@azure/msal-browser 4.25.1 → 4.26.1

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.25.1 2025-10-17 */
+/*! @azure/msal-browser v4.26.1 2025-11-06 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -283,7 +283,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -300,7 +300,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -349,7 +349,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -447,7 +447,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -699,7 +699,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -738,7 +738,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -929,12 +929,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.13.0";
+    const version$1 = "15.13.1";
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -954,7 +954,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1010,7 +1010,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1153,7 +1153,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1250,7 +1250,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1445,7 +1445,47 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Function to build a client info object from server clientInfo string
+     * @param rawClientInfo
+     * @param crypto
+     */
+    function buildClientInfo(rawClientInfo, base64Decode) {
+        if (!rawClientInfo) {
+            throw createClientAuthError(clientInfoEmptyError);
+        }
+        try {
+            const decodedClientInfo = base64Decode(rawClientInfo);
+            return JSON.parse(decodedClientInfo);
+        }
+        catch (e) {
+            throw createClientAuthError(clientInfoDecodingError);
+        }
+    }
+    /**
+     * Function to build a client info object from cached homeAccountId string
+     * @param homeAccountId
+     */
+    function buildClientInfoFromHomeAccountId(homeAccountId) {
+        if (!homeAccountId) {
+            throw createClientAuthError(clientInfoDecodingError);
+        }
+        const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+        return {
+            uid: clientInfoParts[0],
+            utid: clientInfoParts.length < 2
+                ? Constants.EMPTY_STRING
+                : clientInfoParts[1],
+        };
+    }
+
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1527,7 +1567,289 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Authority types supported by MSAL.
+     */
+    const AuthorityType = {
+        Default: 0,
+        Adfs: 1,
+        Dsts: 2,
+        Ciam: 3,
+    };
+
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+     * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+     * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+     * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+     * Downcased to match the realm case-insensitive comparison requirements
+     * @param idTokenClaims
+     * @returns
+     */
+    function getTenantIdFromIdTokenClaims(idTokenClaims) {
+        if (idTokenClaims) {
+            const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+            return tenantId || null;
+        }
+        return null;
+    }
+
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Protocol modes supported by MSAL.
+     */
+    const ProtocolMode = {
+        /**
+         * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
+         */
+        AAD: "AAD",
+        /**
+         * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
+         * Support is limited for this mode.
+         */
+        OIDC: "OIDC",
+        /**
+         * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
+         */
+        EAR: "EAR",
+    };
+
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
+     *
+     * Key : Value Schema
+     *
+     * Key: <home_account_id>-<environment>-<realm*>
+     *
+     * Value Schema:
+     * {
+     *      homeAccountId: home account identifier for the auth scheme,
+     *      environment: entity that issued the token, represented as a full host
+     *      realm: Full tenant or organizational identifier that the account belongs to
+     *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
+     *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
+     *      authorityType: Accounts authority type as a string
+     *      name: Full name for the account, including given name and family name,
+     *      lastModificationTime: last time this entity was modified in the cache
+     *      lastModificationApp:
+     *      nativeAccountId: Account identifier on the native device
+     *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
+     * }
+     * @internal
+     */
+    class AccountEntity {
+        /**
+         * Returns the AccountInfo interface for this account.
+         */
+        static getAccountInfo(accountEntity) {
+            return {
+                homeAccountId: accountEntity.homeAccountId,
+                environment: accountEntity.environment,
+                tenantId: accountEntity.realm,
+                username: accountEntity.username,
+                localAccountId: accountEntity.localAccountId,
+                loginHint: accountEntity.loginHint,
+                name: accountEntity.name,
+                nativeAccountId: accountEntity.nativeAccountId,
+                authorityType: accountEntity.authorityType,
+                // Deserialize tenant profiles array into a Map
+                tenantProfiles: new Map((accountEntity.tenantProfiles || []).map((tenantProfile) => {
+                    return [tenantProfile.tenantId, tenantProfile];
+                })),
+                dataBoundary: accountEntity.dataBoundary,
+            };
+        }
+        /**
+         * Returns true if the account entity is in single tenant format (outdated), false otherwise
+         */
+        isSingleTenant() {
+            return !this.tenantProfiles;
+        }
+        /**
+         * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
+         * @param accountDetails
+         */
+        static createAccount(accountDetails, authority, base64Decode) {
+            const account = new AccountEntity();
+            if (authority.authorityType === AuthorityType.Adfs) {
+                account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
+            }
+            else if (authority.protocolMode === ProtocolMode.OIDC) {
+                account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
+            }
+            else {
+                account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
+            }
+            let clientInfo;
+            if (accountDetails.clientInfo && base64Decode) {
+                clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+                if (clientInfo.xms_tdbr) {
+                    account.dataBoundary =
+                        clientInfo.xms_tdbr === "EU" ? "EU" : "None";
+                }
+            }
+            account.clientInfo = accountDetails.clientInfo;
+            account.homeAccountId = accountDetails.homeAccountId;
+            account.nativeAccountId = accountDetails.nativeAccountId;
+            const env = accountDetails.environment ||
+                (authority && authority.getPreferredCache());
+            if (!env) {
+                throw createClientAuthError(invalidCacheEnvironment);
+            }
+            account.environment = env;
+            // non AAD scenarios can have empty realm
+            account.realm =
+                clientInfo?.utid ||
+                    getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+                    "";
+            // How do you account for MSA CID here?
+            account.localAccountId =
+                clientInfo?.uid ||
+                    accountDetails.idTokenClaims?.oid ||
+                    accountDetails.idTokenClaims?.sub ||
+                    "";
+            /*
+             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+             * In most cases it will contain a single email. This field should not be relied upon if a custom
+             * policy is configured to return more than 1 email.
+             */
+            const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
+                accountDetails.idTokenClaims?.upn;
+            const email = accountDetails.idTokenClaims?.emails
+                ? accountDetails.idTokenClaims.emails[0]
+                : null;
+            account.username = preferredUsername || email || "";
+            account.loginHint = accountDetails.idTokenClaims?.login_hint;
+            account.name = accountDetails.idTokenClaims?.name || "";
+            account.cloudGraphHostName = accountDetails.cloudGraphHostName;
+            account.msGraphHost = accountDetails.msGraphHost;
+            if (accountDetails.tenantProfiles) {
+                account.tenantProfiles = accountDetails.tenantProfiles;
+            }
+            else {
+                const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
+                account.tenantProfiles = [tenantProfile];
+            }
+            return account;
+        }
+        /**
+         * Creates an AccountEntity object from AccountInfo
+         * @param accountInfo
+         * @param cloudGraphHostName
+         * @param msGraphHost
+         * @returns
+         */
+        static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
+            const account = new AccountEntity();
+            account.authorityType =
+                accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
+            account.homeAccountId = accountInfo.homeAccountId;
+            account.localAccountId = accountInfo.localAccountId;
+            account.nativeAccountId = accountInfo.nativeAccountId;
+            account.realm = accountInfo.tenantId;
+            account.environment = accountInfo.environment;
+            account.username = accountInfo.username;
+            account.name = accountInfo.name;
+            account.loginHint = accountInfo.loginHint;
+            account.cloudGraphHostName = cloudGraphHostName;
+            account.msGraphHost = msGraphHost;
+            // Serialize tenant profiles map into an array
+            account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
+            account.dataBoundary = accountInfo.dataBoundary;
+            return account;
+        }
+        /**
+         * Generate HomeAccountId from server response
+         * @param serverClientInfo
+         * @param authType
+         */
+        static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
+            // since ADFS/DSTS do not have tid and does not set client_info
+            if (!(authType === AuthorityType.Adfs ||
+                authType === AuthorityType.Dsts)) {
+                // for cases where there is clientInfo
+                if (serverClientInfo) {
+                    try {
+                        const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                        if (clientInfo.uid && clientInfo.utid) {
+                            return `${clientInfo.uid}.${clientInfo.utid}`;
+                        }
+                    }
+                    catch (e) { }
+                }
+                logger.warning("No client info in response");
+            }
+            // default to "sub" claim
+            return idTokenClaims?.sub || "";
+        }
+        /**
+         * Validates an entity: checks for all expected params
+         * @param entity
+         */
+        static isAccountEntity(entity) {
+            if (!entity) {
+                return false;
+            }
+            return (entity.hasOwnProperty("homeAccountId") &&
+                entity.hasOwnProperty("environment") &&
+                entity.hasOwnProperty("realm") &&
+                entity.hasOwnProperty("localAccountId") &&
+                entity.hasOwnProperty("username") &&
+                entity.hasOwnProperty("authorityType"));
+        }
+        /**
+         * Helper function to determine whether 2 accountInfo objects represent the same account
+         * @param accountA
+         * @param accountB
+         * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+         */
+        static accountInfoIsEqual(accountA, accountB, compareClaims) {
+            if (!accountA || !accountB) {
+                return false;
+            }
+            let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
+            if (compareClaims) {
+                const accountAClaims = (accountA.idTokenClaims ||
+                    {});
+                const accountBClaims = (accountB.idTokenClaims ||
+                    {});
+                // issued at timestamp and nonce are expected to change each time a new id token is acquired
+                claimsMatch =
+                    accountAClaims.iat === accountBClaims.iat &&
+                        accountAClaims.nonce === accountBClaims.nonce;
+            }
+            return (accountA.homeAccountId === accountB.homeAccountId &&
+                accountA.localAccountId === accountB.localAccountId &&
+                accountA.username === accountB.username &&
+                accountA.tenantId === accountB.tenantId &&
+                accountA.loginHint === accountB.loginHint &&
+                accountA.environment === accountB.environment &&
+                accountA.nativeAccountId === accountB.nativeAccountId &&
+                claimsMatch);
+        }
+    }
+
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1550,6 +1872,26 @@
             throw createClientAuthError(tokenParsingError);
         }
     }
+    /**
+     * Check if the signin_state claim contains "kmsi"
+     * @param idTokenClaims
+     * @returns
+     */
+    function isKmsi(idTokenClaims) {
+        if (!idTokenClaims.signin_state) {
+            return false;
+        }
+        /**
+         * Signin_state claim known values:
+         * dvc_mngd - device is managed
+         * dvc_dmjd - device is domain joined
+         * kmsi - user opted to "keep me signed in"
+         * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+         */
+        const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+        const kmsi = idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+        return kmsi;
+    }
     /**
      * decode a JWT
      *
@@ -1588,7 +1930,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1704,7 +2046,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1868,7 +2210,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2007,7 +2349,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2015,7 +2357,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2060,7 +2402,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2119,7 +2461,7 @@
         getBaseAccountInfo(accountFilter, correlationId) {
             const accountEntities = this.getAccountsFilteredBy(accountFilter, correlationId);
             if (accountEntities.length > 0) {
-                return accountEntities[0].getAccountInfo();
+                return AccountEntity.getAccountInfo(accountEntities[0]);
             }
             else {
                 return null;
@@ -2158,7 +2500,7 @@
             return tenantedAccountInfo;
         }
         getTenantProfilesFromAccountEntity(accountEntity, correlationId, targetTenantId, tenantProfileFilter) {
-            const accountInfo = accountEntity.getAccountInfo();
+            const accountInfo = AccountEntity.getAccountInfo(accountEntity);
             let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
             const tokenKeys = this.getTokenKeys();
             // If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
@@ -2228,27 +2570,28 @@
         /**
          * saves a cache record
          * @param cacheRecord {CacheRecord}
-         * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
+         * @param kmsi - Keep Me Signed In
+         * @param storeInCache {?StoreInCache}
          */
-        async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+        async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
             if (!cacheRecord) {
                 throw createClientAuthError(invalidCacheRecord);
             }
             try {
                 if (!!cacheRecord.account) {
-                    await this.setAccount(cacheRecord.account, correlationId);
+                    await this.setAccount(cacheRecord.account, correlationId, kmsi);
                 }
                 if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-                    await this.setIdTokenCredential(cacheRecord.idToken, correlationId);
+                    await this.setIdTokenCredential(cacheRecord.idToken, correlationId, kmsi);
                 }
                 if (!!cacheRecord.accessToken &&
                     storeInCache?.accessToken !== false) {
-                    await this.saveAccessToken(cacheRecord.accessToken, correlationId);
+                    await this.saveAccessToken(cacheRecord.accessToken, correlationId, kmsi);
                 }
                 if (!!cacheRecord.refreshToken &&
                     storeInCache?.refreshToken !== false) {
-                    await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId);
+                    await this.setRefreshTokenCredential(cacheRecord.refreshToken, correlationId, kmsi);
                 }
                 if (!!cacheRecord.appMetadata) {
                     this.setAppMetadata(cacheRecord.appMetadata, correlationId);
@@ -2268,7 +2611,7 @@
          * saves access token credential
          * @param credential
          */
-        async saveAccessToken(credential, correlationId) {
+        async saveAccessToken(credential, correlationId, kmsi) {
             const accessTokenFilter = {
                 clientId: credential.clientId,
                 credentialType: credential.credentialType,
@@ -2293,7 +2636,7 @@
                     }
                 }
             });
-            await this.setAccessTokenCredential(credential, correlationId);
+            await this.setAccessTokenCredential(credential, correlationId, kmsi);
         }
         /**
          * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
@@ -3169,31 +3512,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Protocol modes supported by MSAL.
-     */
-    const ProtocolMode = {
-        /**
-         * Auth Code + PKCE with Entra ID (formerly AAD) specific optimizations and features
-         */
-        AAD: "AAD",
-        /**
-         * Auth Code + PKCE without Entra ID specific optimizations and features. For use only with non-Microsoft owned authorities.
-         * Support is limited for this mode.
-         */
-        OIDC: "OIDC",
-        /**
-         * Encrypted Authorize Response (EAR) with Entra ID specific optimizations and features
-         */
-        EAR: "EAR",
-    };
-
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3715,7 +4034,7 @@
         "upgradedCacheCount",
     ]);
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3794,7 +4113,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3872,79 +4191,39 @@
             serializableCache: serializableCache || null,
         };
     }
-    /**
-     * Construct authoptions from the client and platform passed values
-     * @param authOptions
-     */
-    function buildAuthOptions(authOptions) {
-        return {
-            clientCapabilities: [],
-            azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
-            skipAuthorityMetadataCache: false,
-            instanceAware: false,
-            encodeExtraQueryParams: false,
-            ...authOptions,
-        };
-    }
-    /**
-     * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
-     * @param ClientConfiguration
-     */
-    function isOidcProtocolMode(config) {
-        return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
-    }
-
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    const CcsCredentialType = {
-        HOME_ACCOUNT_ID: "home_account_id",
-        UPN: "UPN",
-    };
-
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Function to build a client info object from server clientInfo string
-     * @param rawClientInfo
-     * @param crypto
-     */
-    function buildClientInfo(rawClientInfo, base64Decode) {
-        if (!rawClientInfo) {
-            throw createClientAuthError(clientInfoEmptyError);
-        }
-        try {
-            const decodedClientInfo = base64Decode(rawClientInfo);
-            return JSON.parse(decodedClientInfo);
-        }
-        catch (e) {
-            throw createClientAuthError(clientInfoDecodingError);
-        }
-    }
-    /**
-     * Function to build a client info object from cached homeAccountId string
-     * @param homeAccountId
+    /**
+     * Construct authoptions from the client and platform passed values
+     * @param authOptions
      */
-    function buildClientInfoFromHomeAccountId(homeAccountId) {
-        if (!homeAccountId) {
-            throw createClientAuthError(clientInfoDecodingError);
-        }
-        const clientInfoParts = homeAccountId.split(Separators.CLIENT_INFO_SEPARATOR, 2);
+    function buildAuthOptions(authOptions) {
         return {
-            uid: clientInfoParts[0],
-            utid: clientInfoParts.length < 2
-                ? Constants.EMPTY_STRING
-                : clientInfoParts[1],
+            clientCapabilities: [],
+            azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS,
+            skipAuthorityMetadataCache: false,
+            instanceAware: false,
+            encodeExtraQueryParams: false,
+            ...authOptions,
         };
+    }
+    /**
+     * Returns true if config has protocolMode set to ProtocolMode.OIDC, false otherwise
+     * @param ClientConfiguration
+     */
+    function isOidcProtocolMode(config) {
+        return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const CcsCredentialType = {
+        HOME_ACCOUNT_ID: "home_account_id",
+        UPN: "UPN",
+    };
+
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3994,7 +4273,7 @@
     const EAR_JWK = "ear_jwk";
     const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4374,22 +4653,7 @@
         });
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Authority types supported by MSAL.
-     */
-    const AuthorityType = {
-        Default: 0,
-        Adfs: 1,
-        Dsts: 2,
-        Ciam: 3,
-    };
-
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4401,7 +4665,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4411,7 +4675,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4421,7 +4685,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4517,7 +4781,7 @@
         };
     };
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4623,7 +4887,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4688,7 +4952,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4950,7 +5214,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5789,7 +6053,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5820,7 +6084,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5839,7 +6103,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5860,7 +6124,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5947,7 +6211,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5978,7 +6242,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6048,328 +6312,85 @@
                 response.status < 500 &&
                 response.status !== 429) {
                 // Telemetry data successfully logged by server, clear Telemetry cache
-                this.config.serverTelemetryManager.clearTelemetryCache();
-            }
-            return response;
-        }
-        /**
-         * Wraps sendPostRequestAsync with necessary preflight and postflight logic
-         * @param thumbprint - Request thumbprint for throttling
-         * @param tokenEndpoint - Endpoint to make the POST to
-         * @param options - Body and Headers to include on the POST request
-         * @param correlationId - CorrelationId for telemetry
-         */
-        async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
-            ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
-            let response;
-            try {
-                response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
-                const responseHeaders = response.headers || {};
-                this.performanceClient?.addFields({
-                    refreshTokenSize: response.body.refresh_token?.length || 0,
-                    httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
-                    requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
-                }, correlationId);
-            }
-            catch (e) {
-                if (e instanceof NetworkError) {
-                    const responseHeaders = e.responseHeaders;
-                    if (responseHeaders) {
-                        this.performanceClient?.addFields({
-                            httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
-                            requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
-                                "",
-                            contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
-                                undefined,
-                            contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
-                                undefined,
-                            httpStatus: e.httpStatus,
-                        }, correlationId);
-                    }
-                    throw e.error;
-                }
-                if (e instanceof AuthError) {
-                    throw e;
-                }
-                else {
-                    throw createClientAuthError(networkError);
-                }
-            }
-            ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
-            return response;
-        }
-        /**
-         * Updates the authority object of the client. Endpoint discovery must be completed.
-         * @param updatedAuthority
-         */
-        async updateAuthority(cloudInstanceHostname, correlationId) {
-            this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);
-            const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
-            const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
-            this.authority = cloudInstanceAuthority;
-        }
-        /**
-         * Creates query string for the /token request
-         * @param request
-         */
-        createTokenQueryParameters(request) {
-            const parameters = new Map();
-            if (request.embeddedClientId) {
-                addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
-            }
-            if (request.tokenQueryParameters) {
-                addExtraQueryParameters(parameters, request.tokenQueryParameters);
-            }
-            addCorrelationId(parameters, request.correlationId);
-            instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-            return mapToQueryString(parameters);
-        }
-    }
-
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
-     * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
-     * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
-     * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
-     * Downcased to match the realm case-insensitive comparison requirements
-     * @param idTokenClaims
-     * @returns
-     */
-    function getTenantIdFromIdTokenClaims(idTokenClaims) {
-        if (idTokenClaims) {
-            const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
-            return tenantId || null;
-        }
-        return null;
-    }
-
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Type that defines required and optional parameters for an Account field (based on universal cache schema implemented by all MSALs).
-     *
-     * Key : Value Schema
-     *
-     * Key: <home_account_id>-<environment>-<realm*>
-     *
-     * Value Schema:
-     * {
-     *      homeAccountId: home account identifier for the auth scheme,
-     *      environment: entity that issued the token, represented as a full host
-     *      realm: Full tenant or organizational identifier that the account belongs to
-     *      localAccountId: Original tenant-specific accountID, usually used for legacy cases
-     *      username: primary username that represents the user, usually corresponds to preferred_username in the v2 endpt
-     *      authorityType: Accounts authority type as a string
-     *      name: Full name for the account, including given name and family name,
-     *      lastModificationTime: last time this entity was modified in the cache
-     *      lastModificationApp:
-     *      nativeAccountId: Account identifier on the native device
-     *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
-     * }
-     * @internal
-     */
-    class AccountEntity {
-        /**
-         * Returns the AccountInfo interface for this account.
-         */
-        getAccountInfo() {
-            return {
-                homeAccountId: this.homeAccountId,
-                environment: this.environment,
-                tenantId: this.realm,
-                username: this.username,
-                localAccountId: this.localAccountId,
-                loginHint: this.loginHint,
-                name: this.name,
-                nativeAccountId: this.nativeAccountId,
-                authorityType: this.authorityType,
-                // Deserialize tenant profiles array into a Map
-                tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
-                    return [tenantProfile.tenantId, tenantProfile];
-                })),
-                dataBoundary: this.dataBoundary,
-            };
-        }
-        /**
-         * Returns true if the account entity is in single tenant format (outdated), false otherwise
-         */
-        isSingleTenant() {
-            return !this.tenantProfiles;
-        }
-        /**
-         * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
-         * @param accountDetails
-         */
-        static createAccount(accountDetails, authority, base64Decode) {
-            const account = new AccountEntity();
-            if (authority.authorityType === AuthorityType.Adfs) {
-                account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
-            }
-            else if (authority.protocolMode === ProtocolMode.OIDC) {
-                account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
-            }
-            else {
-                account.authorityType = CacheAccountType.MSSTS_ACCOUNT_TYPE;
-            }
-            let clientInfo;
-            if (accountDetails.clientInfo && base64Decode) {
-                clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
-                if (clientInfo.xms_tdbr) {
-                    account.dataBoundary =
-                        clientInfo.xms_tdbr === "EU" ? "EU" : "None";
-                }
-            }
-            account.clientInfo = accountDetails.clientInfo;
-            account.homeAccountId = accountDetails.homeAccountId;
-            account.nativeAccountId = accountDetails.nativeAccountId;
-            const env = accountDetails.environment ||
-                (authority && authority.getPreferredCache());
-            if (!env) {
-                throw createClientAuthError(invalidCacheEnvironment);
-            }
-            account.environment = env;
-            // non AAD scenarios can have empty realm
-            account.realm =
-                clientInfo?.utid ||
-                    getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
-                    "";
-            // How do you account for MSA CID here?
-            account.localAccountId =
-                clientInfo?.uid ||
-                    accountDetails.idTokenClaims?.oid ||
-                    accountDetails.idTokenClaims?.sub ||
-                    "";
-            /*
-             * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
-             * In most cases it will contain a single email. This field should not be relied upon if a custom
-             * policy is configured to return more than 1 email.
-             */
-            const preferredUsername = accountDetails.idTokenClaims?.preferred_username ||
-                accountDetails.idTokenClaims?.upn;
-            const email = accountDetails.idTokenClaims?.emails
-                ? accountDetails.idTokenClaims.emails[0]
-                : null;
-            account.username = preferredUsername || email || "";
-            account.loginHint = accountDetails.idTokenClaims?.login_hint;
-            account.name = accountDetails.idTokenClaims?.name || "";
-            account.cloudGraphHostName = accountDetails.cloudGraphHostName;
-            account.msGraphHost = accountDetails.msGraphHost;
-            if (accountDetails.tenantProfiles) {
-                account.tenantProfiles = accountDetails.tenantProfiles;
-            }
-            else {
-                const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, account.localAccountId, account.realm, accountDetails.idTokenClaims);
-                account.tenantProfiles = [tenantProfile];
+                this.config.serverTelemetryManager.clearTelemetryCache();
             }
-            return account;
-        }
-        /**
-         * Creates an AccountEntity object from AccountInfo
-         * @param accountInfo
-         * @param cloudGraphHostName
-         * @param msGraphHost
-         * @returns
-         */
-        static createFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
-            const account = new AccountEntity();
-            account.authorityType =
-                accountInfo.authorityType || CacheAccountType.GENERIC_ACCOUNT_TYPE;
-            account.homeAccountId = accountInfo.homeAccountId;
-            account.localAccountId = accountInfo.localAccountId;
-            account.nativeAccountId = accountInfo.nativeAccountId;
-            account.realm = accountInfo.tenantId;
-            account.environment = accountInfo.environment;
-            account.username = accountInfo.username;
-            account.name = accountInfo.name;
-            account.loginHint = accountInfo.loginHint;
-            account.cloudGraphHostName = cloudGraphHostName;
-            account.msGraphHost = msGraphHost;
-            // Serialize tenant profiles map into an array
-            account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
-            account.dataBoundary = accountInfo.dataBoundary;
-            return account;
+            return response;
         }
         /**
-         * Generate HomeAccountId from server response
-         * @param serverClientInfo
-         * @param authType
+         * Wraps sendPostRequestAsync with necessary preflight and postflight logic
+         * @param thumbprint - Request thumbprint for throttling
+         * @param tokenEndpoint - Endpoint to make the POST to
+         * @param options - Body and Headers to include on the POST request
+         * @param correlationId - CorrelationId for telemetry
          */
-        static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
-            // since ADFS/DSTS do not have tid and does not set client_info
-            if (!(authType === AuthorityType.Adfs ||
-                authType === AuthorityType.Dsts)) {
-                // for cases where there is clientInfo
-                if (serverClientInfo) {
-                    try {
-                        const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
-                        if (clientInfo.uid && clientInfo.utid) {
-                            return `${clientInfo.uid}.${clientInfo.utid}`;
-                        }
+        async sendPostRequest(thumbprint, tokenEndpoint, options, correlationId) {
+            ThrottlingUtils.preProcess(this.cacheManager, thumbprint, correlationId);
+            let response;
+            try {
+                response = await invokeAsync((this.networkClient.sendPostRequestAsync.bind(this.networkClient)), PerformanceEvents.NetworkClientSendPostRequestAsync, this.logger, this.performanceClient, correlationId)(tokenEndpoint, options);
+                const responseHeaders = response.headers || {};
+                this.performanceClient?.addFields({
+                    refreshTokenSize: response.body.refresh_token?.length || 0,
+                    httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                    requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
+                }, correlationId);
+            }
+            catch (e) {
+                if (e instanceof NetworkError) {
+                    const responseHeaders = e.responseHeaders;
+                    if (responseHeaders) {
+                        this.performanceClient?.addFields({
+                            httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
+                            requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] ||
+                                "",
+                            contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
+                                undefined,
+                            contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
+                                undefined,
+                            httpStatus: e.httpStatus,
+                        }, correlationId);
                     }
-                    catch (e) { }
+                    throw e.error;
+                }
+                if (e instanceof AuthError) {
+                    throw e;
+                }
+                else {
+                    throw createClientAuthError(networkError);
                 }
-                logger.warning("No client info in response");
             }
-            // default to "sub" claim
-            return idTokenClaims?.sub || "";
+            ThrottlingUtils.postProcess(this.cacheManager, thumbprint, response, correlationId);
+            return response;
         }
         /**
-         * Validates an entity: checks for all expected params
-         * @param entity
+         * Updates the authority object of the client. Endpoint discovery must be completed.
+         * @param updatedAuthority
          */
-        static isAccountEntity(entity) {
-            if (!entity) {
-                return false;
-            }
-            return (entity.hasOwnProperty("homeAccountId") &&
-                entity.hasOwnProperty("environment") &&
-                entity.hasOwnProperty("realm") &&
-                entity.hasOwnProperty("localAccountId") &&
-                entity.hasOwnProperty("username") &&
-                entity.hasOwnProperty("authorityType"));
+        async updateAuthority(cloudInstanceHostname, correlationId) {
+            this.performanceClient?.addQueueMeasurement(PerformanceEvents.UpdateTokenEndpointAuthority, correlationId);
+            const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${this.authority.tenant}/`;
+            const cloudInstanceAuthority = await createDiscoveredInstance(cloudInstanceAuthorityUri, this.networkClient, this.cacheManager, this.authority.options, this.logger, correlationId, this.performanceClient);
+            this.authority = cloudInstanceAuthority;
         }
         /**
-         * Helper function to determine whether 2 accountInfo objects represent the same account
-         * @param accountA
-         * @param accountB
-         * @param compareClaims - If set to true idTokenClaims will also be compared to determine account equality
+         * Creates query string for the /token request
+         * @param request
          */
-        static accountInfoIsEqual(accountA, accountB, compareClaims) {
-            if (!accountA || !accountB) {
-                return false;
+        createTokenQueryParameters(request) {
+            const parameters = new Map();
+            if (request.embeddedClientId) {
+                addBrokerParameters(parameters, this.config.authOptions.clientId, this.config.authOptions.redirectUri);
             }
-            let claimsMatch = true; // default to true so as to not fail comparison below if compareClaims: false
-            if (compareClaims) {
-                const accountAClaims = (accountA.idTokenClaims ||
-                    {});
-                const accountBClaims = (accountB.idTokenClaims ||
-                    {});
-                // issued at timestamp and nonce are expected to change each time a new id token is acquired
-                claimsMatch =
-                    accountAClaims.iat === accountBClaims.iat &&
-                        accountAClaims.nonce === accountBClaims.nonce;
+            if (request.tokenQueryParameters) {
+                addExtraQueryParameters(parameters, request.tokenQueryParameters);
             }
-            return (accountA.homeAccountId === accountB.homeAccountId &&
-                accountA.localAccountId === accountB.localAccountId &&
-                accountA.username === accountB.username &&
-                accountA.tenantId === accountB.tenantId &&
-                accountA.loginHint === accountB.loginHint &&
-                accountA.environment === accountB.environment &&
-                accountA.nativeAccountId === accountB.nativeAccountId &&
-                claimsMatch);
+            addCorrelationId(parameters, request.correlationId);
+            instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
+            return mapToQueryString(parameters);
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6397,7 +6418,7 @@
         uxNotAllowed: uxNotAllowed
     });
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6487,7 +6508,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6559,7 +6580,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6641,7 +6662,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6668,7 +6689,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6780,14 +6801,14 @@
                 if (handlingRefreshTokenResponse &&
                     !forceCacheRefreshTokenResponse &&
                     cacheRecord.account) {
-                    const key = this.cacheStorage.generateAccountKey(cacheRecord.account.getAccountInfo());
+                    const key = this.cacheStorage.generateAccountKey(AccountEntity.getAccountInfo(cacheRecord.account));
                     const account = this.cacheStorage.getAccount(key, request.correlationId);
                     if (!account) {
                         this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
                         return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                     }
                 }
-                await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, request.storeInCache);
+                await this.cacheStorage.saveCacheRecord(cacheRecord, request.correlationId, isKmsi(idTokenClaims || {}), request.storeInCache);
             }
             finally {
                 if (this.persistencePlugin &&
@@ -6934,7 +6955,7 @@
                     serverTokenResponse?.spa_accountid;
             }
             const accountInfo = cacheRecord.account
-                ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
+                ? updateAccountTenantProfileData(AccountEntity.getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
                 idTokenClaims, cacheRecord.idToken?.secret)
                 : null;
             return {
@@ -6999,7 +7020,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7017,7 +7038,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7252,7 +7273,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7461,7 +7482,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7559,7 +7580,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7574,7 +7595,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7798,7 +7819,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7856,7 +7877,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8119,7 +8140,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8127,7 +8148,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8152,7 +8173,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8192,7 +8213,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.13.0 2025-10-17 */
+    /*! @azure/msal-common v15.13.1 2025-11-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10308,7 +10329,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.25.1";
+    const version = "4.26.1";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10316,9 +10337,9 @@
      */
     const PREFIX = "msal";
     const BROWSER_PREFIX = "browser";
-    const CACHE_KEY_SEPARATOR = "-";
-    const CREDENTIAL_SCHEMA_VERSION = 1;
-    const ACCOUNT_SCHEMA_VERSION = 1;
+    const CACHE_KEY_SEPARATOR = "|";
+    const CREDENTIAL_SCHEMA_VERSION = 2;
+    const ACCOUNT_SCHEMA_VERSION = 2;
     const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
     const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
     const BROWSER_PERF_ENABLED_KEY = `${PREFIX}.${BROWSER_PREFIX}.performance.enabled`;
@@ -11478,7 +11499,10 @@
                 return null;
             }
             try {
-                return JSON.parse(decryptedData);
+                return {
+                    ...JSON.parse(decryptedData),
+                    lastUpdatedAt: data.lastUpdatedAt,
+                };
             }
             catch (e) {
                 this.performanceClient.incrementFields({ encryptedCacheCorruptionCount: 1 }, correlationId);
@@ -11488,19 +11512,24 @@
         setItem(key, value) {
             window.localStorage.setItem(key, value);
         }
-        async setUserData(key, value, correlationId, timestamp) {
+        async setUserData(key, value, correlationId, timestamp, kmsi) {
             if (!this.initialized || !this.encryptionCookie) {
                 throw createBrowserAuthError(uninitializedPublicClientApplication);
             }
-            const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
-            const encryptedData = {
-                id: this.encryptionCookie.id,
-                nonce: nonce,
-                data: data,
-                lastUpdatedAt: timestamp,
-            };
+            if (kmsi) {
+                this.setItem(key, value);
+            }
+            else {
+                const { data, nonce } = await invokeAsync(encrypt, PerformanceEvents.Encrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, value, this.getContext(key));
+                const encryptedData = {
+                    id: this.encryptionCookie.id,
+                    nonce: nonce,
+                    data: data,
+                    lastUpdatedAt: timestamp,
+                };
+                this.setItem(key, JSON.stringify(encryptedData));
+            }
             this.memoryStorage.setItem(key, value);
-            this.setItem(key, JSON.stringify(encryptedData));
             // Notify other frames to update their in-memory cache
             this.broadcast.postMessage({
                 key: key,
@@ -11600,13 +11629,14 @@
             if (!isEncrypted(encObj)) {
                 // Data is not encrypted
                 this.performanceClient.incrementFields({ unencryptedCacheCount: 1 }, correlationId);
-                return encObj;
+                return rawCache;
             }
             if (encObj.id !== this.encryptionCookie.id) {
                 // Data was encrypted with a different key. It must be removed because it is from a previous session.
                 this.performanceClient.incrementFields({ encryptedCacheExpiredCount: 1 }, correlationId);
                 return null;
             }
+            this.performanceClient.incrementFields({ encryptedCacheCount: 1 }, correlationId);
             return invokeAsync(decrypt, PerformanceEvents.Decrypt, this.logger, this.performanceClient, correlationId)(this.encryptionCookie.key, encObj.nonce, this.getContext(key), encObj.data);
         }
         /**
@@ -11798,108 +11828,338 @@
          * Migrates any existing cache data from previous versions of MSAL.js into the current cache structure.
          */
         async migrateExistingCache(correlationId) {
-            const accountKeys0 = getAccountKeys(this.browserStorage, 0);
-            const tokenKeys0 = getTokenKeys(this.clientId, this.browserStorage, 0);
+            let accountKeys = getAccountKeys(this.browserStorage);
+            let tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
             this.performanceClient.addFields({
-                oldAccountCount: accountKeys0.length,
-                oldAccessCount: tokenKeys0.accessToken.length,
-                oldIdCount: tokenKeys0.idToken.length,
-                oldRefreshCount: tokenKeys0.refreshToken.length,
+                preMigrateAcntCount: accountKeys.length,
+                preMigrateATCount: tokenKeys.accessToken.length,
+                preMigrateITCount: tokenKeys.idToken.length,
+                preMigrateRTCount: tokenKeys.refreshToken.length,
             }, correlationId);
-            const accountKeys1 = getAccountKeys(this.browserStorage, 1);
-            const tokenKeys1 = getTokenKeys(this.clientId, this.browserStorage, 1);
+            for (let i = 0; i < ACCOUNT_SCHEMA_VERSION; i++) {
+                const credentialSchema = i; // For now account and credential schemas are the same, but may diverge in future
+                await this.removeStaleAccounts(i, credentialSchema, correlationId);
+            }
+            // Must migrate idTokens first to ensure we have KMSI info for the rest
+            for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+                const accountSchema = i; // For now account and credential schemas are the same, but may diverge in future
+                await this.migrateIdTokens(i, accountSchema, correlationId);
+            }
+            const kmsiMap = this.getKMSIValues();
+            for (let i = 0; i < CREDENTIAL_SCHEMA_VERSION; i++) {
+                await this.migrateAccessTokens(i, kmsiMap, correlationId);
+                await this.migrateRefreshTokens(i, kmsiMap, correlationId);
+            }
+            accountKeys = getAccountKeys(this.browserStorage);
+            tokenKeys = getTokenKeys(this.clientId, this.browserStorage);
             this.performanceClient.addFields({
-                currAccountCount: accountKeys1.length,
-                currAccessCount: tokenKeys1.accessToken.length,
-                currIdCount: tokenKeys1.idToken.length,
-                currRefreshCount: tokenKeys1.refreshToken.length,
+                postMigrateAcntCount: accountKeys.length,
+                postMigrateATCount: tokenKeys.accessToken.length,
+                postMigrateITCount: tokenKeys.idToken.length,
+                postMigrateRTCount: tokenKeys.refreshToken.length,
             }, correlationId);
-            await Promise.all([
-                this.updateV0ToCurrent(ACCOUNT_SCHEMA_VERSION, accountKeys0, accountKeys1, correlationId),
-                this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.idToken, tokenKeys1.idToken, correlationId),
-                this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.accessToken, tokenKeys1.accessToken, correlationId),
-                this.updateV0ToCurrent(CREDENTIAL_SCHEMA_VERSION, tokenKeys0.refreshToken, tokenKeys1.refreshToken, correlationId),
-            ]);
-            if (accountKeys0.length > 0) {
-                this.browserStorage.setItem(getAccountKeysCacheKey(0), JSON.stringify(accountKeys0));
+        }
+        /**
+         * Parses entry, adds lastUpdatedAt if it doesn't exist, removes entry if expired or invalid
+         * @param key
+         * @param correlationId
+         * @returns
+         */
+        async updateOldEntry(key, correlationId) {
+            const rawValue = this.browserStorage.getItem(key);
+            const parsedValue = this.validateAndParseJson(rawValue || "");
+            if (!parsedValue) {
+                this.browserStorage.removeItem(key);
+                return null;
             }
-            else {
-                this.browserStorage.removeItem(getAccountKeysCacheKey(0));
+            if (!parsedValue.lastUpdatedAt) {
+                // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
+                parsedValue.lastUpdatedAt = Date.now().toString();
+                this.setItem(key, JSON.stringify(parsedValue), correlationId);
             }
-            if (accountKeys1.length > 0) {
-                this.browserStorage.setItem(getAccountKeysCacheKey(1), JSON.stringify(accountKeys1));
+            else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+                this.browserStorage.removeItem(key);
+                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+                return null;
             }
-            else {
-                this.browserStorage.removeItem(getAccountKeysCacheKey(1));
-            }
-            this.setTokenKeys(tokenKeys0, correlationId, 0);
-            this.setTokenKeys(tokenKeys1, correlationId, 1);
-        }
-        async updateV0ToCurrent(currentSchema, v0Keys, v1Keys, correlationId) {
-            const upgradePromises = [];
-            for (const v0Key of [...v0Keys]) {
-                const rawV0Value = this.browserStorage.getItem(v0Key);
-                const parsedV0Value = this.validateAndParseJson(rawV0Value || "");
-                if (!parsedV0Value) {
-                    removeElementFromArray(v0Keys, v0Key);
+            const decryptedData = isEncrypted(parsedValue)
+                ? await this.browserStorage.decryptData(key, parsedValue, correlationId)
+                : parsedValue;
+            if (!decryptedData || !isCredentialEntity(decryptedData)) {
+                this.performanceClient.incrementFields({ invalidCacheCount: 1 }, correlationId);
+                return null;
+            }
+            if ((isAccessTokenEntity(decryptedData) ||
+                isRefreshTokenEntity(decryptedData)) &&
+                decryptedData.expiresOn &&
+                isTokenExpired(decryptedData.expiresOn, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC)) {
+                this.browserStorage.removeItem(key);
+                this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+                return null;
+            }
+            return decryptedData;
+        }
+        /**
+         * Remove accounts from the cache for older schema versions if they have not been updated in the last cacheRetentionDays
+         * @param accountSchema
+         * @param credentialSchema
+         * @param correlationId
+         * @returns
+         */
+        async removeStaleAccounts(accountSchema, credentialSchema, correlationId) {
+            const accountKeysToCheck = getAccountKeys(this.browserStorage, accountSchema);
+            if (accountKeysToCheck.length === 0) {
+                return;
+            }
+            for (const accountKey of [...accountKeysToCheck]) {
+                this.performanceClient.incrementFields({ oldAcntCount: 1 }, correlationId);
+                const rawValue = this.browserStorage.getItem(accountKey);
+                const parsedValue = this.validateAndParseJson(rawValue || "");
+                if (!parsedValue) {
+                    removeElementFromArray(accountKeysToCheck, accountKey);
+                    continue;
+                }
+                if (!parsedValue.lastUpdatedAt) {
+                    // Add lastUpdatedAt to the existing entry if it doesnt exist so we know when it's safe to remove it
+                    parsedValue.lastUpdatedAt = Date.now().toString();
+                    this.setItem(accountKey, JSON.stringify(parsedValue), correlationId);
+                    continue;
+                }
+                else if (isCacheExpired(parsedValue.lastUpdatedAt, this.cacheConfig.cacheRetentionDays)) {
+                    // Cache expired remove account and associated tokens
+                    await this.removeAccountOldSchema(accountKey, parsedValue, credentialSchema, correlationId);
+                    removeElementFromArray(accountKeysToCheck, accountKey);
+                }
+            }
+            this.setAccountKeys(accountKeysToCheck, correlationId, accountSchema);
+        }
+        /**
+         * Remove the given account and all associated tokens from the cache
+         * @param accountKey
+         * @param rawObject
+         * @param credentialSchema
+         * @param correlationId
+         */
+        async removeAccountOldSchema(accountKey, rawObject, credentialSchema, correlationId) {
+            const decryptedData = isEncrypted(rawObject)
+                ? (await this.browserStorage.decryptData(accountKey, rawObject, correlationId))
+                : rawObject;
+            const homeAccountId = decryptedData?.homeAccountId;
+            if (homeAccountId) {
+                const tokenKeys = this.getTokenKeys(credentialSchema);
+                [...tokenKeys.idToken]
+                    .filter((key) => key.includes(homeAccountId))
+                    .forEach((key) => {
+                    this.browserStorage.removeItem(key);
+                    removeElementFromArray(tokenKeys.idToken, key);
+                });
+                [...tokenKeys.accessToken]
+                    .filter((key) => key.includes(homeAccountId))
+                    .forEach((key) => {
+                    this.browserStorage.removeItem(key);
+                    removeElementFromArray(tokenKeys.accessToken, key);
+                });
+                [...tokenKeys.refreshToken]
+                    .filter((key) => key.includes(homeAccountId))
+                    .forEach((key) => {
+                    this.browserStorage.removeItem(key);
+                    removeElementFromArray(tokenKeys.refreshToken, key);
+                });
+                this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
+            }
+            this.performanceClient.incrementFields({ expiredAcntRemovedCount: 1 }, correlationId);
+            this.browserStorage.removeItem(accountKey);
+        }
+        /**
+         * Gets key value pair mapping homeAccountId to KMSI value
+         * @returns
+         */
+        getKMSIValues() {
+            const kmsiMap = {};
+            const tokenKeys = this.getTokenKeys().idToken;
+            for (const key of tokenKeys) {
+                const rawValue = this.browserStorage.getUserData(key);
+                if (rawValue) {
+                    const idToken = JSON.parse(rawValue);
+                    const claims = extractTokenClaims(idToken.secret, base64Decode);
+                    if (claims) {
+                        kmsiMap[idToken.homeAccountId] = isKmsi(claims);
+                    }
+                }
+            }
+            return kmsiMap;
+        }
+        /**
+         * Migrates id tokens from the old schema to the new schema, also migrates associated account object if it doesn't already exist in the new schema
+         * @param credentialSchema
+         * @param accountSchema
+         * @param correlationId
+         * @returns
+         */
+        async migrateIdTokens(credentialSchema, accountSchema, correlationId) {
+            const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+            if (credentialKeysToMigrate.idToken.length === 0) {
+                return;
+            }
+            const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+            const currentAccountKeys = getAccountKeys(this.browserStorage);
+            const previousAccountKeys = getAccountKeys(this.browserStorage, accountSchema);
+            for (const idTokenKey of [...credentialKeysToMigrate.idToken]) {
+                this.performanceClient.incrementFields({ oldITCount: 1 }, correlationId);
+                const oldSchemaData = (await this.updateOldEntry(idTokenKey, correlationId));
+                if (!oldSchemaData) {
+                    removeElementFromArray(credentialKeysToMigrate.idToken, idTokenKey);
+                    continue;
+                }
+                const currentAccountKey = currentAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+                const previousAccountKey = previousAccountKeys.find((key) => key.includes(oldSchemaData.homeAccountId));
+                let account = null;
+                if (currentAccountKey) {
+                    account = this.getAccount(currentAccountKey, correlationId);
+                }
+                else if (previousAccountKey) {
+                    const rawValue = this.browserStorage.getItem(previousAccountKey);
+                    const parsedValue = this.validateAndParseJson(rawValue || "");
+                    account =
+                        parsedValue && isEncrypted(parsedValue)
+                            ? (await this.browserStorage.decryptData(previousAccountKey, parsedValue, correlationId))
+                            : parsedValue;
+                }
+                if (!account) {
+                    // Don't migrate idToken if we don't have an account for it
+                    this.performanceClient.incrementFields({ skipITMigrateCount: 1 }, correlationId);
                     continue;
                 }
-                if (!parsedV0Value.lastUpdatedAt) {
-                    // Add lastUpdatedAt to the existing v0 entry if it doesnt exist so we know when it's safe to remove it
-                    parsedV0Value.lastUpdatedAt = Date.now().toString();
-                    this.setItem(v0Key, JSON.stringify(parsedV0Value), correlationId);
-                }
-                const decryptedData = isEncrypted(parsedV0Value)
-                    ? await this.browserStorage.decryptData(v0Key, parsedV0Value, correlationId)
-                    : parsedV0Value;
-                let expirationTime;
-                if (decryptedData) {
-                    if (isAccessTokenEntity(decryptedData)) {
-                        expirationTime = decryptedData.expiresOn;
+                const claims = extractTokenClaims(oldSchemaData.secret, base64Decode);
+                const newIdTokenKey = this.generateCredentialKey(oldSchemaData);
+                const currentIdToken = this.getIdTokenCredential(newIdTokenKey, correlationId);
+                const oldTokenHasSignInState = Object.keys(claims).includes("signin_state");
+                const currentTokenHasSignInState = currentIdToken &&
+                    Object.keys(extractTokenClaims(currentIdToken.secret, base64Decode) || {}).includes("signin_state");
+                /**
+                 * Only migrate if:
+                 * 1. Token doesn't yet exist in current schema
+                 * 2. Old schema token has been updated more recently than the current one AND migrating it won't result in loss of KMSI state
+                 */
+                if (!currentIdToken ||
+                    (oldSchemaData.lastUpdatedAt > currentIdToken.lastUpdatedAt &&
+                        (oldTokenHasSignInState || !currentTokenHasSignInState))) {
+                    const tenantProfiles = account.tenantProfiles || [];
+                    const tenantId = getTenantIdFromIdTokenClaims(claims) || account.realm;
+                    if (tenantId &&
+                        !tenantProfiles.find((tenantProfile) => {
+                            return tenantProfile.tenantId === tenantId;
+                        })) {
+                        const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, claims);
+                        tenantProfiles.push(newTenantProfile);
                     }
-                    else if (isRefreshTokenEntity(decryptedData)) {
-                        expirationTime = decryptedData.expiresOn;
+                    account.tenantProfiles = tenantProfiles;
+                    const newAccountKey = this.generateAccountKey(AccountEntity.getAccountInfo(account));
+                    const kmsi = isKmsi(claims);
+                    await this.setUserData(newAccountKey, JSON.stringify(account), correlationId, account.lastUpdatedAt, kmsi);
+                    if (!currentAccountKeys.includes(newAccountKey)) {
+                        currentAccountKeys.push(newAccountKey);
                     }
+                    await this.setUserData(newIdTokenKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedITCount: 1 }, correlationId);
+                    currentCredentialKeys.idToken.push(newIdTokenKey);
+                }
+            }
+            this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+            this.setTokenKeys(currentCredentialKeys, correlationId);
+            this.setAccountKeys(currentAccountKeys, correlationId);
+        }
+        /**
+         * Migrates access tokens from old cache schema to current schema
+         * @param credentialSchema
+         * @param kmsiMap
+         * @param correlationId
+         * @returns
+         */
+        async migrateAccessTokens(credentialSchema, kmsiMap, correlationId) {
+            const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+            if (credentialKeysToMigrate.accessToken.length === 0) {
+                return;
+            }
+            const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+            for (const accessTokenKey of [...credentialKeysToMigrate.accessToken]) {
+                this.performanceClient.incrementFields({ oldATCount: 1 }, correlationId);
+                const oldSchemaData = (await this.updateOldEntry(accessTokenKey, correlationId));
+                if (!oldSchemaData) {
+                    removeElementFromArray(credentialKeysToMigrate.accessToken, accessTokenKey);
+                    continue;
                 }
-                if (!decryptedData ||
-                    isCacheExpired(parsedV0Value.lastUpdatedAt, this.cacheConfig.cacheRetentionDays) ||
-                    (expirationTime &&
-                        isTokenExpired(expirationTime, DEFAULT_TOKEN_RENEWAL_OFFSET_SEC))) {
-                    this.browserStorage.removeItem(v0Key);
-                    removeElementFromArray(v0Keys, v0Key);
-                    this.performanceClient.incrementFields({ expiredCacheRemovedCount: 1 }, correlationId);
+                if (!Object.keys(kmsiMap).includes(oldSchemaData.homeAccountId)) {
+                    // Don't migrate tokens if we don't have an idToken for them
+                    this.performanceClient.incrementFields({ skipATMigrateCount: 1 }, correlationId);
                     continue;
                 }
-                if (this.cacheConfig.cacheLocation !==
-                    BrowserCacheLocation.LocalStorage ||
-                    isEncrypted(parsedV0Value)) {
-                    const v1Key = `${PREFIX}.${currentSchema}${CACHE_KEY_SEPARATOR}${v0Key}`;
-                    const rawV1Entry = this.browserStorage.getItem(v1Key);
-                    if (!rawV1Entry) {
-                        upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                            v1Keys.push(v1Key);
-                            this.performanceClient.incrementFields({ upgradedCacheCount: 1 }, correlationId);
-                        }));
-                        continue;
+                const newKey = this.generateCredentialKey(oldSchemaData);
+                const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+                if (!currentCredentialKeys.accessToken.includes(newKey)) {
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
+                    currentCredentialKeys.accessToken.push(newKey);
+                }
+                else {
+                    const currentToken = this.getAccessTokenCredential(newKey, correlationId);
+                    if (!currentToken ||
+                        oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                        // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                        await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                        this.performanceClient.incrementFields({ migratedATCount: 1 }, correlationId);
                     }
-                    else {
-                        const parsedV1Entry = this.validateAndParseJson(rawV1Entry);
-                        // If the entry already exists but is older than the v0 entry, replace it
-                        if (Number(parsedV0Value.lastUpdatedAt) >
-                            Number(parsedV1Entry.lastUpdatedAt)) {
-                            upgradePromises.push(this.setUserData(v1Key, JSON.stringify(decryptedData), correlationId, parsedV0Value.lastUpdatedAt).then(() => {
-                                this.performanceClient.incrementFields({ updatedCacheFromV0Count: 1 }, correlationId);
-                            }));
-                            continue;
-                        }
+                }
+            }
+            this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+            this.setTokenKeys(currentCredentialKeys, correlationId);
+        }
+        /**
+         * Migrates refresh tokens from old cache schema to current schema
+         * @param credentialSchema
+         * @param kmsiMap
+         * @param correlationId
+         * @returns
+         */
+        async migrateRefreshTokens(credentialSchema, kmsiMap, correlationId) {
+            const credentialKeysToMigrate = getTokenKeys(this.clientId, this.browserStorage, credentialSchema);
+            if (credentialKeysToMigrate.refreshToken.length === 0) {
+                return;
+            }
+            const currentCredentialKeys = getTokenKeys(this.clientId, this.browserStorage, CREDENTIAL_SCHEMA_VERSION);
+            for (const refreshTokenKey of [
+                ...credentialKeysToMigrate.refreshToken,
+            ]) {
+                this.performanceClient.incrementFields({ oldRTCount: 1 }, correlationId);
+                const oldSchemaData = (await this.updateOldEntry(refreshTokenKey, correlationId));
+                if (!oldSchemaData) {
+                    removeElementFromArray(credentialKeysToMigrate.refreshToken, refreshTokenKey);
+                    continue;
+                }
+                if (!Object.keys(kmsiMap).includes(oldSchemaData.homeAccountId)) {
+                    // Don't migrate tokens if we don't have an idToken for them
+                    this.performanceClient.incrementFields({ skipRTMigrateCount: 1 }, correlationId);
+                    continue;
+                }
+                const newKey = this.generateCredentialKey(oldSchemaData);
+                const kmsi = kmsiMap[oldSchemaData.homeAccountId];
+                if (!currentCredentialKeys.refreshToken.includes(newKey)) {
+                    await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                    this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
+                    currentCredentialKeys.refreshToken.push(newKey);
+                }
+                else {
+                    const currentToken = this.getRefreshTokenCredential(newKey, correlationId);
+                    if (!currentToken ||
+                        oldSchemaData.lastUpdatedAt > currentToken.lastUpdatedAt) {
+                        // If the token already exists, only overwrite it if the old token has a more recent lastUpdatedAt
+                        await this.setUserData(newKey, JSON.stringify(oldSchemaData), correlationId, oldSchemaData.lastUpdatedAt, kmsi);
+                        this.performanceClient.incrementFields({ migratedRTCount: 1 }, correlationId);
                     }
                 }
-                /*
-                 * Note: If we reach here for unencrypted localStorage data, we continue without migrating
-                 * as we can't migrate unencrypted localStorage data right now since we can't guarantee KMSI=no
-                 */
             }
-            return Promise.all(upgradePromises);
+            this.setTokenKeys(credentialKeysToMigrate, correlationId, credentialSchema);
+            this.setTokenKeys(currentCredentialKeys, correlationId);
         }
         /**
          * Tracks upgrades and downgrades for telemetry and debugging purposes
@@ -11944,20 +12204,31 @@
          * @param value
          */
         setItem(key, value, correlationId) {
-            let tokenKeysV0Count = 0;
-            let accessTokenKeys = [];
+            const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+            const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
             const maxRetries = 20;
             for (let i = 0; i <= maxRetries; i++) {
+                // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
                 try {
                     this.browserStorage.setItem(key, value);
                     if (i > 0) {
-                        // Finally update the token keys array with the tokens removed
-                        if (i <= tokenKeysV0Count) {
-                            this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                        }
-                        else {
-                            this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                            this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                        // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                        for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                            // Get the sum of all previous token counts to use as start index for this schema version
+                            const startIndex = tokenKeysCount
+                                .slice(0, schemaVersion)
+                                .reduce((sum, count) => sum + count, 0);
+                            if (startIndex >= i) {
+                                // Done removing tokens
+                                break;
+                            }
+                            const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                                ? startIndex + tokenKeysCount[schemaVersion]
+                                : i;
+                            if (i > startIndex &&
+                                tokenKeysCount[schemaVersion] > 0) {
+                                this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                            }
                         }
                     }
                     break; // If setItem succeeds, exit the loop
@@ -11969,16 +12240,19 @@
                         i < maxRetries) {
                         if (!accessTokenKeys.length) {
                             // If we are currently trying to set the token keys, use the value we're trying to set
-                            const tokenKeys0 = key ===
-                                getTokenKeysCacheKey(this.clientId, 0)
-                                ? JSON.parse(value).accessToken
-                                : this.getTokenKeys(0).accessToken;
-                            const tokenKeys1 = key ===
-                                getTokenKeysCacheKey(this.clientId)
-                                ? JSON.parse(value).accessToken
-                                : this.getTokenKeys().accessToken;
-                            accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                            tokenKeysV0Count = tokenKeys0.length;
+                            for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                                if (key ===
+                                    getTokenKeysCacheKey(this.clientId, i)) {
+                                    const tokenKeys = JSON.parse(value).accessToken;
+                                    accessTokenKeys.push(...tokenKeys);
+                                    tokenKeysCount[i] = tokenKeys.length;
+                                }
+                                else {
+                                    const tokenKeys = this.getTokenKeys(i).accessToken;
+                                    accessTokenKeys.push(...tokenKeys);
+                                    tokenKeysCount[i] = tokenKeys.length;
+                                }
+                            }
                         }
                         if (accessTokenKeys.length <= i) {
                             // Nothing to remove, rethrow the error
@@ -12001,21 +12275,32 @@
          * @param value
          * @param correlationId
          */
-        async setUserData(key, value, correlationId, timestamp) {
-            let tokenKeysV0Count = 0;
-            let accessTokenKeys = [];
+        async setUserData(key, value, correlationId, timestamp, kmsi) {
+            const tokenKeysCount = new Array(CREDENTIAL_SCHEMA_VERSION + 1).fill(0); // Array mapping schema version to number of token keys stored for that version
+            const accessTokenKeys = []; // Flat map of all access token keys stored, ordered by schema version
             const maxRetries = 20;
             for (let i = 0; i <= maxRetries; i++) {
                 try {
-                    await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp);
+                    // Attempt to store item in cache, if cache is full this call will throw and we'll attempt to clear space by removing access tokens from the cache one by one, starting with tokens stored by previous versions of MSAL.js
+                    await invokeAsync(this.browserStorage.setUserData.bind(this.browserStorage), PerformanceEvents.SetUserData, this.logger, this.performanceClient)(key, value, correlationId, timestamp, kmsi);
                     if (i > 0) {
-                        // Finally update the token keys array with the tokens removed
-                        if (i <= tokenKeysV0Count) {
-                            this.removeAccessTokenKeys(accessTokenKeys.slice(0, i), correlationId, 0);
-                        }
-                        else {
-                            this.removeAccessTokenKeys(accessTokenKeys.slice(0, tokenKeysV0Count), correlationId, 0);
-                            this.removeAccessTokenKeys(accessTokenKeys.slice(tokenKeysV0Count, i), correlationId);
+                        // If any tokens were removed in order to store this item update the token keys array with the tokens removed
+                        for (let schemaVersion = 0; schemaVersion <= CREDENTIAL_SCHEMA_VERSION; schemaVersion++) {
+                            // Get the sum of all previous token counts to use as start index for this schema version
+                            const startIndex = tokenKeysCount
+                                .slice(0, schemaVersion)
+                                .reduce((sum, count) => sum + count, 0);
+                            if (startIndex >= i) {
+                                // Done removing tokens
+                                break;
+                            }
+                            const endIndex = i > startIndex + tokenKeysCount[schemaVersion]
+                                ? startIndex + tokenKeysCount[schemaVersion]
+                                : i;
+                            if (i > startIndex &&
+                                tokenKeysCount[schemaVersion] > 0) {
+                                this.removeAccessTokenKeys(accessTokenKeys.slice(startIndex, endIndex), correlationId, schemaVersion);
+                            }
                         }
                     }
                     break; // If setItem succeeds, exit the loop
@@ -12026,10 +12311,12 @@
                         cacheQuotaExceeded &&
                         i < maxRetries) {
                         if (!accessTokenKeys.length) {
-                            const tokenKeys0 = this.getTokenKeys(0).accessToken;
-                            const tokenKeys1 = this.getTokenKeys().accessToken;
-                            accessTokenKeys = [...tokenKeys0, ...tokenKeys1];
-                            tokenKeysV0Count = tokenKeys0.length;
+                            // If we are currently trying to set the token keys, use the value we're trying to set
+                            for (let i = 0; i <= CREDENTIAL_SCHEMA_VERSION; i++) {
+                                const tokenKeys = this.getTokenKeys(i).accessToken;
+                                accessTokenKeys.push(...tokenKeys);
+                                tokenKeysCount[i] = tokenKeys.length;
+                            }
                         }
                         if (accessTokenKeys.length <= i) {
                             // Nothing left to remove, rethrow the error
@@ -12069,20 +12356,21 @@
          * set account entity in the platform cache
          * @param account
          */
-        async setAccount(account, correlationId) {
+        async setAccount(account, correlationId, kmsi) {
             this.logger.trace("BrowserCacheManager.setAccount called");
-            const key = this.generateAccountKey(account.getAccountInfo());
+            const key = this.generateAccountKey(AccountEntity.getAccountInfo(account));
             const timestamp = Date.now().toString();
             account.lastUpdatedAt = timestamp;
-            await this.setUserData(key, JSON.stringify(account), correlationId, timestamp);
+            await this.setUserData(key, JSON.stringify(account), correlationId, timestamp, kmsi);
             const wasAdded = this.addAccountKeyToMap(key, correlationId);
+            this.performanceClient.addFields({ kmsi: kmsi }, correlationId);
             /**
              * @deprecated - Remove this in next major version in favor of more consistent LOGIN event
              */
             if (this.cacheConfig.cacheLocation ===
                 BrowserCacheLocation.LocalStorage &&
                 wasAdded) {
-                this.eventHandler.emitEvent(EventType.ACCOUNT_ADDED, undefined, account.getAccountInfo());
+                this.eventHandler.emitEvent(EventType.ACCOUNT_ADDED, undefined, AccountEntity.getAccountInfo(account));
             }
         }
         /**
@@ -12092,6 +12380,14 @@
         getAccountKeys() {
             return getAccountKeys(this.browserStorage);
         }
+        setAccountKeys(accountKeys, correlationId, schemaVersion = ACCOUNT_SCHEMA_VERSION) {
+            if (accountKeys.length === 0) {
+                this.removeItem(getAccountKeysCacheKey(schemaVersion));
+            }
+            else {
+                this.setItem(getAccountKeysCacheKey(schemaVersion), JSON.stringify(accountKeys), correlationId);
+            }
+        }
         /**
          * Add a new account to the key map
          * @param key
@@ -12123,14 +12419,7 @@
             const removalIndex = accountKeys.indexOf(key);
             if (removalIndex > -1) {
                 accountKeys.splice(removalIndex, 1);
-                if (accountKeys.length === 0) {
-                    // If no keys left, remove the map
-                    this.removeItem(getAccountKeysCacheKey());
-                    return;
-                }
-                else {
-                    this.setItem(getAccountKeysCacheKey(), JSON.stringify(accountKeys), correlationId);
-                }
+                this.setAccountKeys(accountKeys, correlationId);
                 this.logger.trace("BrowserCacheManager.removeAccountKeyFromMap account key removed");
             }
             else {
@@ -12270,12 +12559,12 @@
          * set IdToken credential to the platform cache
          * @param idToken
          */
-        async setIdTokenCredential(idToken, correlationId) {
+        async setIdTokenCredential(idToken, correlationId, kmsi) {
             this.logger.trace("BrowserCacheManager.setIdTokenCredential called");
             const idTokenKey = this.generateCredentialKey(idToken);
             const timestamp = Date.now().toString();
             idToken.lastUpdatedAt = timestamp;
-            await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp);
+            await this.setUserData(idTokenKey, JSON.stringify(idToken), correlationId, timestamp, kmsi);
             const tokenKeys = this.getTokenKeys();
             if (tokenKeys.idToken.indexOf(idTokenKey) === -1) {
                 this.logger.info("BrowserCacheManager: addTokenKey - idToken added to map");
@@ -12307,12 +12596,12 @@
          * set accessToken credential to the platform cache
          * @param accessToken
          */
-        async setAccessTokenCredential(accessToken, correlationId) {
+        async setAccessTokenCredential(accessToken, correlationId, kmsi) {
             this.logger.trace("BrowserCacheManager.setAccessTokenCredential called");
             const accessTokenKey = this.generateCredentialKey(accessToken);
             const timestamp = Date.now().toString();
             accessToken.lastUpdatedAt = timestamp;
-            await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp);
+            await this.setUserData(accessTokenKey, JSON.stringify(accessToken), correlationId, timestamp, kmsi);
             const tokenKeys = this.getTokenKeys();
             const index = tokenKeys.accessToken.indexOf(accessTokenKey);
             if (index !== -1) {
@@ -12346,12 +12635,12 @@
          * set refreshToken credential to the platform cache
          * @param refreshToken
          */
-        async setRefreshTokenCredential(refreshToken, correlationId) {
+        async setRefreshTokenCredential(refreshToken, correlationId, kmsi) {
             this.logger.trace("BrowserCacheManager.setRefreshTokenCredential called");
             const refreshTokenKey = this.generateCredentialKey(refreshToken);
             const timestamp = Date.now().toString();
             refreshToken.lastUpdatedAt = timestamp;
-            await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp);
+            await this.setUserData(refreshTokenKey, JSON.stringify(refreshToken), correlationId, timestamp, kmsi);
             const tokenKeys = this.getTokenKeys();
             if (tokenKeys.refreshToken.indexOf(refreshTokenKey) === -1) {
                 this.logger.info("BrowserCacheManager: addTokenKey - refreshToken added to map");
@@ -12851,7 +13140,7 @@
                 idToken: idTokenEntity,
                 accessToken: accessTokenEntity,
             };
-            return this.saveCacheRecord(cacheRecord, result.correlationId);
+            return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)));
         }
         /**
          * saves a cache record
@@ -12859,9 +13148,9 @@
          * @param storeInCache {?StoreInCache}
          * @param correlationId {?string} correlation id
          */
-        async saveCacheRecord(cacheRecord, correlationId, storeInCache) {
+        async saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache) {
             try {
-                await super.saveCacheRecord(cacheRecord, correlationId, storeInCache);
+                await super.saveCacheRecord(cacheRecord, correlationId, kmsi, storeInCache);
             }
             catch (e) {
                 if (e instanceof CacheError &&
@@ -14093,7 +14382,7 @@
             // generate authenticationResult
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
-            await this.cacheAccount(baseAccount, this.correlationId);
+            await this.cacheAccount(baseAccount, this.correlationId, isKmsi(idTokenClaims));
             await this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
             return result;
         }
@@ -14180,7 +14469,7 @@
             const tid = accountProperties["TenantId"] ||
                 idTokenClaims.tid ||
                 Constants.EMPTY_STRING;
-            const accountInfo = updateAccountTenantProfileData(accountEntity.getAccountInfo(), undefined, // tenantProfile optional
+            const accountInfo = updateAccountTenantProfileData(AccountEntity.getAccountInfo(accountEntity), undefined, // tenantProfile optional
             idTokenClaims, response.id_token);
             /**
              * In pairwise broker flows, this check prevents the broker's native account id
@@ -14217,11 +14506,11 @@
          * cache the account entity in browser storage
          * @param accountEntity
          */
-        async cacheAccount(accountEntity, correlationId) {
+        async cacheAccount(accountEntity, correlationId, kmsi) {
             // Store the account info and hence `nativeAccountId` in browser cache
-            await this.browserStorage.setAccount(accountEntity, this.correlationId);
+            await this.browserStorage.setAccount(accountEntity, this.correlationId, kmsi);
             // Remove any existing cached tokens for this account in browser storage
-            this.browserStorage.removeAccountContext(accountEntity.getAccountInfo(), correlationId);
+            this.browserStorage.removeAccountContext(AccountEntity.getAccountInfo(accountEntity), correlationId);
         }
         /**
          * Stores the access_token and id_token in inmemory storage
@@ -14248,7 +14537,7 @@
                 idToken: cachedIdToken,
                 accessToken: cachedAccessToken,
             };
-            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, request.storeInCache);
+            return this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, this.correlationId, isKmsi(idTokenClaims), request.storeInCache);
         }
         getExpiresInValue(tokenType, expiresIn) {
             return tokenType === AuthenticationScheme.POP
@@ -16274,6 +16563,7 @@
         authFrame.style.width = authFrame.style.height = "0";
         authFrame.style.border = "0";
         authFrame.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+        authFrame.setAttribute("allow", "local-network-access *");
         document.body.appendChild(authFrame);
         return authFrame;
     }
@@ -16526,6 +16816,7 @@
             const idTokenClaims = response.id_token
                 ? extractTokenClaims(response.id_token, base64Decode)
                 : undefined;
+            const kmsi = isKmsi(idTokenClaims || {});
             const authorityOptions = {
                 protocolMode: this.config.auth.protocolMode,
                 knownAuthorities: this.config.auth.knownAuthorities,
@@ -16537,9 +16828,9 @@
                 ? new Authority(Authority.generateAuthority(request.authority, request.azureCloudOptions), this.config.system.networkClient, this.storage, authorityOptions, this.logger, request.correlationId || createNewGuid())
                 : undefined;
             const cacheRecordAccount = await this.loadAccount(request, options.clientInfo || response.client_info || "", correlationId, idTokenClaims, authority);
-            const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId);
-            const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId);
-            const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId);
+            const idToken = await this.loadIdToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, correlationId, kmsi);
+            const accessToken = await this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, cacheRecordAccount.realm, options, correlationId, kmsi);
+            const refreshToken = await this.loadRefreshToken(response, cacheRecordAccount.homeAccountId, cacheRecordAccount.environment, correlationId, kmsi);
             return this.generateAuthenticationResult(request, {
                 account: cacheRecordAccount,
                 idToken,
@@ -16560,7 +16851,7 @@
             this.logger.verbose("TokenCache - loading account");
             if (request.account) {
                 const accountEntity = AccountEntity.createFromAccountInfo(request.account);
-                await this.storage.setAccount(accountEntity, correlationId);
+                await this.storage.setAccount(accountEntity, correlationId, isKmsi(idTokenClaims || {}));
                 return accountEntity;
             }
             else if (!authority || (!clientInfo && !idTokenClaims)) {
@@ -16572,7 +16863,7 @@
             const cachedAccount = buildAccountToCache(this.storage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, authority.hostnameAndPort, claimsTenantId, undefined, // authCodePayload
             undefined, // nativeAccountId
             this.logger);
-            await this.storage.setAccount(cachedAccount, correlationId);
+            await this.storage.setAccount(cachedAccount, correlationId, isKmsi(idTokenClaims || {}));
             return cachedAccount;
         }
         /**
@@ -16583,14 +16874,14 @@
          * @param tenantId
          * @returns `IdTokenEntity`
          */
-        async loadIdToken(response, homeAccountId, environment, tenantId, correlationId) {
+        async loadIdToken(response, homeAccountId, environment, tenantId, correlationId, kmsi) {
             if (!response.id_token) {
                 this.logger.verbose("TokenCache - no id token found in response");
                 return null;
             }
             this.logger.verbose("TokenCache - loading id token");
             const idTokenEntity = createIdTokenEntity(homeAccountId, environment, response.id_token, this.config.auth.clientId, tenantId);
-            await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
+            await this.storage.setIdTokenCredential(idTokenEntity, correlationId, kmsi);
             return idTokenEntity;
         }
         /**
@@ -16602,7 +16893,7 @@
          * @param tenantId
          * @returns `AccessTokenEntity`
          */
-        async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId) {
+        async loadAccessToken(request, response, homeAccountId, environment, tenantId, options, correlationId, kmsi) {
             if (!response.access_token) {
                 this.logger.verbose("TokenCache - no access token found in response");
                 return null;
@@ -16625,7 +16916,7 @@
                 (response.ext_expires_in || response.expires_in) +
                     nowSeconds();
             const accessTokenEntity = createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes.printScopes(), expiresOn, extendedExpiresOn, base64Decode);
-            await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId);
+            await this.storage.setAccessTokenCredential(accessTokenEntity, correlationId, kmsi);
             return accessTokenEntity;
         }
         /**
@@ -16636,7 +16927,7 @@
          * @param environment
          * @returns `RefreshTokenEntity`
          */
-        async loadRefreshToken(response, homeAccountId, environment, correlationId) {
+        async loadRefreshToken(response, homeAccountId, environment, correlationId, kmsi) {
             if (!response.refresh_token) {
                 this.logger.verbose("TokenCache - no refresh token found in response");
                 return null;
@@ -16644,7 +16935,7 @@
             this.logger.verbose("TokenCache - loading refresh token");
             const refreshTokenEntity = createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId, response.foci, undefined, // userAssertionHash
             response.refresh_token_expires_in);
-            await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId);
+            await this.storage.setRefreshTokenCredential(refreshTokenEntity, correlationId, kmsi);
             return refreshTokenEntity;
         }
         /**
@@ -16673,7 +16964,7 @@
                 uniqueId: cacheRecord.account.localAccountId,
                 tenantId: cacheRecord.account.realm,
                 scopes: responseScopes,
-                account: accountEntity.getAccountInfo(),
+                account: AccountEntity.getAccountInfo(accountEntity),
                 idToken: cacheRecord.idToken?.secret || "",
                 idTokenClaims: idTokenClaims || {},
                 accessToken: accessToken,
@@ -17691,7 +17982,7 @@
             this.logger.verbose("hydrateCache called");
             // Account gets saved to browser storage regardless of native or not
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            await this.browserStorage.setAccount(accountEntity, result.correlationId);
+            await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
             if (result.fromNativeBroker) {
                 this.logger.verbose("Response was from native broker, storing in-memory");
                 // Tokens from native broker are stored in-memory
@@ -18969,7 +19260,7 @@
         async hydrateCache(result, request) {
             this.logger.verbose("hydrateCache called");
             const accountEntity = AccountEntity.createFromAccountInfo(result.account, result.cloudGraphHostName, result.msGraphHost);
-            await this.browserStorage.setAccount(accountEntity, result.correlationId);
+            await this.browserStorage.setAccount(accountEntity, result.correlationId, isKmsi(result.idTokenClaims));
             return this.browserStorage.hydrateCache(result, request);
         }
     }