.tenantProfiles = [tenantProfile];
+        }
+        return account;
+    }
+    /**
+     * Creates an AccountEntity object from AccountInfo
+     * @param accountInfo
+     * @param cloudGraphHostName
+     * @param msGraphHost
+     * @returns
+     */
+    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
+        const account = new AccountEntity();
+        account.authorityType =
+            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+        account.homeAccountId = accountInfo.homeAccountId;
+        account.localAccountId = accountInfo.localAccountId;
+        account.nativeAccountId = accountInfo.nativeAccountId;
+        account.realm = accountInfo.tenantId;
+        account.environment = accountInfo.environment;
+        account.username = accountInfo.username;
+        account.name = accountInfo.name;
+        account.loginHint = accountInfo.loginHint;
+        account.cloudGraphHostName = cloudGraphHostName;
+        account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+        account.dataBoundary = accountInfo.dataBoundary;
+        return account;
+    }
+    /**
+     * Generate HomeAccountId from server response
+     * @param serverClientInfo
+     * @param authType
+     */
+    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+        // since ADFS/DSTS do not have tid and does not set client_info
+        if (!(authType === AuthorityType.Adfs ||
+            authType === AuthorityType.Dsts)) {
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
+                }
+                catch (e) { }
+            }
+            logger.warning("No client info in response");
+        }
+        // default to "sub" claim
+        return idTokenClaims?.sub || "";
+    }
+    /**
+     * Validates an entity: checks for all expected params
+     * @param entity
+     */
+    static isAccountEntity(entity) {
+        if (!entity) {
+            return false;
+        }
+        return (entity.hasOwnProperty("homeAccountId") &&
+            entity.hasOwnProperty("environment") &&
+            entity.hasOwnProperty("realm") &&
+            entity.hasOwnProperty("localAccountId") &&
+            entity.hasOwnProperty("username") &&
+            entity.hasOwnProperty("authorityType"));
+    }
+    /**
+     * Helper function to determine whether 2 accountInfo objects represent the same account
+     * @param accountA
+     * @param accountB
+     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+     */
+    static accountInfoIsEqual(accountA, accountB, compareClaims) {
+        if (!accountA || !accountB) {
+            return false;
+        }
+        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
+        if (compareClaims) {
+            const accountAClaims = (accountA.idTokenClaims ||
+                {});
+            const accountBClaims = (accountB.idTokenClaims ||
+                {});
+            // issued at timestamp and nonce are expected to change each time a new id token is acquired
+            claimsMatch =
+                accountAClaims.iat === accountBClaims.iat &&
+                    accountAClaims.nonce === accountBClaims.nonce;
+        }
+        return (accountA.homeAccountId === accountB.homeAccountId &&
+            accountA.localAccountId === accountB.localAccountId &&
+            accountA.username === accountB.username &&
+            accountA.tenantId === accountB.tenantId &&
+            accountA.loginHint === accountB.loginHint &&
+            accountA.environment === accountB.environment &&
+            accountA.nativeAccountId === accountB.nativeAccountId &&
+            claimsMatch);
+    }
+}
+
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1546,6 +1868,26 @@ function extractTokenClaims(encodedToken, base64Decode) {
         throw createClientAuthError(tokenParsingError);
     }
 }
+/**
+ * Check if the signin_state claim contains "kmsi"
+ * @param idTokenClaims
+ * @returns
+ */
+function isKmsi(idTokenClaims) {
+    if (!idTokenClaims.signin_state) {
+        return false;
+    }
+    /**
+     * Signin_state claim known values:
+     * dvc_mngd - device is managed
+     * dvc_dmjd - device is domain joined
+     * kmsi - user opted to "keep me signed in"
+     * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+     */
+    const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+    const kmsi = idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+    return kmsi;
+}
 /**
  * decode a JWT
  *
@@ -1584,7 +1926,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1700,7 +2042,7 @@ function normalizeUrlForComparison(url) {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1864,7 +2206,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2003,7 +2345,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2011,7 +2353,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2056,7 +2398,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2115,7 +2457,7 @@ class CacheManager {
     getBaseAccountInfo(accountFilter, correlationId) {
         const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
         if (accountEntities.length > 0) {
-            return accountEntities[0].getAccountInfo();
+            return AccountEntity.getAccountInfo(accountEntities[0]);
         }
         else {
             return null;
@@ -2154,7 +2496,7 @@ class CacheManager {
         return tenantedAccountInfo;
     }
     getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
-        const accountInfo = accountEntity.getAccountInfo();
+        const accountInfo = AccountEntity.getAccountInfo(accountEntity);
         let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
         const tokenKeys = this.getTokenKeys();
         // If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
@@ -2224,27 +2566,28 @@ class CacheManager {
     /**
      * saves a cache record
      * @param cacheRecord {CacheRecord}
-     * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
+     * @param kmsi - Keep Me Signed In
+     * @param storeInCache {?StoreInCache}
      */
-    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
         try {
             if (!!cacheRecord.account) {
-                await this.setAccount(cacheRecord.account, correlationId);
+                await this.setAccount(cacheRecord.account, correlationId, kmsi);
             }
             if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                await this.setIdTokenCredential(cacheRecord.idToken, correlationId);
+                await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
             }
             if (!!cacheRecord.accessToken &&
                 storeInCache?.accessToken !== false) {
-                await this.saveAccessToken(cacheRecord.accessToken, correlationId);
+                await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
             }
             if (!!cacheRecord.refreshToken &&
                 storeInCache?.refreshToken !== false) {
-                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
+                await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
             }
             if (!!cacheRecord.appMetadata) {
                 this.setAppMetadata(cacheRecord.appMetadata, correlationId);
@@ -2264,7 +2607,7 @@ class CacheManager {
      * saves access token credential
      * @param credential
      */
-    async saveAccessToken(credential, correlationId) {
+    async saveAccessToken(credential, correlationId, kmsi) {
         const accessTokenFilter = {
             clientId: credential.clientId,
             credentialType: credential.credentialType,
@@ -2289,7 +2632,7 @@ class CacheManager {
                 }
             }
         });
-        await this.setAccessTokenCredential(credential, correlationId);
+        await this.setAccessTokenCredential(credential, correlationId, kmsi);
     }
     /**
      * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -3165,31 +3508,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Protocol modes supported by MSAL.
- */
-const ProtocolMode = {
-    /**
-     * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
-     */
-    AAD: "AAD",
-    /**
-     * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
-     * Support is limited for this mode.
-     */
-    OIDC: "OIDC",
-    /**
-     * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
-     */
-    EAR: "EAR",
-};
-
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3711,7 +4030,7 @@ const IntFields = new Set([
     "upgradedCacheCount",
 ]);
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3790,7 +4109,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3868,79 +4187,39 @@ function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions:
         serializableCache: serializableCache || null,
     };
 }
-/**
- * Construct authoptions from the client and platform passed values
- * @param authOptions
- */
-function buildAuthOptions(authOptions) {
-    return {
-        clientCapabilities: [],
-        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
-        skipAuthorityMetadataCache: false,
-        instanceAware: false,
-        encodeExtraQueryParams: false,
-        ...authOptions,
-    };
-}
-/**
- * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
- * @param ClientConfiguration
- */
-function isOidcProtocolMode(config) {
-    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-09 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-const CcsCredentialType = {
-    HOME_ACCOUNT_ID: "home_account_id",
-    UPN: "UPN",
-};
-
-/*! @azure/msal-common v15.13.0 2025-10-09 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Function to build a client info object from server clientInfo string
- * @param rawClientInfo
- * @param crypto
- */
-function buildClientInfo(rawClientInfo, base64Decode) {
-    if (!rawClientInfo) {
-        throw createClientAuthError(clientInfoEmptyError);
-    }
-    try {
-        const decodedClientInfo = base64Decode(rawClientInfo);
-        return JSON.parse(decodedClientInfo);
-    }
-    catch (e) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-}
-/**
- * Function to build a client info object from cached homeAccountId string
- * @param homeAccountId
+/**
+ * Construct authoptions from the client and platform passed values
+ * @param authOptions
  */
-function buildClientInfoFromHomeAccountId(homeAccountId) {
-    if (!homeAccountId) {
-        throw createClientAuthError(clientInfoDecodingError);
-    }
-    const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+function buildAuthOptions(authOptions) {
     return {
-        uid: clientInfoParts[0],
-        utid: clientInfoParts.length < 2
-            ? Constants.EMPTY_STRING
-            : clientInfoParts[1],
+        clientCapabilities: [],
+        azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+        skipAuthorityMetadataCache: false,
+        instanceAware: false,
+        encodeExtraQueryParams: false,
+        ...authOptions,
     };
+}
+/**
+ * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+ * @param ClientConfiguration
+ */
+function isOidcProtocolMode(config) {
+    return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CcsCredentialType = {
+    HOME_ACCOUNT_ID: "home_account_id",
+    UPN: "UPN",
+};
+
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3990,7 +4269,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4370,22 +4649,7 @@ function addPostBodyParameters(parameters, bodyParameters) {
     });
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Authority types supported by MSAL.
- */
-const AuthorityType = {
-    Default: 0,
-    Adfs: 1,
-    Dsts: 2,
-    Ciam: 3,
-};
-
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4397,7 +4661,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4407,7 +4671,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4417,7 +4681,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4513,7 +4777,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4619,7 +4883,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4684,7 +4948,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4946,7 +5210,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5785,7 +6049,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5816,7 +6080,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5835,7 +6099,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5856,7 +6120,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5943,7 +6207,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5974,7 +6238,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6044,328 +6308,85 @@ class BaseClient {
             response.status < 500 &&
             response.status !== 429) {
             // Telemetry data successfully logged by server, clear Telemetry cache
-            this.config.serverTelemetryManager.clearTelemetryCache();
-        }
-        return response;
-    }
-    /**
-     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-     * @param thumbprint - Request thumbprint for throttling
-     * @param tokenEndpoint - Endpoint to make the POST to
-     * @param options - Body and Headers to include on the POST request
-     * @param correlationId - CorrelationId for telemetry
-     */
-    async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
-        let response;
-        try {
-            response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
-            const responseHeaders = response.headers || {};
-            this.performanceClient?.addFields({
-                refreshTokenSize: response.body.refresh_token?.length || 0,
-                httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
-                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
-            }, correlationId);
-        }
-        catch (e) {
-            if (e instanceof NetworkError) {
-                const responseHeaders = e.responseHeaders;
-                if (responseHeaders) {
-                    this.performanceClient?.addFields({
-                        httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
-                        requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
-                            "",
-                        contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
-                            undefined,
-                        contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
-                            undefined,
-                        httpStatus: e.httpStatus,
-                    }, correlationId);
-                }
-                throw e.error;
-            }
-            if (e instanceof AuthError) {
-                throw e;
-            }
-            else {
-                throw createClientAuthError(networkError);
-            }
-        }
-        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
-        return response;
-    }
-    /**
-     * Updates the authority object of the client. Endpoint discovery must be completed.
-     * @param updatedAuthority
-     */
-    async updateAuthority(cloudInstanceHostname, correlationId) {
-        this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);
-        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
-        const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
-        this.authority = cloudInstanceAuthority;
-    }
-    /**
-     * Creates query string for the /token request
-     * @param request
-     */
-    createTokenQueryParameters(request) {
-        const parameters = new Map();
-        if (request.embeddedClientId) {
-            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
-        }
-        if (request.tokenQueryParameters) {
-            addExtraQueryParameters(parameters, request.tokenQueryParameters);
-        }
-        addCorrelationId(parameters, request.correlationId);
-        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-        return mapToQueryString(parameters);
-    }
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-09 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
- * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
- * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
- * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
- * Downcased to match the realm case-insensitive comparison requirements
- * @param idTokenClaims
- * @returns
- */
-function getTenantIdFromIdTokenClaims(idTokenClaims) {
-    if (idTokenClaims) {
-        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
-        return tenantId || null;
-    }
-    return null;
-}
-
-/*! @azure/msal-common v15.13.0 2025-10-09 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
- *
- * Key : Value Schema
- *
- * Key: <home_account_id>-<environment>-<realm*>
- *
- * Value Schema:
- * {
- *      homeAccountId: home account identifier for the auth scheme,
- *      environment: entity that issued the token, represented as a full host
- *      realm: Full tenant or organizational identifier that the account belongs to
- *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
- *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
- *      authorityType: Accounts authority type as a string
- *      name: Full name for the account, including given name and family name,
- *      lastModificationTime: last time this entity was modified in the cache
- *      lastModificationApp:
- *      nativeAccountId: Account identifier on the native device
- *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
- * }
- * @internal
- */
-class AccountEntity {
-    /**
-     * Returns the AccountInfo interface for this account.
-     */
-    getAccountInfo() {
-        return {
-            homeAccountId: this.homeAccountId,
-            environment: this.environment,
-            tenantId: this.realm,
-            username: this.username,
-            localAccountId: this.localAccountId,
-            loginHint: this.loginHint,
-            name: this.name,
-            nativeAccountId: this.nativeAccountId,
-            authorityType: this.authorityType,
-            // Deserialize tenant profiles array into a Map
-            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
-                return [tenantProfile.tenantId, tenantProfile];
-            })),
-            dataBoundary: this.dataBoundary,
-        };
-    }
-    /**
-     * Returns true if the account entity is in single tenant format (outdated), false otherwise
-     */
-    isSingleTenant() {
-        return !this.tenantProfiles;
-    }
-    /**
-     * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-     * @param accountDetails
-     */
-    static createAccount(accountDetails, authority, base64Decode) {
-        const account = new AccountEntity();
-        if (authority.authorityType === AuthorityType.Adfs) {
-            account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
-        }
-        else if (authority.protocolMode === ProtocolMode.OIDC) {
-            account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        }
-        else {
-            account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-        }
-        let clientInfo;
-        if (accountDetails.clientInfo && base64Decode) {
-            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
-            if (clientInfo.xms_tdbr) {
-                account.dataBoundary =
-                    clientInfo.xms_tdbr === "EU" ? "EU" : "None";
-            }
-        }
-        account.clientInfo = accountDetails.clientInfo;
-        account.homeAccountId = accountDetails.homeAccountId;
-        account.nativeAccountId = accountDetails.nativeAccountId;
-        const env = accountDetails.environment ||
-            (authority && authority.getPreferredCache());
-        if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
-        }
-        account.environment = env;
-        // non AAD scenarios can have empty realm
-        account.realm =
-            clientInfo?.utid ||
-                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
-                "";
-        // How do you account for MSA CID here?
-        account.localAccountId =
-            clientInfo?.uid ||
-                accountDetails.idTokenClaims?.oid ||
-                accountDetails.idTokenClaims?.sub ||
-                "";
-        /*
-         * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-         * In most cases it will contain a single email. This field should not be relied upon if a custom
-         * policy is configured to return more than 1 email.
-         */
-        const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
-            accountDetails.idTokenClaims?.upn;
-        const email = accountDetails.idTokenClaims?.emails
-            ? accountDetails.idTokenClaims.emails[0]
-            : null;
-        account.username = preferredUsername || email || "";
-        account.loginHint = accountDetails.idTokenClaims?.login_hint;
-        account.name = accountDetails.idTokenClaims?.name || "";
-        account.cloudGraphHostName = accountDetails.cloudGraphHostName;
-        account.msGraphHost = accountDetails.msGraphHost;
-        if (accountDetails.tenantProfiles) {
-            account.tenantProfiles = accountDetails.tenantProfiles;
-        }
-        else {
-            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
-            account.tenantProfiles = [tenantProfile];
+            this.config.serverTelemetryManager.clearTelemetryCache();
         }
-        return account;
-    }
-    /**
-     * Creates an AccountEntity object from AccountInfo
-     * @param accountInfo
-     * @param cloudGraphHostName
-     * @param msGraphHost
-     * @returns
-     */
-    static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
-        const account = new AccountEntity();
-        account.authorityType =
-            accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
-        account.homeAccountId = accountInfo.homeAccountId;
-        account.localAccountId = accountInfo.localAccountId;
-        account.nativeAccountId = accountInfo.nativeAccountId;
-        account.realm = accountInfo.tenantId;
-        account.environment = accountInfo.environment;
-        account.username = accountInfo.username;
-        account.name = accountInfo.name;
-        account.loginHint = accountInfo.loginHint;
-        account.cloudGraphHostName = cloudGraphHostName;
-        account.msGraphHost = msGraphHost;
-        // Serialize tenant profiles map into an array
-        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
-        account.dataBoundary = accountInfo.dataBoundary;
-        return account;
+        return response;
     }
     /**
-     * Generate HomeAccountId from server response
-     * @param serverClientInfo
-     * @param authType
+     * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+     * @param thumbprint - Request thumbprint for throttling
+     * @param tokenEndpoint - Endpoint to make the POST to
+     * @param options - Body and Headers to include on the POST request
+     * @param correlationId - CorrelationId for telemetry
      */
-    static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
-        // since ADFS/DSTS do not have tid and does not set client_info
-        if (!(authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts)) {
-            // for cases where there is clientInfo
-            if (serverClientInfo) {
-                try {
-                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
-                    if (clientInfo.uid && clientInfo.utid) {
-                        return `${clientInfo.uid}.${clientInfo.utid}`;
-                    }
+    async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
+        ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
+        let response;
+        try {
+            response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
+            const responseHeaders = response.headers || {};
+            this.performanceClient?.addFields({
+                refreshTokenSize: response.body.refresh_token?.length || 0,
+                httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+            }, correlationId);
+        }
+        catch (e) {
+            if (e instanceof NetworkError) {
+                const responseHeaders = e.responseHeaders;
+                if (responseHeaders) {
+                    this.performanceClient?.addFields({
+                        httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                        requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                            "",
+                        contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                            undefined,
+                        contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                            undefined,
+                        httpStatus: e.httpStatus,
+                    }, correlationId);
                 }
-                catch (e) { }
+                throw e.error;
+            }
+            if (e instanceof AuthError) {
+                throw e;
+            }
+            else {
+                throw createClientAuthError(networkError);
             }
-            logger.warning("No client info in response");
         }
-        // default to "sub" claim
-        return idTokenClaims?.sub || "";
+        ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
+        return response;
     }
     /**
-     * Validates an entity: checks for all expected params
-     * @param entity
+     * Updates the authority object of the client. Endpoint discovery must be completed.
+     * @param updatedAuthority
      */
-    static isAccountEntity(entity) {
-        if (!entity) {
-            return false;
-        }
-        return (entity.hasOwnProperty("homeAccountId") &&
-            entity.hasOwnProperty("environment") &&
-            entity.hasOwnProperty("realm") &&
-            entity.hasOwnProperty("localAccountId") &&
-            entity.hasOwnProperty("username") &&
-            entity.hasOwnProperty("authorityType"));
+    async updateAuthority(cloudInstanceHostname, correlationId) {
+        this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);
+        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
+        const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
+        this.authority = cloudInstanceAuthority;
     }
     /**
-     * Helper function to determine whether 2 accountInfo objects represent the same account
-     * @param accountA
-     * @param accountB
-     * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+     * Creates query string for the /token request
+     * @param request
      */
-    static accountInfoIsEqual(accountA, accountB, compareClaims) {
-        if (!accountA || !accountB) {
-            return false;
+    createTokenQueryParameters(request) {
+        const parameters = new Map();
+        if (request.embeddedClientId) {
+            addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
         }
-        let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-        if (compareClaims) {
-            const accountAClaims = (accountA.idTokenClaims ||
-                {});
-            const accountBClaims = (accountB.idTokenClaims ||
-                {});
-            // issued at timestamp and nonce are expected to change each time a new id token is acquired
-            claimsMatch =
-                accountAClaims.iat === accountBClaims.iat &&
-                    accountAClaims.nonce === accountBClaims.nonce;
+        if (request.tokenQueryParameters) {
+            addExtraQueryParameters(parameters, request.tokenQueryParameters);
         }
-        return (accountA.homeAccountId === accountB.homeAccountId &&
-            accountA.localAccountId === accountB.localAccountId &&
-            accountA.username === accountB.username &&
-            accountA.tenantId === accountB.tenantId &&
-            accountA.loginHint === accountB.loginHint &&
-            accountA.environment === accountB.environment &&
-            accountA.nativeAccountId === accountB.nativeAccountId &&
-            claimsMatch);
+        addCorrelationId(parameters, request.correlationId);
+        instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+        return mapToQueryString(parameters);
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6393,7 +6414,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6483,7 +6504,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6555,7 +6576,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6637,7 +6658,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6664,7 +6685,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6776,14 +6797,14 @@ class ResponseHandler {
             if (handlingRefreshTokenResponse &&
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
-                const key = this.cacheStorage.generateAccountKey(cacheRecord.account.getAccountInfo());
+                const key = this.cacheStorage.generateAccountKey(AccountEntity.getAccountInfo(cacheRecord.account));
                 const account = this.cacheStorage.getAccount(key, request.correlationId);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), request.storeInCache);
         }
         finally {
             if (this.persistencePlugin &&
@@ -6930,7 +6951,7 @@ class ResponseHandler {
                 serverTokenResponse?.spa_accountid;
         }
         const accountInfo = cacheRecord.account
-            ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
+            ? updateAccountTenantProfileData(AccountEntity.getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
             idTokenClaims, cacheRecord.idToken?.secret)
             : null;
         return {
@@ -6995,7 +7016,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7013,7 +7034,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7248,7 +7269,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7457,7 +7478,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7555,7 +7576,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7570,7 +7591,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7794,7 +7815,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7852,7 +7873,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8115,7 +8136,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8123,7 +8144,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8148,7 +8169,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8188,7 +8209,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v15.13.0 2025-10-09 */
+/*! @azure/msal-common v15.13.1 2025-10-29 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10304,7 +10325,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.25.0";
+const version = "4.26.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10312,9 +10333,9 @@ const version = "4.25.0";
  */
 const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
-const CACHE_KEY_SEPARATOR = "-";
-const CREDENTIAL_SCHEMA_VERSION = 1;
-const ACCOUNT_SCHEMA_VERSION = 1;
+const CACHE_KEY_SEPARATOR = "|";
+const CREDENTIAL_SCHEMA_VERSION = 2;
+const ACCOUNT_SCHEMA_VERSION = 2;
 const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
 const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
@@ -11474,7 +11495,10 @@ class LocalStorage {
             return null;
         }
         try {
-            return JSON.parse(decryptedData);
+            return {
+                ...JSON.parse(decryptedData),
+                lastUpdatedAt: data.lastUpdatedAt,
+            };
         }
         catch (e) {
             this.performanceClient.incrementFields({ encryptedCacheCorruptionCount: 1 }, correlationId);
@@ -11484,19 +11508,24 @@ class LocalStorage {
     setItem(key, value) {
         window.localStorage.setItem(key, value);
     }
-    async setUserData(key, value, correlationId, timestamp) {
+    async setUserData(key, value, correlationId, timestamp, kmsi) {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(uninitializedPublicClientApplication);
         }
-        const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
-        const encryptedData = {
-            id: this.encryptionCookie.id,
-            nonce: nonce,
-            data: data,
-            lastUpdatedAt: timestamp,
-        };
+        if (kmsi) {
+            this.setItem(key, value);
+        }
+        else {
+            const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
+            const encryptedData = {
+                id: this.encryptionCookie.id,
+                nonce: nonce,
+                data: data,
+                lastUpdatedAt: timestamp,
+            };
+            this.setItem(key, JSON.stringify(encryptedData));
+        }
         this.memoryStorage.setItem(key, value);
-        this.setItem(key, JSON.stringify(encryptedData));
         // Notify other frames to update their in-memory cache
         this.broadcast.postMessage({
             key: key,
@@ -11596,13 +11625,14 @@ class LocalStorage {
         if (!isEncrypted(encObj)) {
             // Data is not encrypted
             this.performanceClient.incrementFields({ unencryptedCacheCount: 1 }, correlationId);
-            return encObj;
+            return rawCache;
         }
         if (encObj.id !== this.encryptionCookie.id) {
             // Data was encrypted with a different key. It must be removed because it is from a previous session.
             this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
             return null;
         }
+        this.performanceClient.incrementFields({ encryptedCacheCount: 1 }, correlationId);
         return invokeAsync(decrypt, PerformanceEvents.Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, encObj.nonce, this.getContext(key), encObj.data);
     }
     /**
@@ -11794,108 +11824,338 @@ class BrowserCacheManager extends CacheManager {
      * Migrates any existing cache data from previous versions of MSAL.js into the current cache structure.
      */
     async migrateExistingCache(correlationId) {
-        const accountKeys0 = getAccountKeys(this.browserStorage, 0);
-        const tokenKeys0 = getTokenKeys(this.clientId, this.browserStorage, 0);
+        let accountKeys = getAccountKeys(this.browserStorage);
+        let tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
         this.performanceClient.addFields({
-            oldAccountCount: accountKeys0.length,
-            oldAccessCount: tokenKeys0.accessToken.length,
-            oldIdCount: tokenKeys0.idToken.length,
-            oldRefreshCount: tokenKeys0.refreshToken.length,
+            preMigrateAcntCount: accountKeys.length,
+            preMigrateATCount: tokenKeys.accessToken.length,
+            preMigrateITCount: tokenKeys.idToken.length,
+            preMigrateRTCount: tokenKeys.refreshToken.length,
         }, correlationId);
-        const accountKeys1 = getAccountKeys(this.browserStorage, 1);
-        const tokenKeys1 = getTokenKeys(this.clientId, this.browserStorage, 1);
+        for (let i = 0; i < ACCOUNT_SCHEMA_VERSION; i++) {
+            const credentialSchema = i; // For now account and credential schemas are the same, but may diverge in future
+            await this.removeStaleAccounts(i, credentialSchema, correlationId);
+        }
+        // Must migrate idTokens first to ensure we have KMSI info for the rest
+        for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+            const accountSchema = i; // For now account and credential schemas are the same, but may diverge in future
+            await this.migrateIdTokens(i, accountSchema, correlationId);
+        }
+        const kmsiMap = this.getKMSIValues();
+        for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+            await this.migrateAccessTokens(i, kmsiMap, correlationId);
+            await this.migrateRefreshTokens(i, kmsiMap, correlationId);
+        }
+        accountKeys = getAccountKeys(this.browserStorage);
+        tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
         this.performanceClient.addFields({
-            currAccountCount: accountKeys1.length,
-            currAccessCount: tokenKeys1.accessToken.length,
-            currIdCount: tokenKeys1.idToken.length,
-            currRefreshCount: tokenKeys1.refreshToken.length,
+            postMigrateAcntCount: accountKeys.length,
+            postMigrateATCount: tokenKeys.accessToken.length,
+            postMigrateITCount: tokenKeys.idToken.length,
+            postMigrateRTCount: tokenKeys.refreshToken.length,
         }, correlationId);
-        await Promise.all([
-            this.updateV0ToCurrent(ACCOUNT_SCHEMA_VERSION, accountKeys0, accountKeys1, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.idToken, tokenKeys1.idToken, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.accessToken, tokenKeys1.accessToken, correlationId),
-            this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.refreshToken, tokenKeys1.refreshToken, correlationId),
-        ]);
-        if (accountKeys0.length > 0) {
-            this.browserStorage.setItem(getAccountKeysCacheKey(0), JSON.stringify(accountKeys0));
+    }
+    /**
+     * Parses entry, adds lastUpdatedAt if it doesn't exist, removes entry if expired or invalid
+     * @param key
+     * @param correlationId
+     * @returns
+     */
+    async updateOldEntry(key, correlationId) {
+        const rawValue = this.browserStorage.getItem(key);
+        const parsedValue = this.validateAndParseJson(rawValue || "");
+        if (!parsedValue) {
+            this.browserStorage.removeItem(key);
+            return null;
         }
-        else {
-            this.browserStorage.removeItem(getAccountKeysCacheKey(0));
+        if (!parsedValue.lastUpdatedAt) {
+            // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
+            parsedValue.lastUpdatedAt = Date.now().toString();
+            this.setItem(key, JSON.stringify(parsedValue), correlationId);
         }
-        if (accountKeys1.length > 0) {
-            this.browserStorage.setItem(getAccountKeysCacheKey(1), JSON.stringify(accountKeys1));
+        else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+            this.browserStorage.removeItem(key);
+            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            return null;
         }
-        else {
-            this.browserStorage.removeItem(getAccountKeysCacheKey(1));
-        }
-        this.setTokenKeys(tokenKeys0, correlationId, 0);
-        this.setTokenKeys(tokenKeys1, correlationId, 1);
-    }
-    async updateV0ToCurrent(currentSchema, v0Keys, v1Keys, correlationId) {
-        const upgradePromises = [];
-        for (const v0Key of [...v0Keys]) {
-            const rawV0Value = this.browserStorage.getItem(v0Key);
-            const parsedV0Value = this.validateAndParseJson(rawV0Value || "");
-            if (!parsedV0Value) {
-                removeElementFromArray(v0Keys, v0Key);
+        const decryptedData = isEncrypted(parsedValue)
+            ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
+            : parsedValue;
+        if (!decryptedData || !isCredentialEntity(decryptedData)) {
+            this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
+            return null;
+        }
+        if ((isAccessTokenEntity(decryptedData) ||
+            isRefreshTokenEntity(decryptedData)) &&
+            decryptedData.expiresOn &&
+            isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
+            this.browserStorage.removeItem(key);
+            this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            return null;
+        }
+        return decryptedData;
+    }
+    /**
+     * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
+     * @param accountSchema
+     * @param credentialSchema
+     * @param correlationId
+     * @returns
+     */
+    async removeStaleAccounts(accountSchema, credentialSchema, correlationId) {
+        const accountKeysToCheck = getAccountKeys(this.browserStorage, accountSchema);
+        if (accountKeysToCheck.length === 0) {
+            return;
+        }
+        for (const accountKey of [...accountKeysToCheck]) {
+            this.performanceClient.incrementFields({ oldAcntCount: 1 }, correlationId);
+            const rawValue = this.browserStorage.getItem(accountKey);
+            const parsedValue = this.validateAndParseJson(rawValue || "");
+            if (!parsedValue) {
+                removeElementFromArray(accountKeysToCheck, accountKey);
+                continue;
+            }
+            if (!parsedValue.lastUpdatedAt) {
+                // Add lastUpdatedAt to the existing entry if it doesnt exist so we know when it's safe to remove it
+                parsedValue.lastUpdatedAt = Date.now().toString();
+                this.setItem(accountKey, JSON.stringify(parsedValue), correlationId);
+                continue;
+            }
+            else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+                // Cache expired remove account and associated tokens
+                await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                removeElementFromArray(accountKeysToCheck, accountKey);
+            }
+        }
+        this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
+    }
+    /**
+     * Remove the given account and all associated tokens from the cache
+     * @param accountKey
+     * @param rawObject
+     * @param credentialSchema
+     * @param correlationId
+     */
+    async removeAccountOldSchema(accountKey, rawObject, credentialSchema, correlationId) {
+        const decryptedData = isEncrypted(rawObject)
+            ? (await this.browserStorage.decryptData(accountKey, rawObject, correlationId))
+            : rawObject;
+        const homeAccountId = decryptedData?.homeAccountId;
+        if (homeAccountId) {
+            const tokenKeys = this.getTokenKeys(credentialSchema);
+            [...tokenKeys.idToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.idToken, key);
+            });
+            [...tokenKeys.accessToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.accessToken, key);
+            });
+            [...tokenKeys.refreshToken]
+                .filter((key) => key.includes(homeAccountId))
+                .forEach((key) => {
+                this.browserStorage.removeItem(key);
+                removeElementFromArray(tokenKeys.refreshToken, key);
+            });
+            this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
+        }
+        this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
+        this.browserStorage.removeItem(accountKey);
+    }
+    /**
+     * Gets key value pair mapping homeAccountId to KMSI value
+     * @returns
+     */
+    getKMSIValues() {
+        const kmsiMap = {};
+        const tokenKeys = this.getTokenKeys().idToken;
+        for (const key of tokenKeys) {
+            const rawValue = this.browserStorage.getUserData(key);
+            if (rawValue) {
+                const idToken = JSON.parse(rawValue);
+                const claims = extractTokenClaims(idToken.secret, base64Decode);
+                if (claims) {
+                    kmsiMap[idToken.homeAccountId] = isKmsi(claims);
+                }
+            }
+        }
+        return kmsiMap;
+    }
+    /**
+     * Migrates id tokens from the old schema to the new schema, also migrates associated account object if it doesn't already exist in the new schema
+     * @param credentialSchema
+     * @param accountSchema
+     * @param correlationId
+     * @returns
+     */
+    async migrateIdTokens(credentialSchema, accountSchema, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.idToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        const currentAccountKeys = getAccountKeys(this.browserStorage);
+        const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
+        for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
+            this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
+                continue;
+            }
+            const currentAccountKey = currentAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+            const previousAccountKey = previousAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+            let account = null;
+            if (currentAccountKey) {
+                account = this.getAccount(currentAccountKey, correlationId);
+            }
+            else if (previousAccountKey) {
+                const rawValue = this.browserStorage.getItem(previousAccountKey);
+                const parsedValue = this.validateAndParseJson(rawValue || "");
+                account =
+                    parsedValue && isEncrypted(parsedValue)
+                        ? (await this.browserStorage.decryptData(previousAccountKey, parsedValue, correlationId))
+                        : parsedValue;
+            }
+            if (!account) {
+                // Don't migrate idToken if we don't have an account for it
+                this.performanceClient.incrementFields({ skipITMigrateCount: 1 }, correlationId);
                 continue;
             }
-            if (!parsedV0Value.lastUpdatedAt) {
-                // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
-                parsedV0Value.lastUpdatedAt = Date.now().toString();
-                this.setItem(v0Key, JSON.stringify(parsedV0Value), correlationId);
-            }
-            const decryptedData = isEncrypted(parsedV0Value)
-                ? await this.browserStorage.decryptData(v0Key, parsedV0Value, correlationId)
-                : parsedV0Value;
-            let expirationTime;
-            if (decryptedData) {
-                if (isAccessTokenEntity(decryptedData)) {
-                    expirationTime = decryptedData.expiresOn;
+            const claims = extractTokenClaims(oldSchemaData.secret, base64Decode);
+            const newIdTokenKey = this.generateCredentialKey(oldSchemaData);
+            const currentIdToken = this.getIdTokenCredential(newIdTokenKey, correlationId);
+            const oldTokenHasSignInState = Object.keys(claims).includes("signin_state");
+            const currentTokenHasSignInState = currentIdToken &&
+                Object.keys(extractTokenClaims(currentIdToken.secret, base64Decode) || {}).includes("signin_state");
+            /**
+             * Only migrate if:
+             * 1. Token doesn't yet exist in current schema
+             * 2. Old schema token has been updated more recently than the current one AND migrating it won't result in loss of KMSI state
+             */
+            if (!currentIdToken ||
+                (oldSchemaData.lastUpdatedAt > currentIdToken.lastUpdatedAt &&
+                    (oldTokenHasSignInState || !currentTokenHasSignInState))) {
+                const tenantProfiles = account.tenantProfiles || [];
+                const tenantId = getTenantIdFromIdTokenClaims(claims) || account.realm;
+                if (tenantId &&
+                    !tenantProfiles.find((tenantProfile) => {
+                        return tenantProfile.tenantId === tenantId;
+                    })) {
+                    const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, claims);
+                    tenantProfiles.push(newTenantProfile);
                 }
-                else if (isRefreshTokenEntity(decryptedData)) {
-                    expirationTime = decryptedData.expiresOn;
+                account.tenantProfiles = tenantProfiles;
+                const newAccountKey = this.generateAccountKey(AccountEntity.getAccountInfo(account));
+                const kmsi = isKmsi(claims);
+                await this.setUserData(newAccountKey, JSON.stringify(account), correlationId, account.lastUpdatedAt, kmsi);
+                if (!currentAccountKeys.includes(newAccountKey)) {
+                    currentAccountKeys.push(newAccountKey);
                 }
+                await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
+                currentCredentialKeys.idToken.push(newIdTokenKey);
+            }
+        }
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
+        this.setAccountKeys(currentAccountKeys, correlationId);
+    }
+    /**
+     * Migrates access tokens from old cache schema to current schema
+     * @param credentialSchema
+     * @param kmsiMap
+     * @param correlationId
+     * @returns
+     */
+    async migrateAccessTokens(credentialSchema, kmsiMap, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.accessToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
+            this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
+                continue;
             }
-            if (!decryptedData ||
-                isCacheExpired(parsedV0Value.lastUpdatedAt, this.cacheConfig.cacheRetentionDays) ||
-                (expirationTime &&
-                    isTokenExpired(expirationTime, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC))) {
-                this.browserStorage.removeItem(v0Key);
-                removeElementFromArray(v0Keys, v0Key);
-                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+            if (!Object.keys(kmsiMap).includes(oldSchemaData.homeAccountId)) {
+                // Don't migrate tokens if we don't have an idToken for them
+                this.performanceClient.incrementFields({ skipATMigrateCount: 1 }, correlationId);
                 continue;
             }
-            if (this.cacheConfig.cacheLocation !==
-                BrowserCacheLocation.LocalStorage ||
-                isEncrypted(parsedV0Value)) {
-                const v1Key = `${PREFIX}.${currentSchema}${CACHE_KEY_SEPARATOR}${v0Key}`;
-                const rawV1Entry = this.browserStorage.getItem(v1Key);
-                if (!rawV1Entry) {
-                    upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                        v1Keys.push(v1Key);
-                        this.performanceClient.incrementFields({ upgradedCacheCount: 1 }, correlationId);
-                    }));
-                    continue;
+            const newKey = this.generateCredentialKey(oldSchemaData);
+            const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+            if (!currentCredentialKeys.accessToken.includes(newKey)) {
+                await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
+                currentCredentialKeys.accessToken.push(newKey);
+            }
+            else {
+                const currentToken = this.getAccessTokenCredential(newKey, correlationId);
+                if (!currentToken ||
+                    oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                    // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
                 }
-                else {
-                    const parsedV1Entry = this.validateAndParseJson(rawV1Entry);
-                    // If the entry already exists but is older than the v0 entry, replace it
-                    if (Number(parsedV0Value.lastUpdatedAt) >
-                        Number(parsedV1Entry.lastUpdatedAt)) {
-                        upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                            this.performanceClient.incrementFields({ updatedCacheFromV0Count: 1 }, correlationId);
-                        }));
-                        continue;
-                    }
+            }
+        }
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
+    }
+    /**
+     * Migrates refresh tokens from old cache schema to current schema
+     * @param credentialSchema
+     * @param kmsiMap
+     * @param correlationId
+     * @returns
+     */
+    async migrateRefreshTokens(credentialSchema, kmsiMap, correlationId) {
+        const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+        if (credentialKeysToMigrate.refreshToken.length === 0) {
+            return;
+        }
+        const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+        for (const refreshTokenKey of [
+            ...credentialKeysToMigrate.refreshToken,
+        ]) {
+            this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
+            const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+            if (!oldSchemaData) {
+                removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
+                continue;
+            }
+            if (!Object.keys(kmsiMap).includes(oldSchemaData.homeAccountId)) {
+                // Don't migrate tokens if we don't have an idToken for them
+                this.performanceClient.incrementFields({ skipRTMigrateCount: 1 }, correlationId);
+                continue;
+            }
+            const newKey = this.generateCredentialKey(oldSchemaData);
+            const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+            if (!currentCredentialKeys.refreshToken.includes(newKey)) {
+                await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
+                currentCredentialKeys.refreshToken.push(newKey);
+            }
+            else {
+                const currentToken = this.getRefreshTokenCredential(newKey, correlationId);
+                if (!currentToken ||
+                    oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                    // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
                 }
             }
-            /*
-             * Note: If we reach here for unencrypted localStorage data, we continue without migrating
-             * as we can't migrate unencrypted localStorage data right now since we can't guarantee KMSI=no
-             */
         }
-        return Promise.all(upgradePromises);
+        this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+        this.setTokenKeys(currentCredentialKeys, correlationId);
     }
     /**
      * Tracks upgrades and downgrades for telemetry and debugging purposes
@@ -11940,20 +12200,31 @@ class BrowserCacheManager extends CacheManager {
      * @param value
      */
     setItem(key, value, correlationId) {
-        let tokenKeysV0Count = 0;
-        let accessTokenKeys = [];
+        const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+        const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
         const maxRetries = 20;
         for (let i = 0; i <= maxRetries; i++) {
+            // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
             try {
                 this.browserStorage.setItem(key, value);
                 if (i > 0) {
-                    // Finally update the token keys array with the tokens removed
-                    if (i <= tokenKeysV0Count) {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                    }
-                    else {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                    // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                    for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                        // Get the sum of all previous token counts to use as start index for this schema version
+                        const startIndex = tokenKeysCount
+                            .slice(0, schemaVersion)
+                            .reduce((sum, count) => sum + count, 0);
+                        if (startIndex >= i) {
+                            // Done removing tokens
+                            break;
+                        }
+                        const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                            ? startIndex + tokenKeysCount[schemaVersion]
+                            : i;
+                        if (i > startIndex &&
+                            tokenKeysCount[schemaVersion] > 0) {
+                            this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                        }
                     }
                 }
                 break; // If setItem succeeds, exit the loop
@@ -11965,16 +12236,19 @@ class BrowserCacheManager extends CacheManager {
                     i < maxRetries) {
                     if (!accessTokenKeys.length) {
                         // If we are currently trying to set the token keys, use the value we're trying to set
-                        const tokenKeys0 = key ===
-                            getTokenKeysCacheKey(this.clientId, 0)
-                            ? JSON.parse(value).accessToken
-                            : this.getTokenKeys(0).accessToken;
-                        const tokenKeys1 = key ===
-                            getTokenKeysCacheKey(this.clientId)
-                            ? JSON.parse(value).accessToken
-                            : this.getTokenKeys().accessToken;
-                        accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                        tokenKeysV0Count = tokenKeys0.length;
+                        for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                            if (key ===
+                                getTokenKeysCacheKey(this.clientId, i)) {
+                                const tokenKeys = JSON.parse(value).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
+                            else {
+                                const tokenKeys = this.getTokenKeys(i).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
+                        }
                     }
                     if (accessTokenKeys.length <= i) {
                         // Nothing to remove, rethrow the error
@@ -11997,21 +12271,32 @@ class BrowserCacheManager extends CacheManager {
      * @param value
      * @param correlationId
      */
-    async setUserData(key, value, correlationId, timestamp) {
-        let tokenKeysV0Count = 0;
-        let accessTokenKeys = [];
+    async setUserData(key, value, correlationId, timestamp, kmsi) {
+        const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+        const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
         const maxRetries = 20;
         for (let i = 0; i <= maxRetries; i++) {
             try {
-                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp);
+                // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
+                await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp, kmsi);
                 if (i > 0) {
-                    // Finally update the token keys array with the tokens removed
-                    if (i <= tokenKeysV0Count) {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                    }
-                    else {
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                        this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                    // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                    for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                        // Get the sum of all previous token counts to use as start index for this schema version
+                        const startIndex = tokenKeysCount
+                            .slice(0, schemaVersion)
+                            .reduce((sum, count) => sum + count, 0);
+                        if (startIndex >= i) {
+                            // Done removing tokens
+                            break;
+                        }
+                        const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                            ? startIndex + tokenKeysCount[schemaVersion]
+                            : i;
+                        if (i > startIndex &&
+                            tokenKeysCount[schemaVersion] > 0) {
+                            this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                        }
                     }
                 }
                 break; // If setItem succeeds, exit the loop
@@ -12022,10 +12307,12 @@ class BrowserCacheManager extends CacheManager {
                     cacheQuotaExceeded &&
                     i < maxRetries) {
                     if (!accessTokenKeys.length) {
-                        const tokenKeys0 = this.getTokenKeys(0).accessToken;
-                        const tokenKeys1 = this.getTokenKeys().accessToken;
-                        accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                        tokenKeysV0Count = tokenKeys0.length;
+                        // If we are currently trying to set the token keys, use the value we're trying to set
+                        for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                            const tokenKeys = this.getTokenKeys(i).accessToken;
+                            accessTokenKeys.push(...tokenKeys);
+                            tokenKeysCount[i] = tokenKeys.length;
+                        }
                     }
                     if (accessTokenKeys.length <= i) {
                         // Nothing left to remove, rethrow the error
@@ -12065,20 +12352,21 @@ class BrowserCacheManager extends CacheManager {
      * set account entity in the platform cache
      * @param account
      */
-    async setAccount(account, correlationId) {
+    async setAccount(account, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setAccount called");
-        const key = this.generateAccountKey(account.getAccountInfo());
+        const key = this.generateAccountKey(AccountEntity.getAccountInfo(account));
         const timestamp = Date.now().toString();
         account.lastUpdatedAt = timestamp;
-        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+        await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
         const wasAdded = this.addAccountKeyToMap(key, correlationId);
+        this.performanceClient.addFields({ kmsi: kmsi }, correlationId);
         /**
          * @deprecated - Remove this in next major version in favor of more consistent LOGIN event
          */
         if (this.cacheConfig.cacheLocation ===
             BrowserCacheLocation.LocalStorage &&
             wasAdded) {
-            this.eventHandler.emitEvent(EventType.ACCOUNT_ADDED, undefined, account.getAccountInfo());
+            this.eventHandler.emitEvent(EventType.ACCOUNT_ADDED, undefined, AccountEntity.getAccountInfo(account));
         }
     }
     /**
@@ -12088,6 +12376,14 @@ class BrowserCacheManager extends CacheManager {
     getAccountKeys() {
         return getAccountKeys(this.browserStorage);
     }
+    setAccountKeys(accountKeys, correlationId, schemaVersion = ACCOUNT_SCHEMA_VERSION) {
+        if (accountKeys.length === 0) {
+            this.removeItem(getAccountKeysCacheKey(schemaVersion));
+        }
+        else {
+            this.setItem(getAccountKeysCacheKey(schemaVersion), JSON.stringify(accountKeys), correlationId);
+        }
+    }
     /**
      * Add a new account to the key map
      * @param key
@@ -12119,14 +12415,7 @@ class BrowserCacheManager extends CacheManager {
         const removalIndex = accountKeys.indexOf(key);
         if (removalIndex > -1) {
             accountKeys.splice(removalIndex, 1);
-            if (accountKeys.length === 0) {
-                // If no keys left, remove the map
-                this.removeItem(getAccountKeysCacheKey());
-                return;
-            }
-            else {
-                this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys), correlationId);
-            }
+            this.setAccountKeys(accountKeys, correlationId);
             this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
         }
         else {
@@ -12266,12 +12555,12 @@ class BrowserCacheManager extends CacheManager {
      * set IdToken credential to the platform cache
      * @param idToken
      */
-    async setIdTokenCredential(idToken, correlationId) {
+    async setIdTokenCredential(idToken, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
         const idTokenKey = this.generateCredentialKey(idToken);
         const timestamp = Date.now().toString();
         idToken.lastUpdatedAt = timestamp;
-        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+        await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
             this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
@@ -12303,12 +12592,12 @@ class BrowserCacheManager extends CacheManager {
      * set accessToken credential to the platform cache
      * @param accessToken
      */
-    async setAccessTokenCredential(accessToken, correlationId) {
+    async setAccessTokenCredential(accessToken, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
         const accessTokenKey = this.generateCredentialKey(accessToken);
         const timestamp = Date.now().toString();
         accessToken.lastUpdatedAt = timestamp;
-        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+        await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         const index = tokenKeys.accessToken.indexOf(accessTokenKey);
         if (index !== -1) {
@@ -12342,12 +12631,12 @@ class BrowserCacheManager extends CacheManager {
      * set refreshToken credential to the platform cache
      * @param refreshToken
      */
-    async setRefreshTokenCredential(refreshToken, correlationId) {
+    async setRefreshTokenCredential(refreshToken, correlationId, kmsi) {
         this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
         const refreshTokenKey = this.generateCredentialKey(refreshToken);
         const timestamp = Date.now().toString();
         refreshToken.lastUpdatedAt = timestamp;
-        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+        await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp, kmsi);
         const tokenKeys = this.getTokenKeys();
         if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
             this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
@@ -12847,7 +13136,7 @@ class BrowserCacheManager extends CacheManager {
             idToken: idTokenEntity,
             accessToken: accessTokenEntity,
         };
-        return this.saveCacheRecord(cacheRecord, result.correlationId);
+        return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)));
     }
     /**
      * saves a cache record
@@ -12855,9 +13144,9 @@ class BrowserCacheManager extends CacheManager {
      * @param storeInCache {?StoreInCache}
      * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+    async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
         try {
-            await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
+            await super.saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache);
         }
         catch (e) {
             if (e instanceof CacheError &&
@@ -14089,7 +14378,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(baseAccount, this.correlationId);
+        await this.cacheAccount(baseAccount, this.correlationId, isKmsi(idTokenClaims));
         await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
@@ -14176,7 +14465,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
         const tid = accountProperties["TenantId"] ||
             idTokenClaims.tid ||
             Constants.EMPTY_STRING;
-        const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
+        const accountInfo = updateAccountTenantProfileData(AccountEntity.getAccountInfo(accountEntity), undefined, // tenantProfile optional
         idTokenClaims, response.id_token);
         /**
          * In pairwise broker flows, this check prevents the broker's native account id
@@ -14213,11 +14502,11 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
      * cache the account entity in browser storage
      * @param accountEntity
      */
-    async cacheAccount(accountEntity, correlationId) {
+    async cacheAccount(accountEntity, correlationId, kmsi) {
         // Store the account info and hence `nativeAccountId` in browser cache
-        await this.browserStorage.setAccount(accountEntity, this.correlationId);
+        await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi);
         // Remove any existing cached tokens for this account in browser storage
-        this.browserStorage.removeAccountContext(accountEntity.getAccountInfo(), correlationId);
+        this.browserStorage.removeAccountContext(AccountEntity.getAccountInfo(accountEntity), correlationId);
     }
     /**
      * Stores the access_token and id_token in inmemory storage
@@ -14244,7 +14533,7 @@ class PlatformAuthInteractionClient extends BaseInteractionClient {
             idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
-        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+        return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), request.storeInCache);
     }
     getExpiresInValue(tokenType, expiresIn) {
         return tokenType === AuthenticationScheme.POP
@@ -16522,6 +16811,7 @@ class TokenCache {
         const idTokenClaims = response.id_token
             ? extractTokenClaims(response.id_token, base64Decode)
             : undefined;
+        const kmsi = isKmsi(idTokenClaims || {});
         const authorityOptions = {
             protocolMode: this.config.auth.protocolMode,
             knownAuthorities: this.config.auth.knownAuthorities,
@@ -16533,9 +16823,9 @@ class TokenCache {
             ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
             : undefined;
         const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
-        const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
-        const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
-        const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
+        const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
+        const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
+        const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
         return this.generateAuthenticationResult(request, {
             account: cacheRecordAccount,
             idToken,
@@ -16556,7 +16846,7 @@ class TokenCache {
         this.logger.verbose("TokenCache - loading account");
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-            await this.storage.setAccount(accountEntity, correlationId);
+            await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}));
             return accountEntity;
         }
         else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -16568,7 +16858,7 @@ class TokenCache {
         const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
         undefined, // nativeAccountId
         this.logger);
-        await this.storage.setAccount(cachedAccount, correlationId);
+        await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}));
         return cachedAccount;
     }
     /**
@@ -16579,14 +16869,14 @@ class TokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    async loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
+    async loadIdToken(response, homeAccountId, environment, tenantId, correlationId, kmsi) {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
             return null;
         }
         this.logger.verbose("TokenCache - loading id token");
         const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
+        await this.storage.setIdTokenCredential(idTokenEntity, correlationId, kmsi);
         return idTokenEntity;
     }
     /**
@@ -16598,7 +16888,7 @@ class TokenCache {
      * @param tenantId
      * @returns `AccessTokenEntity`
      */
-    async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
+    async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId, kmsi) {
         if (!response.access_token) {
             this.logger.verbose("TokenCache - no access token found in response");
             return null;
@@ -16621,7 +16911,7 @@ class TokenCache {
             (response.ext_expires_in || response.expires_in) +
                 nowSeconds();
         const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-        await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
+        await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId, kmsi);
         return accessTokenEntity;
     }
     /**
@@ -16632,7 +16922,7 @@ class TokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    async loadRefreshToken(response, homeAccountId, environment, correlationId) {
+    async loadRefreshToken(response, homeAccountId, environment, correlationId, kmsi) {
         if (!response.refresh_token) {
             this.logger.verbose("TokenCache - no refresh token found in response");
             return null;
@@ -16640,7 +16930,7 @@ class TokenCache {
         this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
         response.refresh_token_expires_in);
-        await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
+        await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId, kmsi);
         return refreshTokenEntity;
     }
     /**
@@ -16669,7 +16959,7 @@ class TokenCache {
             uniqueId: cacheRecord.account.localAccountId,
             tenantId: cacheRecord.account.realm,
             scopes: responseScopes,
-            account: accountEntity.getAccountInfo(),
+            account: AccountEntity.getAccountInfo(accountEntity),
             idToken: cacheRecord.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,
@@ -17687,7 +17977,7 @@ class StandardController {
         this.logger.verbose("hydrateCache called");
         // Account gets saved to browser storage regardless of native or not
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        await this.browserStorage.setAccount(accountEntity, result.correlationId);
+        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
         if (result.fromNativeBroker) {
             this.logger.verbose("Response was from native broker, storing in-memory");
             // Tokens from native broker are stored in-memory
@@ -18965,7 +19255,7 @@ class NestedAppAuthController {
     async hydrateCache(result, request) {
         this.logger.verbose("hydrateCache called");
         const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-        await this.browserStorage.setAccount(accountEntity, result.correlationId);
+        await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
         return this.browserStorage.hydrateCache(result, request);
     }
 }