@azure/msal-browser 5.13.0 → 5.15.0

package/lib/custom-auth-path/msal-custom-auth.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.13.0 2026-06-10 */
+/*! @azure/msal-browser v5.15.0 2026-06-23 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msalCustomAuth = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -33,10 +33,11 @@
     const EMAIL_SCOPE = "email";
     const S256_CODE_CHALLENGE_METHOD = "S256";
     const URL_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded;charset=utf-8";
+    const NOT_APPLICABLE = "N/A";
     const NOT_AVAILABLE = "Not Available";
     const FORWARD_SLASH = "/";
-    const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute/location";
-    const IMDS_VERSION = "2020-06-01";
+    const IMDS_ENDPOINT = "http://169.254.169.254/metadata/instance/compute";
+    const IMDS_VERSION = "2021-02-01";
     const IMDS_TIMEOUT = 2000;
     const AZURE_REGION_AUTO_DISCOVER_FLAG = "TryAutoDetect";
     const REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX = "login.microsoft.com";
@@ -97,6 +98,9 @@
     const ClaimsRequestKeys = {
         ACCESS_TOKEN: "access_token",
         XMS_CC: "xms_cc",
+        ID_TOKEN: "id_token",
+        SIGNIN_STATE: "signin_state",
+        LOGIN_HINT: "login_hint",
     };
     /**
      * we considered making this "enum" in the request instead of string, however it looks like the allowed list of
@@ -233,7 +237,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -285,7 +289,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -297,7 +301,7 @@
      * General error class thrown by the MSAL.js library.
      */
     class AuthError extends Error {
-        constructor(errorCode, errorMessage, suberror) {
+        constructor(errorCode, correlationId, errorMessage, suberror) {
             const message = errorMessage ||
                 (errorCode ? getDefaultErrorMessage$1(errorCode) : "");
             const errorString = message ? `${errorCode}: ${message}` : errorCode;
@@ -306,17 +310,15 @@
             this.errorCode = errorCode || "";
             this.errorMessage = message || "";
             this.subError = suberror || "";
-            this.name = "AuthError";
-        }
-        setCorrelationId(correlationId) {
             this.correlationId = correlationId;
+            this.name = "AuthError";
         }
     }
-    function createAuthError(code, additionalMessage) {
-        return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
+    function createAuthError(code, correlationId, additionalMessage) {
+        return new AuthError(code, correlationId, additionalMessage || getDefaultErrorMessage$1(code));
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -326,17 +328,17 @@
      * Error thrown when there is an error in configuration of the MSAL.js library.
      */
     class ClientConfigurationError extends AuthError {
-        constructor(errorCode) {
-            super(errorCode);
+        constructor(errorCode, correlationId) {
+            super(errorCode, correlationId);
             this.name = "ClientConfigurationError";
             Object.setPrototypeOf(this, ClientConfigurationError.prototype);
         }
     }
-    function createClientConfigurationError(errorCode) {
-        return new ClientConfigurationError(errorCode);
+    function createClientConfigurationError(errorCode, correlationId) {
+        return new ClientConfigurationError(errorCode, correlationId);
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -416,7 +418,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -429,17 +431,17 @@
      * Error thrown when there is an error in the client code running on the browser.
      */
     class ClientAuthError extends AuthError {
-        constructor(errorCode, additionalMessage) {
-            super(errorCode, additionalMessage);
+        constructor(errorCode, correlationId, additionalMessage) {
+            super(errorCode, correlationId, additionalMessage);
             this.name = "ClientAuthError";
             Object.setPrototypeOf(this, ClientAuthError.prototype);
         }
     }
-    function createClientAuthError(errorCode, additionalMessage) {
-        return new ClientAuthError(errorCode, additionalMessage);
+    function createClientAuthError(errorCode, correlationId, additionalMessage) {
+        return new ClientAuthError(errorCode, correlationId, additionalMessage);
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -465,7 +467,7 @@
     const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
     const issuerValidationFailed = "issuer_validation_failed";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -482,8 +484,6 @@
     const stateMismatch = "state_mismatch";
     const stateNotFound = "state_not_found";
     const nonceMismatch = "nonce_mismatch";
-    const authTimeNotFound = "auth_time_not_found";
-    const maxAgeTranspired = "max_age_transpired";
     const multipleMatchingAppMetadata = "multiple_matching_appMetadata";
     const requestCannotBeMade = "request_cannot_be_made";
     const cannotRemoveEmptyScope = "cannot_remove_empty_scope";
@@ -504,7 +504,7 @@
     const resourceParameterRequired = "resource_parameter_required";
     const misplacedResourceParam = "misplaced_resource_parameter";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -516,7 +516,8 @@
      * to ensure uniqueness of strings.
      */
     class ScopeSet {
-        constructor(inputScopes) {
+        constructor(inputScopes, correlationId) {
+            this.correlationId = correlationId;
             // Filter empty string and null/undefined array items
             const scopeArr = inputScopes
                 ? StringUtils.trimArrayEntries([...inputScopes])
@@ -526,7 +527,7 @@
                 : [];
             // Check if scopes array has at least one member
             if (!filteredInput || !filteredInput.length) {
-                throw createClientConfigurationError(emptyInputScopesError);
+                throw createClientConfigurationError(emptyInputScopesError, correlationId);
             }
             this.scopes = new Set(); // Iterator in constructor not supported by IE11
             filteredInput.forEach((scope) => this.scopes.add(scope));
@@ -537,22 +538,22 @@
          * @param appClientId
          * @param scopesRequired
          */
-        static fromString(inputScopeString) {
+        static fromString(inputScopeString, correlationId) {
             const scopeString = inputScopeString || "";
             const inputScopes = scopeString.split(" ");
-            return new ScopeSet(inputScopes);
+            return new ScopeSet(inputScopes, correlationId);
         }
         /**
          * Creates the set of scopes to search for in cache lookups
          * @param inputScopeString
          * @returns
          */
-        static createSearchScopes(inputScopeString) {
+        static createSearchScopes(inputScopeString, correlationId) {
             // Handle empty scopes by using default OIDC scopes for cache lookup
             const scopesToUse = inputScopeString && inputScopeString.length > 0
                 ? inputScopeString
                 : [...OIDC_DEFAULT_SCOPES];
-            const scopeSet = new ScopeSet(scopesToUse);
+            const scopeSet = new ScopeSet(scopesToUse, correlationId);
             if (!scopeSet.containsOnlyOIDCScopes()) {
                 scopeSet.removeOIDCScopes();
             }
@@ -567,7 +568,7 @@
          */
         containsScope(scope) {
             const lowerCaseScopes = this.printScopesLowerCase().split(" ");
-            const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes);
+            const lowerCaseScopesSet = new ScopeSet(lowerCaseScopes, this.correlationId);
             // compare lowercase scopes
             return scope
                 ? lowerCaseScopesSet.scopes.has(scope.toLowerCase())
@@ -614,7 +615,7 @@
                 newScopes.forEach((newScope) => this.appendScope(newScope));
             }
             catch (e) {
-                throw createClientAuthError(cannotAppendScopeSet);
+                throw createClientAuthError(cannotAppendScopeSet, this.correlationId);
             }
         }
         /**
@@ -623,7 +624,7 @@
          */
         removeScope(scope) {
             if (!scope) {
-                throw createClientAuthError(cannotRemoveEmptyScope);
+                throw createClientAuthError(cannotRemoveEmptyScope, this.correlationId);
             }
             this.scopes.delete(scope.trim());
         }
@@ -642,7 +643,7 @@
          */
         unionScopeSets(otherScopes) {
             if (!otherScopes) {
-                throw createClientAuthError(emptyInputScopeSet);
+                throw createClientAuthError(emptyInputScopeSet, this.correlationId);
             }
             const unionScopes = new Set(); // Iterator in constructor not supported in IE11
             otherScopes.scopes.forEach((scope) => unionScopes.add(scope.toLowerCase()));
@@ -655,7 +656,7 @@
          */
         intersectingScopeSets(otherScopes) {
             if (!otherScopes) {
-                throw createClientAuthError(emptyInputScopeSet);
+                throw createClientAuthError(emptyInputScopeSet, this.correlationId);
             }
             // Do not allow OIDC scopes to be the only intersecting scopes
             if (!otherScopes.containsOnlyOIDCScopes()) {
@@ -699,7 +700,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -743,7 +744,7 @@
      * @param scopeSet
      * @param addOidcScopes
      */
-    function addScopes(parameters, scopes, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
+    function addScopes(parameters, scopes, correlationId, addOidcScopes = true, defaultScopes = OIDC_DEFAULT_SCOPES) {
         // Always add openid to the scopes when adding OIDC scopes
         if (addOidcScopes &&
             !defaultScopes.includes("openid") &&
@@ -753,7 +754,7 @@
         const requestScopes = addOidcScopes
             ? [...(scopes || []), ...defaultScopes]
             : scopes || [];
-        const scopeSet = new ScopeSet(requestScopes);
+        const scopeSet = new ScopeSet(requestScopes, correlationId);
         parameters.set(SCOPE, scopeSet.printScopes());
     }
     /**
@@ -823,26 +824,18 @@
      * Adds claims to request parameters, conditionally excluding clientCapabilities
      * when skipBrokerClaims is true and a brokered flow is in effect.
      * @param parameters - The request parameters map
+     * @param correlationId - The request correlation id
      * @param claims - The claims string from the request
      * @param clientCapabilities - The client capabilities from configuration
      * @param skipBrokerClaims - When true and BROKER_CLIENT_ID is present, excludes clientCapabilities from claims
      */
-    function addClaims(parameters, claims, clientCapabilities, skipBrokerClaims) {
+    function addClaims(parameters, correlationId, claims, clientCapabilities, skipBrokerClaims) {
         // Skip clientCapabilities if skipBrokerClaims is set to true and this is a brokered authentication flow
         const configClaims = skipBrokerClaims && parameters.has(BROKER_CLIENT_ID)
             ? undefined
             : clientCapabilities;
-        if (!StringUtils.isEmptyObj(claims) ||
-            (configClaims && configClaims.length > 0)) {
-            const mergedClaims = addClientCapabilitiesToClaims(claims, configClaims);
-            try {
-                JSON.parse(mergedClaims);
-            }
-            catch (e) {
-                throw createClientConfigurationError(invalidClaims);
-            }
-            parameters.set(CLAIMS, mergedClaims);
-        }
+        const mergedClaims = buildMergedClaims(claims, configClaims, correlationId);
+        parameters.set(CLAIMS, mergedClaims);
     }
     /**
      * add correlationId
@@ -913,7 +906,7 @@
             parameters.set(CODE_CHALLENGE_METHOD, codeChallengeMethod);
         }
         else {
-            throw createClientConfigurationError(pkceParamsMissing);
+            throw createClientConfigurationError(pkceParamsMissing, "");
         }
     }
     /**
@@ -998,7 +991,23 @@
             }
         });
     }
-    function addClientCapabilitiesToClaims(claims, clientCapabilities) {
+    /**
+     * Default optional idToken claims requested on all auth requests.
+     * signin_state enables KMSI detection; login_hint enables login hint propagation.
+     */
+    const DEFAULT_ID_TOKEN_CLAIMS = {
+        [ClaimsRequestKeys.SIGNIN_STATE]: { essential: false },
+        [ClaimsRequestKeys.LOGIN_HINT]: { essential: false },
+    };
+    /**
+     * Parses claims JSON, merges default optional idToken claims (signin_state, login_hint),
+     * and appends client capabilities (xms_cc) to the access_token section.
+     * Does not overwrite idToken claims already specified by the caller.
+     * @param claims - Existing claims JSON string from the request (may be undefined)
+     * @param clientCapabilities - Client capabilities array from configuration
+     * @returns Merged claims JSON string
+     */
+    function buildMergedClaims(claims, clientCapabilities, correlationId = "") {
         let mergedClaims;
         // Parse provided claims into JSON object or initialize empty object
         if (!claims) {
@@ -1006,14 +1015,31 @@
         }
         else {
             try {
-                mergedClaims = JSON.parse(claims);
+                const parsed = JSON.parse(claims);
+                if (typeof parsed !== "object" ||
+                    parsed === null ||
+                    Array.isArray(parsed)) {
+                    throw new Error("Claims must be a JSON object");
+                }
+                mergedClaims = parsed;
             }
             catch (e) {
-                throw createClientConfigurationError(invalidClaims);
+                throw createClientConfigurationError(invalidClaims, correlationId);
+            }
+        }
+        // Add default optional idToken claims
+        if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ID_TOKEN)) {
+            mergedClaims[ClaimsRequestKeys.ID_TOKEN] = {};
+        }
+        const idTokenClaims = mergedClaims[ClaimsRequestKeys.ID_TOKEN];
+        for (const [key, value] of Object.entries(DEFAULT_ID_TOKEN_CLAIMS)) {
+            if (!(key in idTokenClaims)) {
+                idTokenClaims[key] = value;
             }
         }
+        // Add client capabilities
         if (clientCapabilities && clientCapabilities.length > 0) {
-            if (!mergedClaims.hasOwnProperty(ClaimsRequestKeys.ACCESS_TOKEN)) {
+            if (!Object.prototype.hasOwnProperty.call(mergedClaims, ClaimsRequestKeys.ACCESS_TOKEN)) {
                 // Add access_token key to claims object
                 mergedClaims[ClaimsRequestKeys.ACCESS_TOKEN] = {};
             }
@@ -1046,16 +1072,11 @@
     /**
      * add server telemetry fields
      * @param serverTelemetryManager
+     * @internal
      */
     function addServerTelemetry(parameters, serverTelemetryManager) {
-        const currentTelemetryHeader = serverTelemetryManager.generateCurrentRequestHeaderValue();
-        const lastTelemetryHeader = serverTelemetryManager.generateLastRequestHeaderValue();
-        if (currentTelemetryHeader) {
-            parameters.set(X_CLIENT_CURR_TELEM, currentTelemetryHeader);
-        }
-        if (lastTelemetryHeader) {
-            parameters.set(X_CLIENT_LAST_TELEM, lastTelemetryHeader);
-        }
+        parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+        parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
     }
     /**
      * Adds parameter that indicates to the server that throttling is supported
@@ -1094,7 +1115,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1137,7 +1158,7 @@
             }
         }
         catch (e) {
-            throw createClientAuthError(hashNotDeserialized);
+            throw createClientAuthError(hashNotDeserialized, "");
         }
         return null;
     }
@@ -1193,8 +1214,8 @@
             return urlObj.href;
         }
         catch (e) {
-            logger?.error("15apdm", correlationId || "");
-            throw createClientConfigurationError(urlParseError);
+            logger?.error(`15apdm ${e}`, correlationId || "");
+            throw createClientConfigurationError(urlParseError, correlationId || "");
         }
     }
     /**
@@ -1211,12 +1232,12 @@
             new URL(url);
         }
         catch (e) {
-            logger?.error("1lrjz7", correlationId || "");
-            throw createClientConfigurationError(urlParseError);
+            logger?.error(`1lrjz7 ${e}`, correlationId || "");
+            throw createClientConfigurationError(urlParseError, correlationId || "");
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1224,38 +1245,38 @@
      */
     const DEFAULT_CRYPTO_IMPLEMENTATION = {
         createNewGuid: () => {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         base64Decode: () => {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         base64Encode: () => {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         base64UrlEncode: () => {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         encodeKid: () => {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         async getPublicKeyThumbprint() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         async removeTokenBindingKey() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         async clearKeystore() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         async signJwt() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         async hashString() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1318,22 +1339,36 @@
         }
     }
     /**
-     * Checks if a string is already a hashed logging string (6 alphanumeric characters)
-     */
-    function isHashedString(str) {
-        if (str.length !== 6) {
-            return false;
+     * Extracts the leading minification hash from a log message, if present.
+     *
+     * Minified messages are produced by the logger-minify rollup plugin and are
+     * either a bare 6-character alphanumeric hash, or that hash followed by a space
+     * and runtime variables appended for local (console) logging, e.g.
+     * "abc123 user-1 popup". Only the leading hash is returned so that telemetry
+     * never captures the appended variables. Returns null when the message is not
+     * a minified message.
+     */
+    function getMessageHash(str) {
+        if (str.length < 6) {
+            return null;
         }
-        for (let i = 0; i < str.length; i++) {
+        /*
+         * If the message is longer than the hash, the hash must be delimited by a
+         * space (the separator the plugin inserts before appended variables).
+         */
+        if (str.length > 6 && str[6] !== " ") {
+            return null;
+        }
+        for (let i = 0; i < 6; i++) {
             const char = str[i];
             const isAlphaNumeric = (char >= "a" && char <= "z") ||
                 (char >= "A" && char <= "Z") ||
                 (char >= "0" && char <= "9");
             if (!isAlphaNumeric) {
-                return false;
+                return null;
             }
         }
-        return true;
+        return str.substring(0, 6);
     }
     /**
      * Class which facilitates logging of messages to a specific place.
@@ -1380,10 +1415,10 @@
          */
         logMessage(logMessage, options) {
             const correlationId = options.correlationId;
-            const isHashedInput = isHashedString(logMessage);
-            if (isHashedInput) {
+            const messageHash = getMessageHash(logMessage);
+            if (messageHash) {
                 const loggedMessage = {
-                    hash: logMessage,
+                    hash: messageHash,
                     level: options.logLevel,
                     containsPii: options.containsPii || false,
                     milliseconds: 0, // Will be calculated in addLogToCache
@@ -1516,12 +1551,12 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.8.0";
+    const version$1 = "16.10.0";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1530,7 +1565,74 @@
         // AzureCloudInstance is not specified.
         None: "none"};
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Extract token by decoding the rawToken
+     *
+     * @param encodedToken
+     */
+    function extractTokenClaims(encodedToken, base64Decode, correlationId) {
+        const jswPayload = getJWSPayload(encodedToken, correlationId);
+        // token will be decoded to get the username
+        try {
+            // base64Decode() should throw an error if there is an issue
+            const base64Decoded = base64Decode(jswPayload);
+            return JSON.parse(base64Decoded);
+        }
+        catch (err) {
+            throw createClientAuthError(tokenParsingError, correlationId);
+        }
+    }
+    /**
+     * Check if the signin_state claim contains "kmsi"
+     * @param idTokenClaims
+     * @returns
+     */
+    function isKmsi(idTokenClaims) {
+        if (!idTokenClaims.signin_state) {
+            return false;
+        }
+        /**
+         * Signin_state claim known values:
+         * dvc_mngd - device is managed
+         * dvc_dmjd - device is domain joined
+         * kmsi - user opted to "keep me signed in"
+         * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
+         */
+        const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
+        return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
+    }
+    /**
+     * decode a JWT
+     *
+     * @param authToken
+     */
+    function getJWSPayload(authToken, correlationId) {
+        if (!authToken) {
+            throw createClientAuthError(nullOrEmptyToken, correlationId);
+        }
+        const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+        const matches = tokenPartsRegex.exec(authToken);
+        if (!matches || matches.length < 4) {
+            throw createClientAuthError(tokenParsingError, correlationId);
+        }
+        /**
+         * const crackedToken = {
+         *  header: matches[1],
+         *  JWSPayload: matches[2],
+         *  JWSSig: matches[3],
+         * };
+         */
+        return matches[2];
+    }
+
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1551,10 +1653,11 @@
      * @param homeAccountId - Home account identifier for this account object
      * @param localAccountId - Local account identifer for this account object
      * @param tenantId - Full tenant or organizational id that this account belongs to
+     * @param nativeAccountId - Native account identifier for this tenant
      * @param idTokenClaims - Claims from the ID token
      * @returns
      */
-    function buildTenantProfile(homeAccountId, localAccountId, tenantId, idTokenClaims) {
+    function buildTenantProfile(homeAccountId, localAccountId, tenantId, nativeAccountId, idTokenClaims) {
         if (idTokenClaims) {
             const { oid, sub, tid, name, tfp, acr, preferred_username, upn, login_hint, } = idTokenClaims;
             /**
@@ -1572,6 +1675,7 @@
                 loginHint: login_hint,
                 isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
                 upn: upn,
+                ...(nativeAccountId && { nativeAccountId }),
             };
         }
         else {
@@ -1580,6 +1684,7 @@
                 localAccountId,
                 username: "",
                 isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+                ...(nativeAccountId && { nativeAccountId }),
             };
         }
     }
@@ -1601,99 +1706,20 @@
         if (idTokenClaims) {
             // Ignore isHomeTenant which is a utility property of tenant profile but not required in base account info
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, idTokenClaims);
+            const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfile(baseAccountInfo.homeAccountId, baseAccountInfo.localAccountId, baseAccountInfo.tenantId, updatedAccountInfo.nativeAccountId, idTokenClaims);
             updatedAccountInfo = {
                 ...updatedAccountInfo,
                 ...claimsSourcedTenantProfile,
                 idTokenClaims: idTokenClaims,
                 idToken: idTokenSecret,
+                kmsi: isKmsi(idTokenClaims),
             };
             return updatedAccountInfo;
         }
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Extract token by decoding the rawToken
-     *
-     * @param encodedToken
-     */
-    function extractTokenClaims(encodedToken, base64Decode) {
-        const jswPayload = getJWSPayload(encodedToken);
-        // token will be decoded to get the username
-        try {
-            // base64Decode() should throw an error if there is an issue
-            const base64Decoded = base64Decode(jswPayload);
-            return JSON.parse(base64Decoded);
-        }
-        catch (err) {
-            throw createClientAuthError(tokenParsingError);
-        }
-    }
-    /**
-     * Check if the signin_state claim contains "kmsi"
-     * @param idTokenClaims
-     * @returns
-     */
-    function isKmsi(idTokenClaims) {
-        if (!idTokenClaims.signin_state) {
-            return false;
-        }
-        /**
-         * Signin_state claim known values:
-         * dvc_mngd - device is managed
-         * dvc_dmjd - device is domain joined
-         * kmsi - user opted to "keep me signed in"
-         * inknownntwk - Request made inside a known network. Don't use this, use CAE instead.
-         */
-        const kmsiClaims = ["kmsi", "dvc_dmjd"]; // There are some cases where kmsi may not be returned but persistent storage is still OK - allow dvc_dmjd as well
-        return idTokenClaims.signin_state.some((value) => kmsiClaims.includes(value.trim().toLowerCase()));
-    }
-    /**
-     * decode a JWT
-     *
-     * @param authToken
-     */
-    function getJWSPayload(authToken) {
-        if (!authToken) {
-            throw createClientAuthError(nullOrEmptyToken);
-        }
-        const tokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
-        const matches = tokenPartsRegex.exec(authToken);
-        if (!matches || matches.length < 4) {
-            throw createClientAuthError(tokenParsingError);
-        }
-        /**
-         * const crackedToken = {
-         *  header: matches[1],
-         *  JWSPayload: matches[2],
-         *  JWSSig: matches[3],
-         * };
-         */
-        return matches[2];
-    }
-    /**
-     * Determine if the token's max_age has transpired
-     */
-    function checkMaxAge(authTime, maxAge) {
-        /*
-         * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
-         * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
-         * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
-         */
-        const fiveMinuteSkew = 300000; // five minutes in milliseconds
-        if (maxAge === 0 || Date.now() - fiveMinuteSkew > authTime + maxAge) {
-            throw createClientAuthError(maxAgeTranspired);
-        }
-    }
-
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1706,11 +1732,12 @@
         get urlString() {
             return this._urlString;
         }
-        constructor(url) {
+        constructor(url, correlationId) {
             this._urlString = url;
+            this.correlationId = correlationId;
             if (!this._urlString) {
                 // Throws error if url is empty
-                throw createClientConfigurationError(urlEmptyError);
+                throw createClientConfigurationError(urlEmptyError, correlationId);
             }
             if (!url.includes("#")) {
                 this._urlString = UrlString.canonicalizeUri(url);
@@ -1746,16 +1773,16 @@
                 components = this.getUrlComponents();
             }
             catch (e) {
-                throw createClientConfigurationError(urlParseError);
+                throw createClientConfigurationError(urlParseError, this.correlationId);
             }
             // Throw error if URI or path segments are not parseable.
             if (!components.HostNameAndPort || !components.PathSegments) {
-                throw createClientConfigurationError(urlParseError);
+                throw createClientConfigurationError(urlParseError, this.correlationId);
             }
             // Throw error if uri is insecure.
             if (!components.Protocol ||
                 components.Protocol.toLowerCase() !== "https:") {
-                throw createClientConfigurationError(authorityUriInsecure);
+                throw createClientConfigurationError(authorityUriInsecure, this.correlationId);
             }
         }
         /**
@@ -1792,7 +1819,7 @@
                     pathArray[0] === AADAuthority.ORGANIZATIONS)) {
                 pathArray[0] = tenantId;
             }
-            return UrlString.constructAuthorityUriFromObject(urlObject);
+            return UrlString.constructAuthorityUriFromObject(urlObject, this.correlationId);
         }
         /**
          * Parses out the components from a url string.
@@ -1804,7 +1831,7 @@
             // If url string does not match regEx, we throw an error
             const match = this.urlString.match(regEx);
             if (!match) {
-                throw createClientConfigurationError(urlParseError);
+                throw createClientConfigurationError(urlParseError, this.correlationId);
             }
             // Url component object
             const urlComponents = {
@@ -1822,17 +1849,17 @@
             }
             return urlComponents;
         }
-        static getDomainFromUrl(url) {
+        static getDomainFromUrl(url, correlationId) {
             const regEx = RegExp("^([^:/?#]+://)?([^/?#]*)");
             const match = url.match(regEx);
             if (!match) {
-                throw createClientConfigurationError(urlParseError);
+                throw createClientConfigurationError(urlParseError, correlationId);
             }
             return match[2];
         }
-        static getAbsoluteUrl(relativeUrl, baseUrl) {
+        static getAbsoluteUrl(relativeUrl, baseUrl, correlationId) {
             if (relativeUrl[0] === FORWARD_SLASH) {
-                const url = new UrlString(baseUrl);
+                const url = new UrlString(baseUrl, correlationId);
                 const baseComponents = url.getUrlComponents();
                 return (baseComponents.Protocol +
                     "//" +
@@ -1841,16 +1868,16 @@
             }
             return relativeUrl;
         }
-        static constructAuthorityUriFromObject(urlObject) {
+        static constructAuthorityUriFromObject(urlObject, correlationId) {
             return new UrlString(urlObject.Protocol +
                 "//" +
                 urlObject.HostNameAndPort +
                 "/" +
-                urlObject.PathSegments.join("/"));
+                urlObject.PathSegments.join("/"), correlationId);
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1966,10 +1993,10 @@
         let staticAliases;
         const canonicalAuthority = staticAuthorityOptions.canonicalAuthority;
         if (canonicalAuthority) {
-            const authorityHost = new UrlString(canonicalAuthority).getUrlComponents().HostNameAndPort;
+            const authorityHost = new UrlString(canonicalAuthority, correlationId).getUrlComponents().HostNameAndPort;
             staticAliases =
-                getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata) ||
-                    getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata) ||
+                getAliasesFromMetadata(logger, correlationId, authorityHost, staticAuthorityOptions.cloudDiscoveryMetadata?.metadata, AuthorityMetadataSource.CONFIG) ||
+                    getAliasesFromMetadata(logger, correlationId, authorityHost, InstanceDiscoveryMetadata.metadata, AuthorityMetadataSource.HARDCODED_VALUES) ||
                     staticAuthorityOptions.knownAuthorities;
         }
         return staticAliases || [];
@@ -1981,15 +2008,15 @@
      * @returns
      */
     function getAliasesFromMetadata(logger, correlationId, authorityHost, cloudDiscoveryMetadata, source) {
-        logger.trace("1bmquz", correlationId);
+        logger.trace(`1bmquz ${source}`, correlationId);
         if (authorityHost && cloudDiscoveryMetadata) {
             const metadata = getCloudDiscoveryMetadataFromNetworkResponse(cloudDiscoveryMetadata, authorityHost);
             if (metadata) {
-                logger.trace("1fotbt", correlationId);
+                logger.trace(`1fotbt ${source}`, correlationId);
                 return metadata.aliases;
             }
             else {
-                logger.trace("14avvj", correlationId);
+                logger.trace(`14avvj ${source}`, correlationId);
             }
         }
         return null;
@@ -2016,7 +2043,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2024,7 +2051,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2062,7 +2089,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2075,14 +2102,14 @@
      */
     function buildClientInfo(rawClientInfo, base64Decode) {
         if (!rawClientInfo) {
-            throw createClientAuthError(clientInfoEmptyError);
+            throw createClientAuthError(clientInfoEmptyError, "");
         }
         try {
             const decodedClientInfo = base64Decode(rawClientInfo);
             return JSON.parse(decodedClientInfo);
         }
         catch (e) {
-            throw createClientAuthError(clientInfoDecodingError);
+            throw createClientAuthError(clientInfoDecodingError, "");
         }
     }
     /**
@@ -2091,7 +2118,7 @@
      */
     function buildClientInfoFromHomeAccountId(homeAccountId) {
         if (!homeAccountId) {
-            throw createClientAuthError(clientInfoDecodingError);
+            throw createClientAuthError(clientInfoDecodingError, "");
         }
         const clientInfoParts = homeAccountId.split(CLIENT_INFO_SEPARATOR, 2);
         return {
@@ -2100,7 +2127,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2115,7 +2142,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2137,7 +2164,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2161,9 +2188,10 @@
         EAR: "EAR",
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /**
      * Returns the AccountInfo interface for this account.
+     * @internal
      */
     function getAccountInfo(accountEntity) {
         const tenantProfiles = accountEntity.tenantProfiles || [];
@@ -2171,8 +2199,11 @@
         if (tenantProfiles.length === 0 &&
             accountEntity.realm &&
             accountEntity.localAccountId) {
-            tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm));
+            tenantProfiles.push(buildTenantProfile(accountEntity.homeAccountId, accountEntity.localAccountId, accountEntity.realm, accountEntity.nativeAccountId));
         }
+        // Resolve nativeAccountId from the home tenant profile first, fall back to top-level (deprecated) for old cache entries
+        const homeTenantProfile = tenantProfiles.find((tp) => tp.tenantId === accountEntity.realm);
+        const nativeAccountId = homeTenantProfile?.nativeAccountId || accountEntity.nativeAccountId;
         return {
             homeAccountId: accountEntity.homeAccountId,
             environment: accountEntity.environment,
@@ -2181,7 +2212,7 @@
             localAccountId: accountEntity.localAccountId,
             loginHint: accountEntity.loginHint,
             name: accountEntity.name,
-            nativeAccountId: accountEntity.nativeAccountId,
+            nativeAccountId: nativeAccountId,
             authorityType: accountEntity.authorityType,
             // Deserialize tenant profiles array into a Map
             tenantProfiles: new Map(tenantProfiles.map((tenantProfile) => {
@@ -2193,8 +2224,9 @@
     /**
      * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
      * @param accountDetails
+     * @internal
      */
-    function createAccountEntity(accountDetails, authority, base64Decode) {
+    function createAccountEntity(accountDetails, authority, correlationId, base64Decode) {
         let authorityType;
         if (authority.authorityType === AuthorityType.Adfs) {
             authorityType = CACHE_ACCOUNT_TYPE_ADFS;
@@ -2216,7 +2248,7 @@
         const env = accountDetails.environment ||
             (authority && authority.getPreferredCache());
         if (!env) {
-            throw createClientAuthError(invalidCacheEnvironment);
+            throw createClientAuthError(invalidCacheEnvironment, correlationId);
         }
         /*
          * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
@@ -2243,7 +2275,7 @@
             tenantProfiles = accountDetails.tenantProfiles;
         }
         else {
-            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.idTokenClaims);
+            const tenantProfile = buildTenantProfile(accountDetails.homeAccountId, localAccountId, realm, accountDetails.nativeAccountId, accountDetails.idTokenClaims);
             tenantProfiles = [tenantProfile];
         }
         return {
@@ -2271,6 +2303,7 @@
      * @param cloudGraphHostName
      * @param msGraphHost
      * @returns
+     * @internal
      */
     function createAccountEntityFromAccountInfo(accountInfo, cloudGraphHostName, msGraphHost) {
         // Serialize tenant profiles map into an array
@@ -2279,7 +2312,14 @@
         if (tenantProfiles.length === 0 &&
             accountInfo.tenantId &&
             accountInfo.localAccountId) {
-            tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.idTokenClaims));
+            tenantProfiles.push(buildTenantProfile(accountInfo.homeAccountId, accountInfo.localAccountId, accountInfo.tenantId, accountInfo.nativeAccountId, accountInfo.idTokenClaims));
+        }
+        else if (accountInfo.nativeAccountId) {
+            // Ensure nativeAccountId is set on the matching tenant profile
+            const matchingProfile = tenantProfiles.find((tp) => tp.tenantId === accountInfo.tenantId);
+            if (matchingProfile && !matchingProfile.nativeAccountId) {
+                matchingProfile.nativeAccountId = accountInfo.nativeAccountId;
+            }
         }
         return {
             authorityType: accountInfo.authorityType || CACHE_ACCOUNT_TYPE_GENERIC,
@@ -2323,6 +2363,7 @@
     /**
      * Validates an entity: checks for all expected params
      * @param entity
+     * @internal
      */
     function isAccountEntity(entity) {
         if (!entity) {
@@ -2336,7 +2377,7 @@
             entity.hasOwnProperty("authorityType"));
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2425,7 +2466,7 @@
             }
             const idToken = this.getIdToken(accountInfo, correlationId, tokenKeys, tenantProfile.tenantId);
             if (idToken) {
-                idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
+                idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode, correlationId);
                 if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
                     // ID token sourced claims don't match so this tenant profile is not a match
                     return null;
@@ -2488,6 +2529,11 @@
                 !(tenantProfile.upn === tenantProfileFilter.upn)) {
                 return false;
             }
+            if (!!tenantProfileFilter.nativeAccountId &&
+                tenantProfile.nativeAccountId !==
+                    tenantProfileFilter.nativeAccountId) {
+                return false;
+            }
             return true;
         }
         idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
@@ -2525,7 +2571,7 @@
          */
         async saveCacheRecord(cacheRecord, correlationId, kmsi, apiId, storeInCache) {
             if (!cacheRecord) {
-                throw createClientAuthError(invalidCacheRecord);
+                throw createClientAuthError(invalidCacheRecord, correlationId);
             }
             try {
                 if (!!cacheRecord.account) {
@@ -2570,7 +2616,7 @@
                 tokenType: credential.tokenType,
             };
             const tokenKeys = this.getTokenKeys();
-            const currentScopes = ScopeSet.fromString(credential.target);
+            const currentScopes = ScopeSet.fromString(credential.target, correlationId);
             tokenKeys.accessToken.forEach((key) => {
                 if (!this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)) {
                     return;
@@ -2578,7 +2624,7 @@
                 const tokenEntity = this.getAccessTokenCredential(key, correlationId);
                 if (tokenEntity &&
                     this.credentialMatchesFilter(tokenEntity, accessTokenFilter, correlationId)) {
-                    const tokenScopeSet = ScopeSet.fromString(tokenEntity.target);
+                    const tokenScopeSet = ScopeSet.fromString(tokenEntity.target, correlationId);
                     if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
                         this.removeAccessToken(key, correlationId);
                     }
@@ -2612,10 +2658,6 @@
                     !this.matchRealm(entity, accountFilter.realm)) {
                     return;
                 }
-                if (!!accountFilter.nativeAccountId &&
-                    !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
-                    return;
-                }
                 if (!!accountFilter.authorityType &&
                     !this.matchAuthorityType(entity, accountFilter.authorityType)) {
                     return;
@@ -2627,6 +2669,7 @@
                     username: accountFilter?.username,
                     loginHint: accountFilter?.loginHint,
                     upn: accountFilter?.upn,
+                    nativeAccountId: accountFilter?.nativeAccountId,
                 };
                 const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
                     return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
@@ -2680,7 +2723,8 @@
              * idTokens do not have "target", target specific refreshTokens do exist for some types of authentication
              * Resource specific refresh tokens case will be added when the support is deemed necessary
              */
-            if (!!filter.target && !this.matchTarget(entity, filter.target)) {
+            if (!!filter.target &&
+                !this.matchTarget(entity, filter.target, correlationId)) {
                 return false;
             }
             // Access Token with Auth Scheme specific matching
@@ -2697,6 +2741,28 @@
                     }
                 }
             }
+            // Additional cache key components matching (bidirectional isolation)
+            const entityComponents = entity.additionalCacheKeyComponents;
+            const filterComponents = filter.additionalCacheKeyComponents;
+            const entityHasComponents = !!entityComponents && Object.keys(entityComponents).length > 0;
+            const filterHasComponents = !!filterComponents && Object.keys(filterComponents).length > 0;
+            if (entityHasComponents !== filterHasComponents) {
+                return false;
+            }
+            if (entityHasComponents && filterHasComponents) {
+                const entityKeys = Object.keys(entityComponents).sort();
+                const filterKeys = Object.keys(filterComponents).sort();
+                if (entityKeys.length !== filterKeys.length) {
+                    return false;
+                }
+                for (let i = 0; i < entityKeys.length; i++) {
+                    if (entityKeys[i] !== filterKeys[i] ||
+                        entityComponents[entityKeys[i]] !==
+                            filterComponents[filterKeys[i]]) {
+                        return false;
+                    }
+                }
+            }
             return true;
         }
         /**
@@ -2822,7 +2888,7 @@
                         void this.cryptoImpl
                             .removeTokenBindingKey(kid, correlationId)
                             .catch(() => {
-                            this.commonLogger.error("0cx291", correlationId);
+                            this.commonLogger.error(`0cx291 ${kid}`, correlationId);
                             this.performanceClient?.incrementFields({ removeTokenBindingKeyFailure: 1 }, correlationId);
                         });
                     }
@@ -2964,7 +3030,7 @@
         getAccessToken(account, request, tokenKeys, targetRealm) {
             const correlationId = request.correlationId;
             this.commonLogger.trace("1t7hz1", correlationId);
-            const scopes = ScopeSet.createSearchScopes(request.scopes);
+            const scopes = ScopeSet.createSearchScopes(request.scopes, correlationId);
             const authScheme = request.authenticationScheme ||
                 AuthenticationScheme.BEARER;
             /*
@@ -3154,7 +3220,7 @@
                 return null;
             }
             else if (numAppMetadata > 1) {
-                throw createClientAuthError(multipleMatchingAppMetadata);
+                throw createClientAuthError(multipleMatchingAppMetadata, correlationId);
             }
             return appMetadataEntries[0];
         }
@@ -3284,15 +3350,6 @@
         matchRealm(entity, realm) {
             return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
         }
-        /**
-         * helper to match nativeAccountId
-         * @param entity
-         * @param nativeAccountId
-         * @returns boolean indicating the match result
-         */
-        matchNativeAccountId(entity, nativeAccountId) {
-            return !!(entity.nativeAccountId && nativeAccountId === entity.nativeAccountId);
-        }
         /**
          * helper to match loginHint which can be either:
          * 1. login_hint ID token claim
@@ -3336,14 +3393,14 @@
          * @param entity
          * @param target
          */
-        matchTarget(entity, target) {
+        matchTarget(entity, target, correlationId) {
             const isNotAccessTokenCredential = entity.credentialType !== CredentialType.ACCESS_TOKEN &&
                 entity.credentialType !==
                     CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
             if (isNotAccessTokenCredential || !entity.target) {
                 return false;
             }
-            const entityScopeSet = ScopeSet.fromString(entity.target);
+            const entityScopeSet = ScopeSet.fromString(entity.target, correlationId);
             return entityScopeSet.containsScopeSet(target);
         }
         /**
@@ -3397,77 +3454,77 @@
     /** @internal */
     class DefaultStorageClass extends CacheManager {
         async setAccount() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getAccount() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         async setIdTokenCredential() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getIdTokenCredential() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         async setAccessTokenCredential() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getAccessTokenCredential() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         async setRefreshTokenCredential() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getRefreshTokenCredential() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         setAppMetadata() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getAppMetadata() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         setServerTelemetry() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getServerTelemetry() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         setAuthorityMetadata() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getAuthorityMetadata() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getAuthorityMetadataKeys() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         setThrottlingCache() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getThrottlingCache() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         removeItem() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getKeys() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getAccountKeys() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         getTokenKeys() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         generateCredentialKey() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         generateAccountKey() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3481,7 +3538,7 @@
     const PerformanceEventStatus = {
         InProgress: 1};
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3536,7 +3593,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3556,10 +3613,10 @@
     };
     const DEFAULT_NETWORK_IMPLEMENTATION = {
         async sendGetRequestAsync() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
         async sendPostRequestAsync() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         },
     };
     const DEFAULT_LIBRARY_INFO = {
@@ -3588,6 +3645,7 @@
      * @param Configuration
      *
      * @returns Configuration
+     * @internal
      */
     function buildClientConfiguration({ authOptions: userAuthOptions, systemOptions: userSystemOptions, loggerOptions: userLoggerOption, storageInterface: storageImplementation, networkInterface: networkImplementation, cryptoInterface: cryptoImplementation, clientCredentials: clientCredentials, libraryInfo: libraryInfo, telemetry: telemetry, serverTelemetryManager: serverTelemetryManager, persistencePlugin: persistencePlugin, serializableCache: serializableCache, }) {
         const loggerOptions = {
@@ -3599,7 +3657,7 @@
             systemOptions: { ...DEFAULT_SYSTEM_OPTIONS, ...userSystemOptions },
             loggerOptions: loggerOptions,
             storageInterface: storageImplementation ||
-                new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions), new StubPerformanceClient()),
+                new DefaultStorageClass(userAuthOptions.clientId, DEFAULT_CRYPTO_IMPLEMENTATION, new Logger(loggerOptions, name$1, version$1), new StubPerformanceClient()),
             networkInterface: networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
             cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
             clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
@@ -3631,7 +3689,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3658,7 +3716,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3723,7 +3781,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3759,7 +3817,7 @@
      * @param expiresOn
      * @param extExpiresOn
      */
-    function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, refreshOn, tokenType, userAssertionHash, keyId) {
+    function createAccessTokenEntity(homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, base64Decode, correlationId, refreshOn, tokenType, userAssertionHash, keyId, additionalCacheKeyComponents) {
         const atEntity = {
             homeAccountId: homeAccountId,
             credentialType: CredentialType.ACCESS_TOKEN,
@@ -3791,9 +3849,9 @@
             switch (atEntity.tokenType) {
                 case AuthenticationScheme.POP:
                     // Make sure keyId is present and add it to credential
-                    const tokenClaims = extractTokenClaims(accessToken, base64Decode);
+                    const tokenClaims = extractTokenClaims(accessToken, base64Decode, correlationId);
                     if (!tokenClaims?.cnf?.kid) {
-                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt);
+                        throw createClientAuthError(tokenClaimsCnfRequiredForSignedJwt, correlationId);
                     }
                     atEntity.keyId = tokenClaims.cnf.kid;
                     break;
@@ -3801,6 +3859,11 @@
                     atEntity.keyId = keyId;
             }
         }
+        /* Additional cache key components for cache isolation (e.g., FMI path) */
+        if (additionalCacheKeyComponents &&
+            Object.keys(additionalCacheKeyComponents).length > 0) {
+            atEntity.additionalCacheKeyComponents = additionalCacheKeyComponents;
+        }
         return atEntity;
     }
     /**
@@ -3960,6 +4023,7 @@
         return (nowSeconds() +
             AUTHORITY_METADATA_REFRESH_TIME_SECONDS);
     }
+    /** @internal */
     function updateAuthorityEndpointMetadata(authorityMetadata, updatedValues, fromNetwork) {
         authorityMetadata.authorization_endpoint =
             updatedValues.authorization_endpoint;
@@ -3969,6 +4033,7 @@
         authorityMetadata.endpointsFromNetwork = fromNetwork;
         authorityMetadata.jwks_uri = updatedValues.jwks_uri;
     }
+    /** @internal */
     function updateCloudDiscoveryMetadata(authorityMetadata, updatedValues, fromNetwork) {
         authorityMetadata.aliases = updatedValues.aliases;
         authorityMetadata.preferred_cache = updatedValues.preferred_cache;
@@ -3977,12 +4042,13 @@
     }
     /**
      * Returns whether or not the data needs to be refreshed
+     * @internal
      */
     function isAuthorityMetadataExpired(metadata) {
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4053,7 +4119,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4072,7 +4138,7 @@
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const invoke = (callback, eventName, logger, telemetryClient, correlationId) => {
         return (...args) => {
-            logger.trace("1plfzx", correlationId);
+            logger.trace(`1plfzx ${eventName}`, correlationId);
             const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
             if (correlationId) {
                 // Track number of times this API is called in a single request
@@ -4083,11 +4149,11 @@
                 inProgressEvent.end({
                     success: true,
                 });
-                logger.trace("1g8n6a", correlationId);
+                logger.trace(`1g8n6a ${eventName}`, correlationId);
                 return result;
             }
             catch (e) {
-                logger.trace("0cfd8i", correlationId);
+                logger.trace(`0cfd8i ${eventName}`, correlationId);
                 try {
                     logger.trace(JSON.stringify(e), correlationId);
                 }
@@ -4116,7 +4182,7 @@
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId) => {
         return (...args) => {
-            logger.trace("1plfzx", correlationId);
+            logger.trace(`1plfzx ${eventName}`, correlationId);
             const inProgressEvent = telemetryClient.startMeasurement(eventName, correlationId);
             if (correlationId) {
                 // Track number of times this API is called in a single request
@@ -4124,14 +4190,14 @@
             }
             return callback(...args)
                 .then((response) => {
-                logger.trace("1g8n6a", correlationId);
+                logger.trace(`1g8n6a ${eventName}`, correlationId);
                 inProgressEvent.end({
                     success: true,
                 });
                 return response;
             })
                 .catch((e) => {
-                logger.trace("0cfd8i", correlationId);
+                logger.trace(`0cfd8i ${eventName}`, correlationId);
                 try {
                     logger.trace(JSON.stringify(e), correlationId);
                 }
@@ -4146,7 +4212,7 @@
         };
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4207,7 +4273,7 @@
             // Deconstruct request to extract SHR parameters
             const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
             const resourceUrlString = resourceRequestUri
-                ? new UrlString(resourceRequestUri)
+                ? new UrlString(resourceRequestUri, request.correlationId)
                 : undefined;
             const resourceUrlComponents = resourceUrlString?.getUrlComponents();
             return this.cryptoUtils.signJwt({
@@ -4226,7 +4292,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4277,7 +4343,7 @@
      */
     const interruptedUser = "interrupted_user";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4308,12 +4374,11 @@
      * Error thrown when user interaction is required.
      */
     class InteractionRequiredAuthError extends AuthError {
-        constructor(errorCode, errorMessage, subError, timestamp, traceId, correlationId, claims, errorNo) {
-            super(errorCode, errorMessage, subError);
+        constructor(errorCode, correlationId, errorMessage, subError, timestamp, traceId, claims, errorNo) {
+            super(errorCode, correlationId, errorMessage, subError);
             Object.setPrototypeOf(this, InteractionRequiredAuthError.prototype);
             this.timestamp = timestamp || "";
             this.traceId = traceId || "";
-            this.correlationId = correlationId || "";
             this.claims = claims || "";
             this.name = "InteractionRequiredAuthError";
             this.errorNo = errorNo;
@@ -4341,11 +4406,11 @@
     /**
      * Creates an InteractionRequiredAuthError
      */
-    function createInteractionRequiredAuthError(errorCode, errorMessage) {
-        return new InteractionRequiredAuthError(errorCode, errorMessage);
+    function createInteractionRequiredAuthError(errorCode, correlationId, errorMessage) {
+        return new InteractionRequiredAuthError(errorCode, correlationId, errorMessage);
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4355,8 +4420,8 @@
      * Error thrown when there is an error with the server code, for example, unavailability.
      */
     class ServerError extends AuthError {
-        constructor(errorCode, errorMessage, subError, errorNo, status) {
-            super(errorCode, errorMessage, subError);
+        constructor(errorCode, correlationId, errorMessage, subError, errorNo, status) {
+            super(errorCode, correlationId, errorMessage, subError);
             this.name = "ServerError";
             this.errorNo = errorNo;
             this.status = status;
@@ -4364,7 +4429,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4375,9 +4440,10 @@
      * @param cryptoObj
      * @param userState
      * @param meta
+     * @param correlationId
      */
-    function setRequestState(cryptoObj, userState, meta) {
-        const libraryState = generateLibraryState(cryptoObj, meta);
+    function setRequestState(cryptoObj, userState, meta, correlationId) {
+        const libraryState = generateLibraryState(cryptoObj, correlationId, meta);
         return userState
             ? `${libraryState}${RESOURCE_DELIM}${userState}`
             : libraryState;
@@ -4385,11 +4451,12 @@
     /**
      * Generates the state value used by the common library.
      * @param cryptoObj
+     * @param correlationId
      * @param meta
      */
-    function generateLibraryState(cryptoObj, meta) {
+    function generateLibraryState(cryptoObj, correlationId, meta) {
         if (!cryptoObj) {
-            throw createClientAuthError(noCryptoObject);
+            throw createClientAuthError(noCryptoObject, correlationId);
         }
         // Create a state object containing a unique id and the timestamp of the request creation
         const stateObj = {
@@ -4405,13 +4472,14 @@
      * Parses the state into the RequestStateObject, which contains the LibraryState info and the state passed by the user.
      * @param base64Decode
      * @param state
+     * @param correlationId
      */
-    function parseRequestState(base64Decode, state) {
+    function parseRequestState(base64Decode, state, correlationId) {
         if (!base64Decode) {
-            throw createClientAuthError(noCryptoObject);
+            throw createClientAuthError(noCryptoObject, correlationId);
         }
         if (!state) {
-            throw createClientAuthError(invalidState);
+            throw createClientAuthError(invalidState, correlationId);
         }
         try {
             // Split the state between library state and user passed state and decode them separately
@@ -4428,11 +4496,11 @@
             };
         }
         catch (e) {
-            throw createClientAuthError(invalidState);
+            throw createClientAuthError(invalidState, correlationId);
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4467,14 +4535,14 @@
                 const serverErrorNo = serverResponse.error_codes?.length
                     ? serverResponse.error_codes[0]
                     : undefined;
-                const serverError = new ServerError(serverResponse.error, errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
+                const serverError = new ServerError(serverResponse.error || "", serverResponse.correlation_id || "", errString, serverResponse.suberror, serverErrorNo, serverResponse.status);
                 // check if 500 error
                 if (refreshAccessToken &&
                     serverResponse.status &&
                     serverResponse.status >=
                         HTTP_SERVER_ERROR_RANGE_START &&
                     serverResponse.status <= HTTP_SERVER_ERROR_RANGE_END) {
-                    this.logger.warning("16ks7j", correlationId);
+                    this.logger.warning(`16ks7j ${serverError}`, correlationId);
                     // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
                     return;
                     // check if 400 error
@@ -4484,12 +4552,12 @@
                     serverResponse.status >=
                         HTTP_CLIENT_ERROR_RANGE_START &&
                     serverResponse.status <= HTTP_CLIENT_ERROR_RANGE_END) {
-                    this.logger.warning("0g61x3", correlationId);
+                    this.logger.warning(`0g61x3 ${serverError}`, correlationId);
                     // don't throw an exception, but alert the user via a log that the token was unable to be refreshed
                     return;
                 }
                 if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                    throw new InteractionRequiredAuthError(serverResponse.error, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+                    throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
                 }
                 throw serverError;
             }
@@ -4499,24 +4567,16 @@
          * @param serverTokenResponse
          * @param authority
          */
-        async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
+        async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, apiId, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId, additionalCacheKeyComponents) {
             // create an idToken object (not entity)
             let idTokenClaims;
             if (serverTokenResponse.id_token) {
-                idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode);
+                idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
                 // token nonce check (TODO: Add a warning if no nonce is given?)
                 if (authCodePayload && authCodePayload.nonce) {
                     if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                        throw createClientAuthError(nonceMismatch);
-                    }
-                }
-                // token max_age check
-                if (request.maxAge || request.maxAge === 0) {
-                    const authTime = idTokenClaims.auth_time;
-                    if (!authTime) {
-                        throw createClientAuthError(authTimeNotFound);
+                        throw createClientAuthError(nonceMismatch, request.correlationId);
                     }
-                    checkMaxAge(authTime, request.maxAge);
                 }
             }
             // generate homeAccountId
@@ -4524,12 +4584,12 @@
             // save the response tokens
             let requestStateObj;
             if (!!authCodePayload && !!authCodePayload.state) {
-                requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state);
+                requestStateObj = parseRequestState(this.cryptoObj.base64Decode, authCodePayload.state, request.correlationId);
             }
             // Add keyId from request to serverTokenResponse if defined
             serverTokenResponse.key_id =
                 serverTokenResponse.key_id || request.sshKid || undefined;
-            const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
+            const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents);
             let cacheContext;
             try {
                 if (this.persistencePlugin && this.serializableCache) {
@@ -4576,10 +4636,10 @@
          * @param idTokenObj
          * @param authority
          */
-        generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
+        generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, additionalCacheKeyComponents) {
             const env = authority.getPreferredCache();
             if (!env) {
-                throw createClientAuthError(invalidCacheEnvironment);
+                throw createClientAuthError(invalidCacheEnvironment, request.correlationId);
             }
             const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
             // IdToken: non AAD scenarios can have empty realm
@@ -4595,8 +4655,8 @@
             if (serverTokenResponse.access_token) {
                 // If scopes not returned in server response, use request scopes
                 const responseScopes = serverTokenResponse.scope
-                    ? ScopeSet.fromString(serverTokenResponse.scope)
-                    : new ScopeSet(request.scopes || []);
+                    ? ScopeSet.fromString(serverTokenResponse.scope, request.correlationId)
+                    : new ScopeSet(request.scopes || [], request.correlationId);
                 /*
                  * Use timestamp calculated before request
                  * Server may return timestamps as strings, parse to numbers if so.
@@ -4616,7 +4676,7 @@
                     ? reqTimestamp + refreshIn
                     : undefined;
                 // non AAD scenarios can have empty realm
-                cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id);
+                cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant || "", responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, request.correlationId, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, additionalCacheKeyComponents);
                 // Set resource (to be used for MCP scenarios)
                 const resource = request.resource || null;
                 if (resource) {
@@ -4682,14 +4742,14 @@
                     const popTokenGenerator = new PopTokenGenerator(cryptoObj, performanceClient);
                     const { secret, keyId } = cacheRecord.accessToken;
                     if (!keyId) {
-                        throw createClientAuthError(keyIdMissing);
+                        throw createClientAuthError(keyIdMissing, request.correlationId);
                     }
                     accessToken = await popTokenGenerator.signPopToken(secret, keyId, request);
                 }
                 else {
                     accessToken = cacheRecord.accessToken.secret;
                 }
-                responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+                responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target, request.correlationId).asArray();
                 // Access token expiresOn cached in seconds, converting to Date for AuthenticationResult
                 expiresOn = toDateFromSeconds(cacheRecord.accessToken.expiresOn);
                 extExpiresOn = toDateFromSeconds(cacheRecord.accessToken.extendedExpiresOn);
@@ -4707,8 +4767,18 @@
             const tid = idTokenClaims?.tid || "";
             // for hybrid + native bridge enablement, send back the native account Id
             if (serverTokenResponse?.spa_accountid && !!cacheRecord.account) {
+                // Set on deprecated top-level for downgrade compat
                 cacheRecord.account.nativeAccountId =
                     serverTokenResponse?.spa_accountid;
+                // Set on the matching tenant profile (source of truth)
+                const targetTenantId = tid || cacheRecord.account.realm;
+                if (cacheRecord.account.tenantProfiles) {
+                    const matchingProfile = cacheRecord.account.tenantProfiles.find((tp) => tp.tenantId === targetTenantId);
+                    if (matchingProfile) {
+                        matchingProfile.nativeAccountId =
+                            serverTokenResponse.spa_accountid;
+                    }
+                }
             }
             const accountInfo = cacheRecord.account
                 ? updateAccountTenantProfileData(getAccountInfo(cacheRecord.account), undefined, // tenantProfile optional
@@ -4739,6 +4809,7 @@
             };
         }
     }
+    /** @internal */
     function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decode, correlationId, idTokenClaims, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger, performanceClient) {
         logger?.verbose("09jz0t", correlationId);
         /*
@@ -4766,21 +4837,21 @@
                 cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
                 msGraphHost: authCodePayload?.msgraph_host,
                 nativeAccountId: nativeAccountId,
-            }, authority, base64Decode);
+            }, authority, correlationId, base64Decode);
         const tenantProfiles = baseAccount.tenantProfiles || [];
         const tenantId = claimsTenantId || baseAccount.realm;
         if (tenantId &&
             !tenantProfiles.find((tenantProfile) => {
                 return tenantProfile.tenantId === tenantId;
             })) {
-            const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, idTokenClaims);
+            const newTenantProfile = buildTenantProfile(homeAccountId, baseAccount.localAccountId, tenantId, nativeAccountId, idTokenClaims);
             tenantProfiles.push(newTenantProfile);
         }
         baseAccount.tenantProfiles = tenantProfiles;
         return baseAccount;
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4790,12 +4861,12 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
+    async function getClientAssertion(clientAssertion, clientId, tokenEndpoint, fmiPath) {
         if (typeof clientAssertion === "string") {
             return clientAssertion;
         }
@@ -4803,12 +4874,13 @@
             const config = {
                 clientId: clientId,
                 tokenEndpoint: tokenEndpoint,
+                fmiPath: fmiPath,
             };
             return clientAssertion(config);
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4829,7 +4901,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4857,7 +4929,7 @@
                     cacheManager.removeItem(key, correlationId);
                     return;
                 }
-                throw new ServerError(value.errorCodes?.join(" ") || "", value.errorMessage, value.subError);
+                throw new ServerError(value.errorCodes?.join(" ") || "", correlationId, value.errorMessage, value.subError);
             }
         }
         /**
@@ -4915,7 +4987,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4926,7 +4998,7 @@
      */
     class NetworkError extends AuthError {
         constructor(error, httpStatus, responseHeaders) {
-            super(error.errorCode, error.errorMessage, error.subError);
+            super(error.errorCode, error.correlationId, error.errorMessage, error.subError);
             Object.setPrototypeOf(this, NetworkError.prototype);
             this.name = "NetworkError";
             this.error = error;
@@ -4946,7 +5018,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4966,7 +5038,7 @@
                         headers[HeaderNames.CCS_HEADER] = `Oid:${clientInfo.uid}@${clientInfo.utid}`;
                     }
                     catch (e) {
-                        logger.verbose("1qhtee", "");
+                        logger.verbose(`1qhtee ${e}`, "");
                     }
                     break;
                 case CcsCredentialType.UPN:
@@ -4998,6 +5070,7 @@
      * @param queryString
      * @param headers
      * @param thumbprint
+     * @internal
      */
     async function executePostToTokenEndpoint(tokenEndpoint, queryString, headers, thumbprint, correlationId, cacheManager, networkClient, logger, performanceClient, serverTelemetryManager) {
         const response = await sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers }, correlationId, cacheManager, networkClient, logger, performanceClient);
@@ -5019,6 +5092,7 @@
      * @param networkClient - Network module instance
      * @param logger - Logger instance
      * @param performanceClient - Performance client instance
+     * @internal
      */
     async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId, cacheManager, networkClient, logger, performanceClient) {
         ThrottlingUtils.preProcess(cacheManager, thumbprint, correlationId);
@@ -5053,14 +5127,14 @@
                 throw e;
             }
             else {
-                throw createClientAuthError(networkError);
+                throw createClientAuthError(networkError, correlationId);
             }
         }
         ThrottlingUtils.postProcess(cacheManager, thumbprint, response, correlationId);
         return response;
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5072,7 +5146,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5082,7 +5156,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5092,7 +5166,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5119,9 +5193,12 @@
                 try {
                     const localIMDSVersionResponse = await invokeAsync(this.getRegionFromIMDS.bind(this), RegionDiscoveryGetRegionFromIMDS, this.logger, this.performanceClient, this.correlationId)(IMDS_VERSION, options);
                     if (localIMDSVersionResponse.status === HTTP_SUCCESS) {
-                        autodetectedRegionName = localIMDSVersionResponse.body;
-                        regionDiscoveryMetadata.region_source =
-                            RegionDiscoverySources.IMDS;
+                        autodetectedRegionName =
+                            localIMDSVersionResponse.body?.location;
+                        if (autodetectedRegionName) {
+                            regionDiscoveryMetadata.region_source =
+                                RegionDiscoverySources.IMDS;
+                        }
                     }
                     // If the response using the local IMDS version failed, try to fetch the current version of IMDS and retry.
                     if (localIMDSVersionResponse.status ===
@@ -5136,9 +5213,11 @@
                         if (currentIMDSVersionResponse.status ===
                             HTTP_SUCCESS) {
                             autodetectedRegionName =
-                                currentIMDSVersionResponse.body;
-                            regionDiscoveryMetadata.region_source =
-                                RegionDiscoverySources.IMDS;
+                                currentIMDSVersionResponse.body?.location;
+                            if (autodetectedRegionName) {
+                                regionDiscoveryMetadata.region_source =
+                                    RegionDiscoverySources.IMDS;
+                            }
                         }
                     }
                 }
@@ -5162,11 +5241,12 @@
         /**
          * Make the call to the IMDS endpoint
          *
-         * @param imdsEndpointUrl
-         * @returns Promise<NetworkResponse<string>>
+         * @param version
+         * @param options
+         * @returns Promise<NetworkResponse<ImdsComputeResponse>>
          */
         async getRegionFromIMDS(version, options) {
-            return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}&format=text`, options, IMDS_TIMEOUT);
+            return this.networkInterface.sendGetRequestAsync(`${IMDS_ENDPOINT}?api-version=${version}`, options, IMDS_TIMEOUT);
         }
         /**
          * Get the most recent version of the IMDS endpoint available
@@ -5197,7 +5277,7 @@
         },
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5227,7 +5307,7 @@
             this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
         }
         /**
-         * Get {@link AuthorityType}
+         * Get {@link AuthorityType:type}
          * @param authorityUri {@link IUri}
          * @private
          */
@@ -5273,7 +5353,7 @@
          * Sets canonical authority.
          */
         set canonicalAuthority(url) {
-            this._canonicalAuthority = new UrlString(url);
+            this._canonicalAuthority = new UrlString(url, this.correlationId);
             this._canonicalAuthority.validateAsUri();
             this._canonicalAuthorityUrlComponents = null;
         }
@@ -5307,7 +5387,7 @@
                 return this.replacePath(this.metadata.authorization_endpoint);
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         /**
@@ -5318,7 +5398,7 @@
                 return this.replacePath(this.metadata.token_endpoint);
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         get deviceCodeEndpoint() {
@@ -5326,7 +5406,7 @@
                 return this.replacePath(this.metadata.token_endpoint.replace("/token", "/devicecode"));
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         /**
@@ -5336,12 +5416,12 @@
             if (this.discoveryComplete()) {
                 // ROPC policies may not have end_session_endpoint set
                 if (!this.metadata.end_session_endpoint) {
-                    throw createClientAuthError(endSessionEndpointNotSupported);
+                    throw createClientAuthError(endSessionEndpointNotSupported, this.correlationId);
                 }
                 return this.replacePath(this.metadata.end_session_endpoint);
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         /**
@@ -5352,7 +5432,7 @@
                 return this.replacePath(this.metadata.issuer);
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         /**
@@ -5363,7 +5443,7 @@
                 return this.replacePath(this.metadata.jwks_uri);
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         /**
@@ -5390,7 +5470,7 @@
          */
         replacePath(urlString) {
             let endpoint = urlString;
-            const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority);
+            const cachedAuthorityUrl = new UrlString(this.metadata.canonical_authority, this.correlationId);
             const cachedAuthorityUrlComponents = cachedAuthorityUrl.getUrlComponents();
             const cachedAuthorityParts = cachedAuthorityUrlComponents.PathSegments;
             const currentAuthorityParts = this.canonicalAuthorityUrlComponents.PathSegments;
@@ -5398,14 +5478,14 @@
                 let cachedPart = cachedAuthorityParts[index];
                 if (index === 0 &&
                     this.canReplaceTenant(cachedAuthorityUrlComponents)) {
-                    const tenantId = new UrlString(this.metadata.authorization_endpoint).getUrlComponents().PathSegments[0];
+                    const tenantId = new UrlString(this.metadata.authorization_endpoint, this.correlationId).getUrlComponents().PathSegments[0];
                     /**
                      * Check if AAD canonical authority contains tenant domain name, for example "testdomain.onmicrosoft.com",
                      * by comparing its first path segment to the corresponding authorization endpoint path segment, which is
                      * always resolved with tenant id by OIDC.
                      */
                     if (cachedPart !== tenantId) {
-                        this.logger.verbose("1q3g2x", this.correlationId);
+                        this.logger.verbose(`1q3g2x ${cachedPart} ${tenantId}`, this.correlationId);
                         cachedPart = tenantId;
                     }
                 }
@@ -5532,7 +5612,7 @@
             }
             else {
                 // Metadata could not be obtained from the config, cache, network or hardcoded values
-                throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint);
+                throw createClientAuthError(openIdConfigError, this.defaultOpenIdConfigurationEndpoint, this.correlationId);
             }
         }
         /**
@@ -5584,7 +5664,7 @@
          * @param metadataEntity
          */
         isAuthoritySameType(metadataEntity) {
-            const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority);
+            const cachedAuthorityUrl = new UrlString(metadataEntity.canonical_authority, this.correlationId);
             const cachedParts = cachedAuthorityUrl.getUrlComponents().PathSegments;
             return (cachedParts.length ===
                 this.canonicalAuthorityUrlComponents.PathSegments.length);
@@ -5598,7 +5678,7 @@
                     return JSON.parse(this.authorityOptions.authorityMetadata);
                 }
                 catch (e) {
-                    throw createClientConfigurationError(invalidAuthorityMetadata);
+                    throw createClientConfigurationError(invalidAuthorityMetadata, this.correlationId);
                 }
             }
             return null;
@@ -5615,7 +5695,7 @@
              * hardcoded list of metadata
              */
             const openIdConfigurationEndpoint = this.defaultOpenIdConfigurationEndpoint;
-            this.logger.verbose("1y65x6", this.correlationId);
+            this.logger.verbose(`1y65x6 ${openIdConfigurationEndpoint}`, this.correlationId);
             try {
                 const response = await this.networkInterface.sendGetRequestAsync(openIdConfigurationEndpoint, options);
                 const isValidResponse = isOpenIdConfigResponse(response.body);
@@ -5628,7 +5708,7 @@
                 }
             }
             catch (e) {
-                this.logger.verbose("0a9wik", this.correlationId);
+                this.logger.verbose(`0a9wik ${e}`, this.correlationId);
                 return null;
             }
         }
@@ -5654,7 +5734,7 @@
                         RegionDiscoveryOutcomes.CONFIGURED_NO_AUTO_DETECTION;
                     this.regionDiscoveryMetadata.region_used =
                         userConfiguredAzureRegion;
-                    return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion);
+                    return Authority.replaceWithRegionalInformation(metadata, userConfiguredAzureRegion, this.correlationId);
                 }
                 const autodetectedRegionName = await invokeAsync(this.regionDiscovery.detectRegion.bind(this.regionDiscovery), RegionDiscoveryDetectRegion, this.logger, this.performanceClient, this.correlationId)(this.authorityOptions.azureRegionConfiguration
                     ?.environmentRegion, this.regionDiscoveryMetadata);
@@ -5663,7 +5743,7 @@
                         RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_SUCCESSFUL;
                     this.regionDiscoveryMetadata.region_used =
                         autodetectedRegionName;
-                    return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName);
+                    return Authority.replaceWithRegionalInformation(metadata, autodetectedRegionName, this.correlationId);
                 }
                 this.regionDiscoveryMetadata.region_outcome =
                     RegionDiscoveryOutcomes.AUTO_DETECTION_REQUESTED_FAILED;
@@ -5688,13 +5768,15 @@
                 return AuthorityMetadataSource.NETWORK;
             }
             // Metadata could not be obtained from the config, cache, network or hardcoded values
-            throw createClientConfigurationError(untrustedAuthority);
+            throw createClientConfigurationError(untrustedAuthority, this.correlationId);
         }
         updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
             this.logger.verbose("1tpqlr", this.correlationId);
-            this.logger.verbosePii("1fy7uz", this.correlationId);
-            this.logger.verbosePii("08zabj", this.correlationId);
-            this.logger.verbosePii("1o1kv3", this.correlationId);
+            this.logger.verbosePii(`1fy7uz ${this.authorityOptions.knownAuthorities ||
+            NOT_APPLICABLE}`, this.correlationId);
+            this.logger.verbosePii(`08zabj ${this.authorityOptions.authorityMetadata ||
+            NOT_APPLICABLE}`, this.correlationId);
+            this.logger.verbosePii(`1o1kv3 ${metadataEntity.canonical_authority || NOT_APPLICABLE}`, this.correlationId);
             const metadata = this.getCloudDiscoveryMetadataFromConfig();
             if (metadata) {
                 this.logger.verbose("1nakio", this.correlationId);
@@ -5750,7 +5832,7 @@
                 }
                 catch (e) {
                     this.logger.verbose("1wq5tu", this.correlationId);
-                    throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+                    throw createClientConfigurationError(invalidCloudDiscoveryMetadata, this.correlationId);
                 }
             }
             // If cloudDiscoveryMetadata is empty or does not contain the host, check knownAuthorities
@@ -5781,18 +5863,18 @@
                     typedResponseBody =
                         response.body;
                     metadata = typedResponseBody.metadata;
-                    this.logger.verbosePii("1vglyt", this.correlationId);
+                    this.logger.verbosePii(`1vglyt ${typedResponseBody.tenant_discovery_endpoint}`, this.correlationId);
                 }
                 else if (isCloudInstanceDiscoveryErrorResponse(response.body)) {
-                    this.logger.warning("062uto", this.correlationId);
+                    this.logger.warning(`062uto ${response.status}`, this.correlationId);
                     typedResponseBody =
                         response.body;
                     if (typedResponseBody.error === INVALID_INSTANCE) {
                         this.logger.error("1x90tm", this.correlationId);
                         return null;
                     }
-                    this.logger.warning("0wchdm", this.correlationId);
-                    this.logger.warning("1s5mpv", this.correlationId);
+                    this.logger.warning(`0wchdm ${typedResponseBody.error}`, this.correlationId);
+                    this.logger.warning(`1s5mpv ${typedResponseBody.error_description}`, this.correlationId);
                     this.logger.warning("1yhqpw", this.correlationId);
                     metadata = [];
                 }
@@ -5805,10 +5887,11 @@
             }
             catch (error) {
                 if (error instanceof AuthError) {
-                    this.logger.error("0vwhc7", this.correlationId);
+                    this.logger.error(`0vwhc7 ${error.errorCode} ${error.errorMessage}`, this.correlationId);
                 }
                 else {
-                    this.logger.error("0s2z41", this.correlationId);
+                    const typedError = error;
+                    this.logger.error(`0s2z41 ${typedError.name} ${typedError.message}`, this.correlationId);
                 }
                 return null;
             }
@@ -5827,8 +5910,7 @@
             const normalizedHost = host.toLowerCase();
             const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
                 return (authority &&
-                    UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                        normalizedHost);
+                    UrlString.getDomainFromUrl(authority, this.correlationId).toLowerCase() === normalizedHost);
             });
             return matches.length > 0;
         }
@@ -5872,7 +5954,7 @@
                 return this.metadata.preferred_cache;
             }
             else {
-                throw createClientAuthError(endpointResolutionError);
+                throw createClientAuthError(endpointResolutionError, this.correlationId);
             }
         }
         /**
@@ -5915,7 +5997,7 @@
          */
         validateIssuer(issuer) {
             if (!issuer) {
-                throw createClientConfigurationError(issuerValidationFailed);
+                throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
             }
             // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
             let issuerUrl;
@@ -5923,7 +6005,7 @@
                 issuerUrl = new URL(issuer);
             }
             catch {
-                throw createClientConfigurationError(issuerValidationFailed);
+                throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
             }
             const issuerScheme = issuerUrl.protocol;
             const issuerHost = issuerUrl.host;
@@ -5961,7 +6043,7 @@
                 return;
             }
             // issuer validation fails if none of the above rules are satisfied
-            throw createClientConfigurationError(issuerValidationFailed);
+            throw createClientConfigurationError(issuerValidationFailed, this.correlationId);
         }
         /**
          * Rule 1: The issuer scheme + host (and port) match the authority's. Path
@@ -6049,9 +6131,9 @@
          * @param host string
          * @param region string
          */
-        static buildRegionalAuthorityString(host, region, queryString) {
+        static buildRegionalAuthorityString(host, region, correlationId, queryString) {
             // Create and validate a Url string object with the initial authority string
-            const authorityUrlInstance = new UrlString(host);
+            const authorityUrlInstance = new UrlString(host, correlationId);
             authorityUrlInstance.validateAsUri();
             const authorityUrlParts = authorityUrlInstance.getUrlComponents();
             let hostNameAndPort = `${region}.${authorityUrlParts.HostNameAndPort}`;
@@ -6062,7 +6144,7 @@
             const url = UrlString.constructAuthorityUriFromObject({
                 ...authorityUrlInstance.getUrlComponents(),
                 HostNameAndPort: hostNameAndPort,
-            }).urlString;
+            }, correlationId).urlString;
             // Add the query string if a query string was provided
             if (queryString)
                 return `${url}?${queryString}`;
@@ -6074,15 +6156,15 @@
          * @param metadata OpenIdConfigResponse
          * @param azureRegion string
          */
-        static replaceWithRegionalInformation(metadata, azureRegion) {
+        static replaceWithRegionalInformation(metadata, azureRegion, correlationId) {
             const regionalMetadata = { ...metadata };
             regionalMetadata.authorization_endpoint =
-                Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
+                Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion, correlationId);
             regionalMetadata.token_endpoint =
-                Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
+                Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, correlationId);
             if (regionalMetadata.end_session_endpoint) {
                 regionalMetadata.end_session_endpoint =
-                    Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
+                    Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion, correlationId);
             }
             return regionalMetadata;
         }
@@ -6095,9 +6177,9 @@
          *
          * @param authority
          */
-        static transformCIAMAuthority(authority) {
+        static transformCIAMAuthority(authority, correlationId) {
             let ciamAuthority = authority;
-            const authorityUrl = new UrlString(authority);
+            const authorityUrl = new UrlString(authority, correlationId);
             const authorityUrlComponents = authorityUrl.getUrlComponents();
             // check if transformation is needed
             if (authorityUrlComponents.PathSegments.length === 0 &&
@@ -6119,8 +6201,8 @@
     /**
      * Extract tenantId from authority
      */
-    function getTenantFromAuthorityString(authority) {
-        const authorityUrl = new UrlString(authority);
+    function getTenantFromAuthorityString(authority, correlationId) {
+        const authorityUrl = new UrlString(authority, correlationId);
         const authorityUrlComponents = authorityUrl.getUrlComponents();
         /**
          * For credential matching purposes, tenantId is the last path segment of the authority URL:
@@ -6153,7 +6235,7 @@
                 cloudDiscoveryMetadata = JSON.parse(rawCloudDiscoveryMetadata);
             }
             catch (e) {
-                throw createClientConfigurationError(invalidCloudDiscoveryMetadata);
+                throw createClientConfigurationError(invalidCloudDiscoveryMetadata, "");
             }
         }
         return {
@@ -6165,7 +6247,7 @@
         };
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6187,7 +6269,7 @@
      * @internal
      */
     async function createDiscoveredInstance(authorityUri, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
-        const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri));
+        const authorityUriFinal = Authority.transformCIAMAuthority(formatAuthorityUri(authorityUri), correlationId);
         // Initialize authority and perform discovery endpoint check.
         const acquireTokenAuthority = new Authority(authorityUriFinal, networkClient, cacheManager, authorityOptions, logger, correlationId, performanceClient);
         try {
@@ -6195,11 +6277,11 @@
             return acquireTokenAuthority;
         }
         catch (e) {
-            throw createClientAuthError(endpointResolutionError);
+            throw createClientAuthError(endpointResolutionError, correlationId);
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6239,7 +6321,7 @@
          */
         async acquireToken(request, apiId, authCodePayload) {
             if (!request.code) {
-                throw createClientAuthError(requestCannotBeMade);
+                throw createClientAuthError(requestCannotBeMade, request.correlationId);
             }
             // Check for new cloud instance
             if (authCodePayload && authCodePayload.cloud_instance_host_name) {
@@ -6262,7 +6344,7 @@
         getLogoutUri(logoutRequest) {
             // Throw error if logoutRequest is null/undefined
             if (!logoutRequest) {
-                throw createClientConfigurationError(logoutRequestEmpty);
+                throw createClientConfigurationError(logoutRequestEmpty, "");
             }
             const queryString = this.createLogoutUrlQueryString(logoutRequest);
             // Construct logout URI
@@ -6287,7 +6369,7 @@
                     };
                 }
                 catch (e) {
-                    this.logger.verbose("0wznt3", request.correlationId);
+                    this.logger.verbose(`0wznt3 ${e}`, request.correlationId);
                 }
             }
             const headers = createTokenRequestHeaders(this.logger, this.config.systemOptions.preventCorsPreflight, ccsCredential || request.ccsCredential);
@@ -6310,7 +6392,7 @@
             if (!this.includeRedirectUri) {
                 // Just validate
                 if (!request.redirectUri) {
-                    throw createClientConfigurationError(redirectUriEmpty);
+                    throw createClientConfigurationError(redirectUriEmpty, request.correlationId);
                 }
             }
             else {
@@ -6318,7 +6400,7 @@
                 addRedirectUri(parameters, request.redirectUri);
             }
             // Add scope array, parameter builder will add default scopes and dedupe
-            addScopes(parameters, request.scopes, true, this.oidcDefaultScopes);
+            addScopes(parameters, request.scopes, request.correlationId, true, this.oidcDefaultScopes);
             addResource(parameters, request.resource);
             // add code: user set, not validated
             addAuthorizationCode(parameters, request.code);
@@ -6361,7 +6443,7 @@
                     addSshJwk(parameters, request.sshJwk);
                 }
                 else {
-                    throw createClientConfigurationError(missingSshJwk);
+                    throw createClientConfigurationError(missingSshJwk, request.correlationId);
                 }
             }
             let ccsCred = undefined;
@@ -6374,7 +6456,7 @@
                     };
                 }
                 catch (e) {
-                    this.logger.verbose("0wznt3", request.correlationId);
+                    this.logger.verbose(`0wznt3 ${e}`, request.correlationId);
                 }
             }
             else {
@@ -6389,7 +6471,7 @@
                             addCcsOid(parameters, clientInfo);
                         }
                         catch (e) {
-                            this.logger.verbose("1qhtee", request.correlationId);
+                            this.logger.verbose(`1qhtee ${e}`, request.correlationId);
                         }
                         break;
                     case CcsCredentialType.UPN:
@@ -6412,7 +6494,7 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
             return mapToQueryString(parameters);
         }
         /**
@@ -6456,7 +6538,7 @@
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6502,11 +6584,11 @@
         async acquireTokenByRefreshToken(request, apiId) {
             // Cannot renew token if no request object is given.
             if (!request) {
-                throw createClientConfigurationError(tokenRequestEmpty);
+                throw createClientConfigurationError(tokenRequestEmpty, "");
             }
             // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
             if (!request.account) {
-                throw createClientAuthError(noAccountInSilentRequest);
+                throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
             }
             // try checking if FOCI is enabled for the given application
             const isFOCI = this.cacheManager.isAppMetadataFOCI(request.account.environment, request.correlationId);
@@ -6543,7 +6625,7 @@
             // fetches family RT or application RT based on FOCI value
             const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, request.correlationId, undefined);
             if (!refreshToken) {
-                throw createInteractionRequiredAuthError(noTokensFound);
+                throw createInteractionRequiredAuthError(noTokensFound, request.correlationId);
             }
             if (refreshToken.expiresOn) {
                 const offset = request.refreshTokenExpirationOffsetSeconds ||
@@ -6553,7 +6635,7 @@
                     rtOffsetSeconds: offset,
                 }, request.correlationId);
                 if (isTokenExpired(refreshToken.expiresOn, offset)) {
-                    throw createInteractionRequiredAuthError(refreshTokenExpired);
+                    throw createInteractionRequiredAuthError(refreshTokenExpired, request.correlationId);
                 }
             }
             // attach cached RT size to the current measurement
@@ -6607,7 +6689,7 @@
             if (request.redirectUri) {
                 addRedirectUri(parameters, request.redirectUri);
             }
-            addScopes(parameters, request.scopes, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
+            addScopes(parameters, request.scopes, request.correlationId, true, this.config.authOptions.authority.options.OIDCOptions?.defaultScopes);
             addGrantType(parameters, GrantType$1.REFRESH_TOKEN_GRANT);
             addClientInfo(parameters);
             addLibraryInfo(parameters, this.config.libraryInfo);
@@ -6643,7 +6725,7 @@
                     addSshJwk(parameters, request.sshJwk);
                 }
                 else {
-                    throw createClientConfigurationError(missingSshJwk);
+                    throw createClientConfigurationError(missingSshJwk, request.correlationId);
                 }
             }
             if (this.config.systemOptions.preventCorsPreflight &&
@@ -6655,7 +6737,7 @@
                             addCcsOid(parameters, clientInfo);
                         }
                         catch (e) {
-                            this.logger.verbose("1qhtee", request.correlationId);
+                            this.logger.verbose(`1qhtee ${e}`, request.correlationId);
                         }
                         break;
                     case CcsCredentialType.UPN:
@@ -6672,12 +6754,12 @@
                 });
             }
             instrumentBrokerParams(parameters, request.correlationId, this.performanceClient);
-            addClaims(parameters, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
+            addClaims(parameters, request.correlationId, request.claims, this.config.authOptions.clientCapabilities, request.skipBrokerClaims);
             return mapToQueryString(parameters);
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6712,32 +6794,32 @@
             if (request.forceRefresh || !StringUtils.isEmptyObj(request.claims)) {
                 // Must refresh due to present force_refresh flag.
                 this.setCacheOutcome(CacheOutcome.FORCE_REFRESH_OR_CLAIMS, request.correlationId);
-                throw createClientAuthError(tokenRefreshRequired);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
             }
             // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
             if (!request.account) {
-                throw createClientAuthError(noAccountInSilentRequest);
+                throw createClientAuthError(noAccountInSilentRequest, request.correlationId);
             }
             const requestTenantId = request.account.tenantId ||
-                getTenantFromAuthorityString(request.authority);
+                getTenantFromAuthorityString(request.authority, request.correlationId);
             const tokenKeys = this.cacheManager.getTokenKeys();
             const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId);
             if (!cachedAccessToken) {
                 // must refresh due to non-existent access_token
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-                throw createClientAuthError(tokenRefreshRequired);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
             }
             else if (wasClockTurnedBack(cachedAccessToken.cachedAt) ||
                 isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                 // must refresh due to the expires_in value
                 this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
-                throw createClientAuthError(tokenRefreshRequired);
+                throw createClientAuthError(tokenRefreshRequired, request.correlationId);
             }
             else if (request.resource) {
                 // cached access token must have a resource that matches the request resource for MCP scenarios
                 if (cachedAccessToken.resource !== request.resource) {
                     this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
-                    throw createClientAuthError(tokenRefreshRequired);
+                    throw createClientAuthError(tokenRefreshRequired, request.correlationId);
                 }
             }
             else if (cachedAccessToken.refreshOn &&
@@ -6769,7 +6851,7 @@
                 cacheOutcome: cacheOutcome,
             }, correlationId);
             if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
-                this.logger.info("09ingz", correlationId);
+                this.logger.info(`09ingz ${cacheOutcome}`, correlationId);
             }
         }
         /**
@@ -6779,36 +6861,29 @@
         async generateResultFromCacheRecord(cacheRecord, request) {
             let idTokenClaims;
             if (cacheRecord.idToken) {
-                idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode);
-            }
-            // token max_age check
-            if (request.maxAge || request.maxAge === 0) {
-                const authTime = idTokenClaims?.auth_time;
-                if (!authTime) {
-                    throw createClientAuthError(authTimeNotFound);
-                }
-                checkMaxAge(authTime, request.maxAge);
+                idTokenClaims = extractTokenClaims(cacheRecord.idToken.secret, this.config.cryptoInterface.base64Decode, request.correlationId);
             }
             return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, this.performanceClient, idTokenClaims);
         }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     const StubbedNetworkModule = {
+        // Module-level singleton: no per-request correlationId available
         sendGetRequestAsync: () => {
-            return Promise.reject(createClientAuthError(methodNotImplemented));
+            return Promise.reject(createClientAuthError(methodNotImplemented, ""));
         },
         sendPostRequestAsync: () => {
-            return Promise.reject(createClientAuthError(methodNotImplemented));
+            return Promise.reject(createClientAuthError(methodNotImplemented, ""));
         },
     };
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6821,6 +6896,7 @@
      * @param logger
      * @param performanceClient
      * @returns
+     * @internal
      */
     function getStandardAuthorizeRequestParameters(authOptions, request, logger, performanceClient) {
         // generate the correlationId if not set by the user and add
@@ -6833,7 +6909,7 @@
             ...(request.scopes || []),
             ...(request.extraScopesToConsent || []),
         ];
-        addScopes(parameters, requestScopes, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
+        addScopes(parameters, requestScopes, request.correlationId, true, authOptions.authority.options.OIDCOptions?.defaultScopes);
         addResource(parameters, request.resource);
         addRedirectUri(parameters, request.redirectUri);
         addCorrelationId(parameters, correlationId);
@@ -6935,7 +7011,7 @@
         if (request.embeddedClientId) {
             addBrokerParameters(parameters, authOptions.clientId, authOptions.redirectUri);
         }
-        addClaims(parameters, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
+        addClaims(parameters, request.correlationId, request.claims, authOptions.clientCapabilities, request.skipBrokerClaims);
         // If extraQueryParameters includes instance_aware its value will be added when extraQueryParameters are added
         if (authOptions.instanceAware &&
             (!request.extraQueryParameters ||
@@ -6949,6 +7025,7 @@
      * @param authority
      * @param requestParameters
      * @returns
+     * @internal
      */
     function getAuthorizeUrl(authority, requestParameters) {
         const queryString = mapToQueryString(requestParameters);
@@ -6959,13 +7036,14 @@
      * the client to exchange for a token in acquireToken.
      * @param serverParams
      * @param cachedState
+     * @param correlationId
      */
-    function getAuthorizationCodePayload(serverParams, cachedState) {
+    function getAuthorizationCodePayload(serverParams, cachedState, correlationId) {
         // Get code response
-        validateAuthorizationResponse(serverParams, cachedState);
+        validateAuthorizationResponse(serverParams, cachedState, correlationId);
         // throw when there is no auth code in the response
         if (!serverParams.code) {
-            throw createClientAuthError(authorizationCodeMissingFromServerResponse);
+            throw createClientAuthError(authorizationCodeMissingFromServerResponse, correlationId);
         }
         return serverParams;
     }
@@ -6973,12 +7051,13 @@
      * Function which validates server authorization code response.
      * @param serverResponseHash
      * @param requestState
+     * @param correlationId
      */
-    function validateAuthorizationResponse(serverResponse, requestState) {
+    function validateAuthorizationResponse(serverResponse, requestState, correlationId) {
         if (!serverResponse.state || !requestState) {
             throw serverResponse.state
-                ? createClientAuthError(stateNotFound, "Cached State")
-                : createClientAuthError(stateNotFound, "Server State");
+                ? createClientAuthError(stateNotFound, correlationId, "Cached State")
+                : createClientAuthError(stateNotFound, correlationId, "Server State");
         }
         let decodedServerResponseState;
         let decodedRequestState;
@@ -6986,16 +7065,16 @@
             decodedServerResponseState = decodeURIComponent(serverResponse.state);
         }
         catch (e) {
-            throw createClientAuthError(invalidState, serverResponse.state);
+            throw createClientAuthError(invalidState, correlationId, serverResponse.state);
         }
         try {
             decodedRequestState = decodeURIComponent(requestState);
         }
         catch (e) {
-            throw createClientAuthError(invalidState, serverResponse.state);
+            throw createClientAuthError(invalidState, correlationId, serverResponse.state);
         }
         if (decodedServerResponseState !== decodedRequestState) {
-            throw createClientAuthError(stateMismatch);
+            throw createClientAuthError(stateMismatch, correlationId);
         }
         // Check for error
         if (serverResponse.error ||
@@ -7003,9 +7082,9 @@
             serverResponse.suberror) {
             const serverErrorNo = parseServerErrorNo(serverResponse);
             if (isInteractionRequiredError(serverResponse.error, serverResponse.error_description, serverResponse.suberror)) {
-                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.correlation_id || "", serverResponse.claims || "", serverErrorNo);
+                throw new InteractionRequiredAuthError(serverResponse.error || "", serverResponse.correlation_id || correlationId, serverResponse.error_description, serverResponse.suberror, serverResponse.timestamp || "", serverResponse.trace_id || "", serverResponse.claims || "", serverErrorNo);
             }
-            throw new ServerError(serverResponse.error || "", serverResponse.error_description, serverResponse.suberror, serverErrorNo);
+            throw new ServerError(serverResponse.error || "", serverResponse.correlation_id || correlationId, serverResponse.error_description, serverResponse.suberror, serverErrorNo);
         }
     }
     /**
@@ -7031,7 +7110,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7051,10 +7130,10 @@
         if (request.resource &&
             (containsResourceParam(request.extraParameters) ||
                 containsResourceParam(request.extraQueryParameters))) {
-            throw createClientAuthError(misplacedResourceParam);
+            throw createClientAuthError(misplacedResourceParam, request.correlationId || "");
         }
         if (!request.resource) {
-            throw createClientAuthError(resourceParameterRequired);
+            throw createClientAuthError(resourceParameterRequired, request.correlationId || "");
         }
     }
     function containsResourceParam(params) {
@@ -7064,7 +7143,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7074,7 +7153,7 @@
      */
     const unexpectedError = "unexpected_error";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7367,7 +7446,7 @@
         clearNativeBrokerErrorCode() { }
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7377,18 +7456,18 @@
      * Error thrown when there is an error in the client code running on the browser.
      */
     class JoseHeaderError extends AuthError {
-        constructor(errorCode, errorMessage) {
-            super(errorCode, errorMessage);
+        constructor(errorCode, correlationId, errorMessage) {
+            super(errorCode, correlationId, errorMessage);
             this.name = "JoseHeaderError";
             Object.setPrototypeOf(this, JoseHeaderError.prototype);
         }
     }
     /** Returns JoseHeaderError object */
-    function createJoseHeaderError(code) {
-        return new JoseHeaderError(code);
+    function createJoseHeaderError(code, correlationId) {
+        return new JoseHeaderError(code, correlationId);
     }
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7396,7 +7475,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v16.8.0 2026-06-10 */
+    /*! @azure/msal-common v16.10.0 2026-06-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7420,11 +7499,11 @@
         static getShrHeaderString(shrHeaderOptions) {
             // KeyID is required on the SHR header
             if (!shrHeaderOptions.kid) {
-                throw createJoseHeaderError(missingKidError);
+                throw createJoseHeaderError(missingKidError, "");
             }
             // Alg is required on the SHR header
             if (!shrHeaderOptions.alg) {
-                throw createJoseHeaderError(missingAlgError);
+                throw createJoseHeaderError(missingAlgError, "");
             }
             const shrHeader = new JoseHeader({
                 // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
@@ -7831,7 +7910,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.13.0";
+    const version = "5.15.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8467,6 +8546,116 @@
      */
     const WaitForBridgeLateResponse = "waitForBridgeLateResponse";
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    const pkceNotCreated = "pkce_not_created";
+    const earJwkEmpty = "ear_jwk_empty";
+    const earJweEmpty = "ear_jwe_empty";
+    const cryptoNonExistent = "crypto_nonexistent";
+    const emptyNavigateUri = "empty_navigate_uri";
+    const hashEmptyError = "hash_empty_error";
+    const noStateInHash = "no_state_in_hash";
+    const hashDoesNotContainKnownProperties = "hash_does_not_contain_known_properties";
+    const unableToParseState = "unable_to_parse_state";
+    const stateInteractionTypeMismatch = "state_interaction_type_mismatch";
+    const interactionInProgress = "interaction_in_progress";
+    const interactionInProgressCancelled = "interaction_in_progress_cancelled";
+    const popupWindowError = "popup_window_error";
+    const emptyWindowError = "empty_window_error";
+    const userCancelled = "user_cancelled";
+    const redirectBridgeEmptyResponse = "redirect_bridge_empty_response";
+    const redirectInIframe = "redirect_in_iframe";
+    const blockIframeReload = "block_iframe_reload";
+    const blockNestedPopups = "block_nested_popups";
+    const silentLogoutUnsupported = "silent_logout_unsupported";
+    const noAccountError = "no_account_error";
+    const noTokenRequestCacheError = "no_token_request_cache_error";
+    const unableToParseTokenRequestCacheError = "unable_to_parse_token_request_cache_error";
+    const nonBrowserEnvironment = "non_browser_environment";
+    const databaseNotOpen = "database_not_open";
+    const noNetworkConnectivity = "no_network_connectivity";
+    const postRequestFailed = "post_request_failed";
+    const getRequestFailed = "get_request_failed";
+    const failedToParseResponse = "failed_to_parse_response";
+    const cryptoKeyNotFound = "crypto_key_not_found";
+    const authCodeRequired = "auth_code_required";
+    const authCodeOrNativeAccountIdRequired = "auth_code_or_nativeAccountId_required";
+    const spaCodeAndNativeAccountIdPresent = "spa_code_and_nativeAccountId_present";
+    const databaseUnavailable = "database_unavailable";
+    const unableToAcquireTokenFromNativePlatform = "unable_to_acquire_token_from_native_platform";
+    const nativeHandshakeTimeout = "native_handshake_timeout";
+    const nativeExtensionNotInstalled = "native_extension_not_installed";
+    const nativeConnectionNotEstablished = "native_connection_not_established";
+    const uninitializedPublicClientApplication = "uninitialized_public_client_application";
+    const nativePromptNotSupported = "native_prompt_not_supported";
+    const invalidBase64String = "invalid_base64_string";
+    const invalidPopTokenRequest = "invalid_pop_token_request";
+    const failedToBuildHeaders = "failed_to_build_headers";
+    const failedToParseHeaders = "failed_to_parse_headers";
+    const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
+    const timedOut = "timed_out";
+    const emptyResponse = "empty_response";
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function getDefaultErrorMessage(code) {
+        return `See https://aka.ms/msal.js.errors#${code} for details`;
+    }
+    /**
+     * Browser library error class thrown by the MSAL.js library for SPAs
+     */
+    class BrowserAuthError extends AuthError {
+        constructor(errorCode, correlationId, subError) {
+            super(errorCode, correlationId, getDefaultErrorMessage(errorCode), subError);
+            Object.setPrototypeOf(this, BrowserAuthError.prototype);
+            this.name = "BrowserAuthError";
+        }
+    }
+    function createBrowserAuthError(errorCode, correlationId, subError) {
+        return new BrowserAuthError(errorCode, correlationId, subError);
+    }
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
+     * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
+     */
+    /**
+     * Returns a URL-safe plaintext decoded string from b64 encoded input.
+     * @param input
+     */
+    function base64Decode(input) {
+        return new TextDecoder().decode(base64DecToArr(input));
+    }
+    /**
+     * Decodes base64 into Uint8Array
+     * @param base64String
+     */
+    function base64DecToArr(base64String) {
+        let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
+        switch (encodedString.length % 4) {
+            case 0:
+                break;
+            case 2:
+                encodedString += "==";
+                break;
+            case 3:
+                encodedString += "=";
+                break;
+            default:
+                throw createBrowserAuthError(invalidBase64String, "");
+        }
+        const binString = atob(encodedString);
+        return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
+    }
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8651,116 +8840,6 @@
         CacheLookupPolicy.RefreshTokenAndNetwork,
     ];
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    const pkceNotCreated = "pkce_not_created";
-    const earJwkEmpty = "ear_jwk_empty";
-    const earJweEmpty = "ear_jwe_empty";
-    const cryptoNonExistent = "crypto_nonexistent";
-    const emptyNavigateUri = "empty_navigate_uri";
-    const hashEmptyError = "hash_empty_error";
-    const noStateInHash = "no_state_in_hash";
-    const hashDoesNotContainKnownProperties = "hash_does_not_contain_known_properties";
-    const unableToParseState = "unable_to_parse_state";
-    const stateInteractionTypeMismatch = "state_interaction_type_mismatch";
-    const interactionInProgress = "interaction_in_progress";
-    const interactionInProgressCancelled = "interaction_in_progress_cancelled";
-    const popupWindowError = "popup_window_error";
-    const emptyWindowError = "empty_window_error";
-    const userCancelled = "user_cancelled";
-    const redirectBridgeEmptyResponse = "redirect_bridge_empty_response";
-    const redirectInIframe = "redirect_in_iframe";
-    const blockIframeReload = "block_iframe_reload";
-    const blockNestedPopups = "block_nested_popups";
-    const silentLogoutUnsupported = "silent_logout_unsupported";
-    const noAccountError = "no_account_error";
-    const noTokenRequestCacheError = "no_token_request_cache_error";
-    const unableToParseTokenRequestCacheError = "unable_to_parse_token_request_cache_error";
-    const nonBrowserEnvironment = "non_browser_environment";
-    const databaseNotOpen = "database_not_open";
-    const noNetworkConnectivity = "no_network_connectivity";
-    const postRequestFailed = "post_request_failed";
-    const getRequestFailed = "get_request_failed";
-    const failedToParseResponse = "failed_to_parse_response";
-    const cryptoKeyNotFound = "crypto_key_not_found";
-    const authCodeRequired = "auth_code_required";
-    const authCodeOrNativeAccountIdRequired = "auth_code_or_nativeAccountId_required";
-    const spaCodeAndNativeAccountIdPresent = "spa_code_and_nativeAccountId_present";
-    const databaseUnavailable = "database_unavailable";
-    const unableToAcquireTokenFromNativePlatform = "unable_to_acquire_token_from_native_platform";
-    const nativeHandshakeTimeout = "native_handshake_timeout";
-    const nativeExtensionNotInstalled = "native_extension_not_installed";
-    const nativeConnectionNotEstablished = "native_connection_not_established";
-    const uninitializedPublicClientApplication = "uninitialized_public_client_application";
-    const nativePromptNotSupported = "native_prompt_not_supported";
-    const invalidBase64String = "invalid_base64_string";
-    const invalidPopTokenRequest = "invalid_pop_token_request";
-    const failedToBuildHeaders = "failed_to_build_headers";
-    const failedToParseHeaders = "failed_to_parse_headers";
-    const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";
-    const timedOut = "timed_out";
-    const emptyResponse = "empty_response";
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    function getDefaultErrorMessage(code) {
-        return `See https://aka.ms/msal.js.errors#${code} for details`;
-    }
-    /**
-     * Browser library error class thrown by the MSAL.js library for SPAs
-     */
-    class BrowserAuthError extends AuthError {
-        constructor(errorCode, subError) {
-            super(errorCode, getDefaultErrorMessage(errorCode), subError);
-            Object.setPrototypeOf(this, BrowserAuthError.prototype);
-            this.name = "BrowserAuthError";
-        }
-    }
-    function createBrowserAuthError(errorCode, subError) {
-        return new BrowserAuthError(errorCode, subError);
-    }
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Class which exposes APIs to decode base64 strings to plaintext. See here for implementation details:
-     * https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem
-     */
-    /**
-     * Returns a URL-safe plaintext decoded string from b64 encoded input.
-     * @param input
-     */
-    function base64Decode(input) {
-        return new TextDecoder().decode(base64DecToArr(input));
-    }
-    /**
-     * Decodes base64 into Uint8Array
-     * @param base64String
-     */
-    function base64DecToArr(base64String) {
-        let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
-        switch (encodedString.length % 4) {
-            case 0:
-                break;
-            case 2:
-                encodedString += "==";
-                break;
-            case 3:
-                encodedString += "=";
-                break;
-            default:
-                throw createBrowserAuthError(invalidBase64String);
-        }
-        const binString = atob(encodedString);
-        return Uint8Array.from(binString, (m) => m.codePointAt(0) || 0);
-    }
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8849,13 +8928,13 @@
      */
     function validateCryptoAvailable(skipValidateSubtleCrypto) {
         if (!window) {
-            throw createBrowserAuthError(nonBrowserEnvironment);
+            throw createBrowserAuthError(nonBrowserEnvironment, "");
         }
         if (!window.crypto) {
-            throw createBrowserAuthError(cryptoNonExistent);
+            throw createBrowserAuthError(cryptoNonExistent, "");
         }
         if (!skipValidateSubtleCrypto && !window.crypto.subtle) {
-            throw createBrowserAuthError(cryptoNonExistent, SUBTLE_SUBERROR);
+            throw createBrowserAuthError(cryptoNonExistent, "", SUBTLE_SUBERROR);
         }
     }
     /**
@@ -8994,10 +9073,10 @@
     async function decryptEarResponse(earJwk, earJwe) {
         const earJweParts = earJwe.split(".");
         if (earJweParts.length !== 5) {
-            throw createBrowserAuthError(failedToDecryptEarResponse, "jwe_length");
+            throw createBrowserAuthError(failedToDecryptEarResponse, "", "jwe_length");
         }
         const key = await importEarKey(earJwk).catch(() => {
-            throw createBrowserAuthError(failedToDecryptEarResponse, "import_key");
+            throw createBrowserAuthError(failedToDecryptEarResponse, "", "import_key");
         });
         try {
             const header = new TextEncoder().encode(earJweParts[0]);
@@ -9018,7 +9097,7 @@
             return new TextDecoder().decode(decryptedData);
         }
         catch (e) {
-            throw createBrowserAuthError(failedToDecryptEarResponse, "decrypt");
+            throw createBrowserAuthError(failedToDecryptEarResponse, "", "decrypt");
         }
     }
     /**
@@ -9116,14 +9195,14 @@
      * Browser library error class thrown by the MSAL.js library for SPAs
      */
     class BrowserConfigurationAuthError extends AuthError {
-        constructor(errorCode, errorMessage) {
-            super(errorCode, errorMessage);
+        constructor(errorCode, correlationId, errorMessage) {
+            super(errorCode, correlationId, errorMessage);
             this.name = "BrowserConfigurationAuthError";
             Object.setPrototypeOf(this, BrowserConfigurationAuthError.prototype);
         }
     }
-    function createBrowserConfigurationAuthError(errorCode) {
-        return new BrowserConfigurationAuthError(errorCode, getDefaultErrorMessage(errorCode));
+    function createBrowserConfigurationAuthError(errorCode, correlationId) {
+        return new BrowserConfigurationAuthError(errorCode, correlationId, getDefaultErrorMessage(errorCode));
     }
 
     /*
@@ -9179,17 +9258,21 @@
             payload = `${queryContent}${hashContent}`;
             params = new URLSearchParams(payload);
         }
+        /*
+         * Called by the redirect-bridge entry point before any request context exists,
+         * so correlationId is intentionally empty for the throws below.
+         */
         if (!payload || !params) {
-            throw createBrowserAuthError(emptyResponse);
+            throw createBrowserAuthError(emptyResponse, "");
         }
         const state = params.get("state");
         if (!state) {
-            throw createBrowserAuthError(noStateInHash);
+            throw createBrowserAuthError(noStateInHash, "");
         }
-        const { libraryState } = parseRequestState(base64Decode, state);
+        const { libraryState } = parseRequestState(base64Decode, state, "");
         const { id, meta } = libraryState;
         if (!id || !meta) {
-            throw createBrowserAuthError(unableToParseState, "missing_library_state");
+            throw createBrowserAuthError(unableToParseState, "", "missing_library_state");
         }
         return {
             params,
@@ -9269,10 +9352,11 @@
             logger.verbose("BrowserUtils.cancelPendingBridgeResponse - Cancelling pending bridge monitor", correlationId);
             clearTimeout(activeBridgeMonitor.timeoutId);
             activeBridgeMonitor.channel.close();
-            activeBridgeMonitor.reject(createBrowserAuthError(interactionInProgressCancelled));
+            activeBridgeMonitor.reject(createBrowserAuthError(interactionInProgressCancelled, ""));
             activeBridgeMonitor = null;
         }
     }
+    /** @internal */
     async function waitForBridgeResponse(timeoutMs, logger, request, performanceClient, experimentalConfig) {
         return new Promise((resolve, reject) => {
             logger.verbose("BrowserUtils.waitForBridgeResponse - started", request.correlationId);
@@ -9281,7 +9365,7 @@
                 redirectBridgeTimeoutMs: timeoutMs,
                 lateResponseExperimentEnabled: experimentalConfig?.iframeTimeoutTelemetry || false,
             }, correlationId);
-            const { libraryState } = parseRequestState(base64Decode, request.state || "");
+            const { libraryState } = parseRequestState(base64Decode, request.state || "", request.correlationId);
             const channel = new BroadcastChannel(libraryState.id);
             let responseString = undefined;
             let timedOut$1 = false;
@@ -9302,7 +9386,7 @@
                 else {
                     channel.close();
                 }
-                reject(createBrowserAuthError(timedOut, "redirect_bridge_timeout"));
+                reject(createBrowserAuthError(timedOut, "", "redirect_bridge_timeout"));
             }, timeoutMs);
             // Track this monitor so it can be cancelled if needed
             activeBridgeMonitor = {
@@ -9334,7 +9418,7 @@
                     resolve(responseString);
                 }
                 else {
-                    reject(createBrowserAuthError(redirectBridgeEmptyResponse));
+                    reject(createBrowserAuthError(redirectBridgeEmptyResponse, correlationId));
                 }
             };
         });
@@ -9351,8 +9435,8 @@
     /**
      * Gets the homepage url for the current window location.
      */
-    function getHomepage() {
-        const currentUrl = new UrlString(window.location.href);
+    function getHomepage(correlationId) {
+        const currentUrl = new UrlString(window.location.href, correlationId || "");
         const urlComponents = currentUrl.getUrlComponents();
         return `${urlComponents.Protocol}//${urlComponents.HostNameAndPort}/`;
     }
@@ -9364,7 +9448,7 @@
         const isResponseHash = getDeserializedResponse(window.location.hash);
         // return an error if called from the hidden iframe created by the msal js silent calls
         if (isResponseHash && isInIframe()) {
-            throw createBrowserAuthError(blockIframeReload);
+            throw createBrowserAuthError(blockIframeReload, "");
         }
     }
     /**
@@ -9375,7 +9459,7 @@
     function blockRedirectInIframe(allowRedirectInIframe) {
         if (isInIframe() && !allowRedirectInIframe) {
             // If we are not in top frame, we shouldn't redirect. This is also handled by the service.
-            throw createBrowserAuthError(redirectInIframe);
+            throw createBrowserAuthError(redirectInIframe, "");
         }
     }
     /**
@@ -9384,7 +9468,7 @@
     function blockAcquireTokenInPopups() {
         // Popups opened by msal popup APIs are given a name that starts with "msal."
         if (isInPopup()) {
-            throw createBrowserAuthError(blockNestedPopups);
+            throw createBrowserAuthError(blockNestedPopups, "");
         }
     }
     /**
@@ -9393,7 +9477,7 @@
      */
     function blockNonBrowserEnvironment() {
         if (typeof window === "undefined") {
-            throw createBrowserAuthError(nonBrowserEnvironment);
+            throw createBrowserAuthError(nonBrowserEnvironment, "");
         }
     }
     /**
@@ -9402,7 +9486,7 @@
      */
     function blockAPICallsBeforeInitialize(initialized) {
         if (!initialized) {
-            throw createBrowserAuthError(uninitializedPublicClientApplication);
+            throw createBrowserAuthError(uninitializedPublicClientApplication, "");
         }
     }
     /**
@@ -9420,16 +9504,17 @@
         blockAPICallsBeforeInitialize(initialized);
     }
     /**
-     * Helper to validate app enviornment before making redirect request
+     * Helper to validate app environment before making redirect request
      * @param initialized
      * @param config
+     * @internal
      */
     function redirectPreflightCheck(initialized, config) {
         preflightCheck$1(initialized);
         blockRedirectInIframe(config.system.allowRedirectInIframe);
         // Block redirects if memory storage is enabled
         if (config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage) {
-            throw createBrowserConfigurationAuthError(inMemRedirectUnavailable);
+            throw createBrowserConfigurationAuthError(inMemRedirectUnavailable, "");
         }
     }
     /**
@@ -9473,7 +9558,7 @@
             this.navigationClient = navigationClient;
             this.platformAuthProvider = platformAuthProvider;
             this.correlationId = correlationId;
-            this.logger = logger.clone(BrowserConstants.MSAL_SKU, version);
+            this.logger = logger.clone(name, version);
             this.performanceClient = performanceClient;
         }
     }
@@ -9488,7 +9573,7 @@
     function getRedirectUri(requestRedirectUri, clientConfigRedirectUri, logger, correlationId) {
         logger.verbose("getRedirectUri called", correlationId);
         const redirectUri = requestRedirectUri || clientConfigRedirectUri || "";
-        return UrlString.getAbsoluteUrl(redirectUri, getCurrentUri());
+        return UrlString.getAbsoluteUrl(redirectUri, getCurrentUri(), correlationId);
     }
     /**
      * Initializes and returns a ServerTelemetryManager with the provided telemetry configuration.
@@ -9549,13 +9634,13 @@
             ? instanceAwareEQ === "true"
             : config.auth.instanceAware;
         const userAuthority = account && resolvedInstanceAware
-            ? config.auth.authority.replace(UrlString.getDomainFromUrl(resolvedAuthority), account.environment)
+            ? config.auth.authority.replace(UrlString.getDomainFromUrl(resolvedAuthority, correlationId), account.environment)
             : resolvedAuthority;
         // fall back to the authority from config
         const builtAuthority = Authority.generateAuthority(userAuthority, requestAzureCloudOptions || config.auth.azureCloudOptions);
         const discoveredAuthority = await invokeAsync(createDiscoveredInstance, AuthorityFactoryCreateDiscoveredInstance, logger, performanceClient, correlationId)(builtAuthority, config.system.networkClient, browserStorage, authorityOptions, logger, correlationId, performanceClient);
         if (account && !discoveredAuthority.isAlias(account.environment)) {
-            throw createClientConfigurationError(authorityMismatch);
+            throw createClientConfigurationError(authorityMismatch, correlationId);
         }
         return discoveredAuthority;
     }
@@ -9628,10 +9713,10 @@
             if (validatedRequest.authenticationScheme ===
                 AuthenticationScheme.SSH) {
                 if (!request.sshJwk) {
-                    throw createClientConfigurationError(missingSshJwk);
+                    throw createClientConfigurationError(missingSshJwk, "");
                 }
                 if (!request.sshKid) {
-                    throw createClientConfigurationError(missingSshKid);
+                    throw createClientConfigurationError(missingSshKid, "");
                 }
             }
             logger.verbose(`Authentication Scheme set to "'${validatedRequest.authenticationScheme}'" as configured in Auth request`, correlationId);
@@ -9660,7 +9745,7 @@
         if (protocolMode === ProtocolMode.EAR) {
             // Validate that method can only be POST when protocol mode is EAR
             if (requestMethod && requestMethod !== HttpMethod$1.POST) {
-                throw createClientConfigurationError(invalidRequestMethodForEAR);
+                throw createClientConfigurationError(invalidRequestMethodForEAR, "");
             }
             else {
                 httpMethod = HttpMethod$1.POST;
@@ -9725,7 +9810,7 @@
                 if (logoutRequest && logoutRequest.postLogoutRedirectUri) {
                     this.logger.verbose("Setting postLogoutRedirectUri to uri set on logout request", validLogoutRequest.correlationId);
                     validLogoutRequest.postLogoutRedirectUri =
-                        UrlString.getAbsoluteUrl(logoutRequest.postLogoutRedirectUri, getCurrentUri());
+                        UrlString.getAbsoluteUrl(logoutRequest.postLogoutRedirectUri, getCurrentUri(), validLogoutRequest.correlationId);
                 }
                 else if (this.config.auth.postLogoutRedirectUri === null) {
                     this.logger.verbose("postLogoutRedirectUri configured as null and no uri set on request, not passing post logout redirect", validLogoutRequest.correlationId);
@@ -9733,12 +9818,12 @@
                 else if (this.config.auth.postLogoutRedirectUri) {
                     this.logger.verbose("Setting postLogoutRedirectUri to configured uri", validLogoutRequest.correlationId);
                     validLogoutRequest.postLogoutRedirectUri =
-                        UrlString.getAbsoluteUrl(this.config.auth.postLogoutRedirectUri, getCurrentUri());
+                        UrlString.getAbsoluteUrl(this.config.auth.postLogoutRedirectUri, getCurrentUri(), validLogoutRequest.correlationId);
                 }
                 else {
                     this.logger.verbose("Setting postLogoutRedirectUri to current page", validLogoutRequest.correlationId);
                     validLogoutRequest.postLogoutRedirectUri =
-                        UrlString.getAbsoluteUrl(getCurrentUri(), getCurrentUri());
+                        UrlString.getAbsoluteUrl(getCurrentUri(), getCurrentUri(), validLogoutRequest.correlationId);
                 }
             }
             else {
@@ -9851,7 +9936,7 @@
         const browserState = {
             interactionType: interactionType,
         };
-        const state = setRequestState(browserCrypto, (request && request.state) || "", browserState);
+        const state = setRequestState(browserCrypto, (request && request.state) || "", browserState, correlationId);
         const baseRequest = await invokeAsync(initializeBaseRequest, InitializeBaseRequest, logger, performanceClient, correlationId)({ ...request, correlationId: correlationId }, config, performanceClient, logger, correlationId);
         const interactionRequest = {
             ...baseRequest,
@@ -10703,7 +10788,7 @@
          * @param customAuthProxyDomain - The custom auth proxy domain.
          */
         constructor(authority, config, networkInterface, cacheManager, logger, performanceClient, customAuthProxyDomain) {
-            const ciamAuthorityUrl = CustomAuthAuthority.transformCIAMAuthority(authority);
+            const ciamAuthorityUrl = CustomAuthAuthority.transformCIAMAuthority(authority, "");
             const authorityOptions = {
                 protocolMode: config.system.protocolMode,
                 OIDCOptions: config.auth.OIDCOptions,
@@ -12019,7 +12104,7 @@
             this.logger.verbose("Cache cleared", correlationId);
             const postLogoutRedirectUri = this.config.auth.postLogoutRedirectUri;
             if (postLogoutRedirectUri) {
-                const absoluteRedirectUri = UrlString.getAbsoluteUrl(postLogoutRedirectUri, getCurrentUri());
+                const absoluteRedirectUri = UrlString.getAbsoluteUrl(postLogoutRedirectUri, getCurrentUri(), correlationId);
                 this.logger.verbose("Post logout redirect uri is set, redirecting to uri", correlationId);
                 // Redirect to post logout redirect uri
                 await this.navigationClient.navigateExternal(absoluteRedirectUri, {
@@ -13940,7 +14025,7 @@
                     this.dbOpen = true;
                     resolve();
                 });
-                openDB.addEventListener("error", () => reject(createBrowserAuthError(databaseUnavailable)));
+                openDB.addEventListener("error", () => reject(createBrowserAuthError(databaseUnavailable, "")));
             });
         }
         /**
@@ -13971,7 +14056,7 @@
             return new Promise((resolve, reject) => {
                 // TODO: Add timeouts?
                 if (!this.db) {
-                    return reject(createBrowserAuthError(databaseNotOpen));
+                    return reject(createBrowserAuthError(databaseNotOpen, ""));
                 }
                 const transaction = this.db.transaction([this.tableName], "readonly");
                 const objectStore = transaction.objectStore(this.tableName);
@@ -13997,7 +14082,7 @@
             return new Promise((resolve, reject) => {
                 // TODO: Add timeouts?
                 if (!this.db) {
-                    return reject(createBrowserAuthError(databaseNotOpen));
+                    return reject(createBrowserAuthError(databaseNotOpen, ""));
                 }
                 const transaction = this.db.transaction([this.tableName], "readwrite");
                 const objectStore = transaction.objectStore(this.tableName);
@@ -14020,7 +14105,7 @@
             await this.validateDbIsOpen();
             return new Promise((resolve, reject) => {
                 if (!this.db) {
-                    return reject(createBrowserAuthError(databaseNotOpen));
+                    return reject(createBrowserAuthError(databaseNotOpen, ""));
                 }
                 const transaction = this.db.transaction([this.tableName], "readwrite");
                 const objectStore = transaction.objectStore(this.tableName);
@@ -14042,7 +14127,7 @@
             await this.validateDbIsOpen();
             return new Promise((resolve, reject) => {
                 if (!this.db) {
-                    return reject(createBrowserAuthError(databaseNotOpen));
+                    return reject(createBrowserAuthError(databaseNotOpen, ""));
                 }
                 const transaction = this.db.transaction([this.tableName], "readonly");
                 const objectStore = transaction.objectStore(this.tableName);
@@ -14066,7 +14151,7 @@
             await this.validateDbIsOpen();
             return new Promise((resolve, reject) => {
                 if (!this.db) {
-                    return reject(createBrowserAuthError(databaseNotOpen));
+                    return reject(createBrowserAuthError(databaseNotOpen, ""));
                 }
                 const transaction = this.db.transaction([this.tableName], "readonly");
                 const objectStore = transaction.objectStore(this.tableName);
@@ -14391,7 +14476,7 @@
             await this.cache.removeItem(kid, correlationId);
             const keyFound = await this.cache.containsKey(kid, correlationId);
             if (keyFound) {
-                throw createClientAuthError(bindingKeyNotRemoved);
+                throw createClientAuthError(bindingKeyNotRemoved, correlationId);
             }
         }
         /**
@@ -14428,7 +14513,7 @@
             const signJwtMeasurement = this.performanceClient?.startMeasurement(CryptoOptsSignJwt, correlationId);
             const cachedKeyPair = await this.cache.getItem(kid, correlationId || "");
             if (!cachedKeyPair) {
-                throw createBrowserAuthError(cryptoKeyNotFound);
+                throw createBrowserAuthError(cryptoKeyNotFound, correlationId || "");
             }
             // Get public key as JWK
             const publicKeyJwk = await exportJwk(cachedKeyPair.publicKey);
@@ -14584,7 +14669,7 @@
             return "";
         }
         getUserData() {
-            throw createClientAuthError(methodNotImplemented);
+            throw createClientAuthError(methodNotImplemented, "");
         }
         setItem(key, value, cookieLifeDays, secure = true, sameSite = SameSiteOptions.Lax) {
             let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(value)};path=/;SameSite=${sameSite};`;
@@ -14598,8 +14683,8 @@
             }
             document.cookie = cookieStr;
         }
-        async setUserData() {
-            return Promise.reject(createClientAuthError(methodNotImplemented));
+        async setUserData(_key, _value, correlationId) {
+            return Promise.reject(createClientAuthError(methodNotImplemented, correlationId));
         }
         removeItem(key) {
             // Setting expiration to -1 removes it
@@ -14698,7 +14783,7 @@
     class LocalStorage {
         constructor(clientId, logger, performanceClient) {
             if (!window.localStorage) {
-                throw createBrowserConfigurationAuthError(storageNotSupported);
+                throw createBrowserConfigurationAuthError(storageNotSupported, "");
             }
             this.memoryStorage = new MemoryStorage();
             this.initialized = false;
@@ -14755,13 +14840,13 @@
         }
         getUserData(key) {
             if (!this.initialized) {
-                throw createBrowserAuthError(uninitializedPublicClientApplication);
+                throw createBrowserAuthError(uninitializedPublicClientApplication, "");
             }
             return this.memoryStorage.getItem(key);
         }
         async decryptData(key, data, correlationId) {
             if (!this.initialized || !this.encryptionCookie) {
-                throw createBrowserAuthError(uninitializedPublicClientApplication);
+                throw createBrowserAuthError(uninitializedPublicClientApplication, "");
             }
             if (data.id !== this.encryptionCookie.id) {
                 // Data was encrypted with a different key. It must be removed because it is from a previous session.
@@ -14788,7 +14873,7 @@
         }
         async setUserData(key, value, correlationId, timestamp, kmsi) {
             if (!this.initialized || !this.encryptionCookie) {
-                throw createBrowserAuthError(uninitializedPublicClientApplication);
+                throw createBrowserAuthError(uninitializedPublicClientApplication, "");
             }
             if (kmsi) {
                 this.setItem(key, value);
@@ -14986,7 +15071,7 @@
     class SessionStorage {
         constructor() {
             if (!window.sessionStorage) {
-                throw createBrowserConfigurationAuthError(storageNotSupported);
+                throw createBrowserConfigurationAuthError(storageNotSupported, "");
             }
         }
         async initialize() {
@@ -15288,7 +15373,7 @@
                 const rawValue = this.browserStorage.getUserData(key);
                 if (rawValue) {
                     const idToken = JSON.parse(rawValue);
-                    const claims = extractTokenClaims(idToken.secret, base64Decode);
+                    const claims = extractTokenClaims(idToken.secret, base64Decode, "");
                     if (claims) {
                         kmsiMap[idToken.homeAccountId] = isKmsi(claims);
                     }
@@ -15349,12 +15434,12 @@
                     this.performanceClient.incrementFields({ skipITMigrateCount: 1 }, correlationId);
                     continue;
                 }
-                const claims = extractTokenClaims(oldSchemaData.secret, base64Decode);
+                const claims = extractTokenClaims(oldSchemaData.secret, base64Decode, correlationId);
                 const newIdTokenKey = this.generateCredentialKey(oldSchemaData);
                 const currentIdToken = this.getIdTokenCredential(newIdTokenKey, correlationId);
                 const oldTokenHasSignInState = Object.keys(claims).includes("signin_state");
                 const currentTokenHasSignInState = currentIdToken &&
-                    Object.keys(extractTokenClaims(currentIdToken.secret, base64Decode) || {}).includes("signin_state");
+                    Object.keys(extractTokenClaims(currentIdToken.secret, base64Decode, correlationId) || {}).includes("signin_state");
                 /**
                  * Only migrate if:
                  * 1. Token doesn't yet exist in current schema
@@ -15369,7 +15454,7 @@
                         !tenantProfiles.find((tenantProfile) => {
                             return tenantProfile.tenantId === tenantId;
                         })) {
-                        const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, claims);
+                        const newTenantProfile = buildTenantProfile(account.homeAccountId, account.localAccountId, tenantId, account.nativeAccountId, claims);
                         tenantProfiles.push(newTenantProfile);
                     }
                     account.tenantProfiles = tenantProfiles;
@@ -16322,7 +16407,7 @@
             // Get token request from cache and parse as TokenExchangeParameters.
             const encodedTokenRequest = this.getTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, correlationId, true);
             if (!encodedTokenRequest) {
-                throw createBrowserAuthError(noTokenRequestCacheError);
+                throw createBrowserAuthError(noTokenRequestCacheError, "");
             }
             const encodedVerifier = this.getTemporaryCache(TemporaryCacheKeys.VERIFIER, correlationId, true);
             let parsedRequest;
@@ -16336,7 +16421,7 @@
             catch (e) {
                 this.logger.errorPii(`Attempted to parse: '${encodedTokenRequest}'`, correlationId);
                 this.logger.error(`Parsing cached token request threw with error: '${e}'`, correlationId);
-                throw createBrowserAuthError(unableToParseTokenRequestCacheError);
+                throw createBrowserAuthError(unableToParseTokenRequestCacheError, "");
             }
             return [parsedRequest, verifier];
         }
@@ -16396,7 +16481,7 @@
                         this.removeTemporaryItem(key);
                     }
                     else {
-                        throw createBrowserAuthError(interactionInProgress);
+                        throw createBrowserAuthError(interactionInProgress, "");
                     }
                 }
                 // Set new interaction
@@ -16427,7 +16512,7 @@
                 ? toSecondsFromDate(result.expiresOn)
                 : 0, result.extExpiresOn
                 ? toSecondsFromDate(result.extExpiresOn)
-                : 0, base64Decode, undefined, // refreshOn
+                : 0, base64Decode, request.correlationId || "", undefined, // refreshOn
             result.tokenType, undefined, // userAssertionHash
             request.sshKid);
             if (request.resource) {
@@ -16437,7 +16522,7 @@
                 idToken: idTokenEntity,
                 accessToken: accessTokenEntity,
             };
-            return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode)), ApiId.hydrateCache);
+            return this.saveCacheRecord(cacheRecord, result.correlationId, isKmsi(extractTokenClaims(result.idToken, base64Decode, result.correlationId)), ApiId.hydrateCache);
         }
         /**
          * saves a cache record
@@ -16550,7 +16635,7 @@
     class EventHandler {
         constructor(logger) {
             this.eventCallbacks = new Map();
-            this.logger = logger || new Logger({});
+            this.logger = logger || new Logger({}, name, version);
             if (typeof BroadcastChannel !== "undefined") {
                 this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
             }
@@ -16653,16 +16738,16 @@
      * @param browserCrypto
      * @param state
      */
-    function extractBrowserRequestState(browserCrypto, state) {
+    function extractBrowserRequestState(browserCrypto, state, correlationId) {
         if (!state) {
             return null;
         }
         try {
-            const requestStateObj = parseRequestState(browserCrypto.base64Decode, state);
+            const requestStateObj = parseRequestState(browserCrypto.base64Decode, state, correlationId);
             return requestStateObj.libraryState.meta;
         }
         catch (e) {
-            throw createClientAuthError(invalidState);
+            throw createClientAuthError(invalidState, correlationId);
         }
     }
 
@@ -16677,12 +16762,12 @@
             if (!stripLeadingHashOrQuery(responseString)) {
                 // Hash or Query string is empty
                 logger.error(`The request has returned to the redirectUri but a '${responseLocation}' is not present. It's likely that the '${responseLocation}' has been removed or the page has been redirected by code running on the redirectUri page.`, correlationId);
-                throw createBrowserAuthError(hashEmptyError);
+                throw createBrowserAuthError(hashEmptyError, correlationId);
             }
             else {
                 logger.error(`A '${responseLocation}' is present in the iframe but it does not contain known properties. It's likely that the '${responseLocation}' has been replaced by code running on the redirectUri page.`, correlationId);
                 logger.errorPii(`The '${responseLocation}' detected is: '${responseString}'`, correlationId);
-                throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+                throw createBrowserAuthError(hashDoesNotContainKnownProperties, correlationId);
             }
         }
         return serverParams;
@@ -16690,16 +16775,16 @@
     /**
      * Returns the interaction type that the response object belongs to
      */
-    function validateInteractionType(response, browserCrypto, interactionType) {
+    function validateInteractionType(response, browserCrypto, interactionType, correlationId) {
         if (!response.state) {
-            throw createBrowserAuthError(noStateInHash);
+            throw createBrowserAuthError(noStateInHash, correlationId);
         }
-        const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
+        const platformStateObj = extractBrowserRequestState(browserCrypto, response.state, correlationId);
         if (!platformStateObj) {
-            throw createBrowserAuthError(unableToParseState);
+            throw createBrowserAuthError(unableToParseState, correlationId);
         }
         if (platformStateObj.interactionType !== interactionType) {
-            throw createBrowserAuthError(stateInteractionTypeMismatch);
+            throw createBrowserAuthError(stateInteractionTypeMismatch, correlationId);
         }
     }
 
@@ -16725,13 +16810,13 @@
         async handleCodeResponse(response, request, apiId) {
             let authCodeResponse;
             try {
-                authCodeResponse = getAuthorizationCodePayload(response, request.state);
+                authCodeResponse = getAuthorizationCodePayload(response, request.state, request.correlationId);
             }
             catch (e) {
                 if (e instanceof ServerError &&
                     e.subError === userCancelled) {
                     // Translate server error caused by user closing native prompt to corresponding first class MSAL error
-                    throw createBrowserAuthError(userCancelled);
+                    throw createBrowserAuthError(userCancelled, request.correlationId);
                 }
                 else {
                     throw e;
@@ -16816,8 +16901,8 @@
      */
     const INVALID_METHOD_ERROR = -2147186943;
     class NativeAuthError extends AuthError {
-        constructor(errorCode, description, ext) {
-            super(errorCode, description || getDefaultErrorMessage(errorCode));
+        constructor(errorCode, correlationId, description, ext) {
+            super(errorCode, correlationId, description || getDefaultErrorMessage(errorCode));
             Object.setPrototypeOf(this, NativeAuthError.prototype);
             this.name = "NativeAuthError";
             this.ext = ext;
@@ -16852,22 +16937,32 @@
      * @param ext
      * @returns
      */
-    function createNativeAuthError(code, description, ext) {
+    function createNativeAuthError(code, correlationId, description, ext) {
+        let error;
         if (ext && ext.status) {
             switch (ext.status) {
                 case ACCOUNT_UNAVAILABLE:
-                    return createInteractionRequiredAuthError(nativeAccountUnavailable, getDefaultErrorMessage(code));
+                    error = createInteractionRequiredAuthError(nativeAccountUnavailable, correlationId, getDefaultErrorMessage(code));
+                    break;
                 case USER_INTERACTION_REQUIRED:
-                    return new InteractionRequiredAuthError(code, description);
+                    error = new InteractionRequiredAuthError(code, correlationId, description);
+                    break;
                 case USER_CANCEL:
-                    return createBrowserAuthError(userCancelled);
+                    error = createBrowserAuthError(userCancelled, correlationId);
+                    break;
                 case NO_NETWORK:
-                    return createBrowserAuthError(noNetworkConnectivity);
+                    error = createBrowserAuthError(noNetworkConnectivity, correlationId);
+                    break;
                 case UI_NOT_ALLOWED:
-                    return createInteractionRequiredAuthError(uiNotAllowed);
+                    error = createInteractionRequiredAuthError(uiNotAllowed, correlationId);
+                    break;
+                default:
+                    error = new NativeAuthError(code, correlationId, description, ext);
             }
+            return error;
         }
-        return new NativeAuthError(code, description, ext);
+        error = new NativeAuthError(code, correlationId, description, ext);
+        return error;
     }
 
     /*
@@ -17023,7 +17118,7 @@
             return {
                 authority: request.authority,
                 correlationId: this.correlationId,
-                scopes: ScopeSet.fromString(request.scope).asArray(),
+                scopes: ScopeSet.fromString(request.scope, this.correlationId).asArray(),
                 account: cachedAccount,
                 forceRefresh: false,
             };
@@ -17037,21 +17132,21 @@
         async acquireTokensFromCache(nativeAccountId, request) {
             if (!nativeAccountId) {
                 this.logger.warning("NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided", this.correlationId);
-                throw createClientAuthError(noAccountFound);
+                throw createClientAuthError(noAccountFound, this.correlationId);
             }
             // fetch the account from browser cache
             const account = this.browserStorage.getBaseAccountInfo({
                 nativeAccountId,
             }, this.correlationId);
             if (!account) {
-                throw createClientAuthError(noAccountFound);
+                throw createClientAuthError(noAccountFound, this.correlationId);
             }
             // leverage silent flow for cached tokens retrieval
             try {
                 const silentRequest = this.createSilentCacheRequest(request, account);
                 const result = await this.silentCacheClient.acquireToken(silentRequest);
                 const idToken = this.browserStorage.getIdToken(account, this.correlationId, this.browserStorage.getTokenKeys(), account.tenantId);
-                const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode);
+                const idTokenClaims = extractTokenClaims(idToken?.secret || "", base64Decode, this.correlationId);
                 const fullAccount = updateAccountTenantProfileData(account, undefined, // tenantProfile optional
                 idTokenClaims, idToken?.secret);
                 return {
@@ -17095,7 +17190,7 @@
                 noHistory: false,
             };
             const redirectUri = navigateToLoginRequestUrl
-                ? UrlString.getAbsoluteUrl(request.redirectStartPage || window.location.href, getCurrentUri())
+                ? UrlString.getAbsoluteUrl(request.redirectStartPage || window.location.href, getCurrentUri(), this.correlationId)
                 : getRedirectUri(request.redirectUri, this.config.auth.redirectUri, this.logger, this.correlationId);
             rootMeasurement.end({ success: true });
             await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
@@ -17154,7 +17249,7 @@
         async handleNativeResponse(response, request, reqTimestamp) {
             this.logger.trace("NativeInteractionClient - handleNativeResponse called.", this.correlationId);
             // generate identifiers
-            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode);
+            const idTokenClaims = extractTokenClaims(response.id_token, base64Decode, this.correlationId);
             const homeAccountIdentifier = this.createHomeAccountIdentifier(response, idTokenClaims);
             const cachedhomeAccountId = this.browserStorage.getAccountInfoFilteredBy({
                 nativeAccountId: request.accountId,
@@ -17167,7 +17262,7 @@
             else if (homeAccountIdentifier !== cachedhomeAccountId &&
                 response.account.id !== request.accountId) {
                 // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-                throw createNativeAuthError(userSwitch);
+                throw createNativeAuthError(userSwitch, this.correlationId);
             }
             // Get the preferred_cache domain for the given authority
             const authority = await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, request.authority);
@@ -17203,8 +17298,8 @@
          */
         generateScopes(requestScopes, responseScopes) {
             return responseScopes
-                ? ScopeSet.fromString(responseScopes)
-                : ScopeSet.fromString(requestScopes);
+                ? ScopeSet.fromString(responseScopes, this.correlationId)
+                : ScopeSet.fromString(requestScopes, this.correlationId);
         }
         /**
          * If PoP token is requesred, records the PoP token if returned from the WAM, else generates one in the browser
@@ -17237,7 +17332,7 @@
                  * PopTokenGenerator to query the full key for signing
                  */
                 if (!request.keyId) {
-                    throw createClientAuthError(keyIdMissing);
+                    throw createClientAuthError(keyIdMissing, this.correlationId);
                 }
                 return popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters);
             }
@@ -17274,6 +17369,12 @@
              */
             if (accountInfo.nativeAccountId !== response.account.id) {
                 accountInfo.nativeAccountId = response.account.id;
+                // Also update the matching tenant profile (source of truth)
+                const targetTenantId = tid || accountInfo.tenantId;
+                const tenantProfile = accountInfo.tenantProfiles?.get(targetTenantId);
+                if (tenantProfile) {
+                    tenantProfile.nativeAccountId = response.account.id;
+                }
             }
             // generate PoP token as needed
             const responseAccessToken = await this.generatePopAccessToken(response, request);
@@ -17330,7 +17431,7 @@
                     : response.expires_in) || 0;
             const tokenExpirationSeconds = reqTimestamp + expiresIn;
             const responseScopes = this.generateScopes(response.scope, request.scope);
-            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
+            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, environment, response.access_token, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, request.correlationId, undefined, request.tokenType, undefined, request.keyId);
             // save idtoken credential in configured browser storage
             if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
                 await this.browserStorage.setIdTokenCredential(cachedIdToken, this.correlationId, isKmsi(idTokenClaims));
@@ -17413,11 +17514,9 @@
                 : this.config.auth.clientCapabilities;
             // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
             const { scopes, claims, ...remainingProperties } = request;
-            const scopeSet = new ScopeSet(scopes || []);
+            const scopeSet = new ScopeSet(scopes || [], this.correlationId);
             scopeSet.appendScopes(OIDC_DEFAULT_SCOPES);
-            const mergedClaims = configClaims && configClaims.length
-                ? addClientCapabilitiesToClaims(claims, configClaims)
-                : claims;
+            const mergedClaims = buildMergedClaims(claims, configClaims?.length ? configClaims : undefined);
             const validatedRequest = {
                 ...remainingProperties,
                 claims: mergedClaims,
@@ -17438,7 +17537,7 @@
             };
             // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
             if (validatedRequest.signPopToken && !!request.popKid) {
-                throw createBrowserAuthError(invalidPopTokenRequest);
+                throw createBrowserAuthError(invalidPopTokenRequest, this.correlationId);
             }
             this.handleExtraBrokerParams(validatedRequest);
             validatedRequest.extraParameters =
@@ -17481,7 +17580,7 @@
                 await getDiscoveredAuthority(this.config, this.correlationId, this.performanceClient, this.browserStorage, this.logger, requestAuthority, azureCloudOptions, undefined, // requestExtraQueryParameters
                 account);
             }
-            const canonicalAuthority = new UrlString(requestAuthority);
+            const canonicalAuthority = new UrlString(requestAuthority, this.correlationId);
             canonicalAuthority.validateAsUri();
             return canonicalAuthority;
         }
@@ -17507,7 +17606,7 @@
                     return prompt;
                 default:
                     this.logger.trace(`initializePlatformRequest: prompt = '${prompt}' is not compatible with native flow`, this.correlationId);
-                    throw createBrowserAuthError(nativePromptNotSupported);
+                    throw createBrowserAuthError(nativePromptNotSupported, this.correlationId);
             }
         }
         /**
@@ -17663,7 +17762,7 @@
      */
     async function getAuthCodeRequestUrl(config, authority, request, logger, performanceClient) {
         if (!request.codeChallenge) {
-            throw createClientConfigurationError(pkceParamsMissing);
+            throw createClientConfigurationError(pkceParamsMissing, request.correlationId);
         }
         const parameters = await invokeAsync(getStandardParameters, GetStandardParams, logger, performanceClient, request.correlationId)(config, authority, request, logger, performanceClient);
         addResponseType(parameters, OAuthResponseType.CODE);
@@ -17680,7 +17779,7 @@
      */
     async function getEARForm(frame, config, authority, request, logger, performanceClient) {
         if (!request.earJwk) {
-            throw createBrowserAuthError(earJwkEmpty);
+            throw createBrowserAuthError(earJwkEmpty, request.correlationId);
         }
         const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
         addResponseType(parameters, OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN);
@@ -17754,11 +17853,11 @@
     async function handleResponsePlatformBroker(request, accountId, apiId, config, browserStorage, nativeStorage, eventHandler, logger, performanceClient, platformAuthProvider) {
         logger.verbose("Account id found, calling WAM for token", request.correlationId);
         if (!platformAuthProvider) {
-            throw createBrowserAuthError(nativeConnectionNotEstablished);
+            throw createBrowserAuthError(nativeConnectionNotEstablished, request.correlationId);
         }
         const browserCrypto = new CryptoOps(logger, performanceClient);
         const nativeInteractionClient = new PlatformAuthInteractionClient(config, browserStorage, browserCrypto, logger, eventHandler, config.system.navigationClient, apiId, performanceClient, platformAuthProvider, accountId, nativeStorage, request.correlationId);
-        const { userRequestState } = parseRequestState(browserCrypto.base64Decode, request.state);
+        const { userRequestState } = parseRequestState(browserCrypto.base64Decode, request.state, request.correlationId);
         return invokeAsync(nativeInteractionClient.acquireToken.bind(nativeInteractionClient), NativeInteractionClientAcquireToken, logger, performanceClient, request.correlationId)({
             ...request,
             state: userRequestState,
@@ -17816,12 +17915,12 @@
         // Instrument clientdata telemetry fields from the authorize response
         instrumentClientData(response, request.correlationId, performanceClient);
         // Validate state & check response for errors
-        validateAuthorizationResponse(response, request.state);
+        validateAuthorizationResponse(response, request.state, request.correlationId);
         if (!response.ear_jwe) {
-            throw createBrowserAuthError(earJweEmpty);
+            throw createBrowserAuthError(earJweEmpty, request.correlationId);
         }
         if (!request.earJwk) {
-            throw createBrowserAuthError(earJwkEmpty);
+            throw createBrowserAuthError(earJwkEmpty, request.correlationId);
         }
         const decryptedData = JSON.parse(await invokeAsync(decryptEarResponse, DecryptEarResponse, logger, performanceClient, request.correlationId)(request.earJwk, response.ear_jwe));
         if (decryptedData.accountId) {
@@ -17878,7 +17977,7 @@
             return pkceCodeVerifierB64;
         }
         catch (e) {
-            throw createBrowserAuthError(pkceNotCreated);
+            throw createBrowserAuthError(pkceNotCreated, correlationId);
         }
     }
     /**
@@ -17893,7 +17992,7 @@
             return urlEncodeArr(new Uint8Array(pkceHashedCodeVerifier));
         }
         catch (e) {
-            throw createBrowserAuthError(pkceNotCreated);
+            throw createBrowserAuthError(pkceNotCreated, correlationId);
         }
     }
 
@@ -17932,7 +18031,7 @@
             }
             return new Promise((resolve, reject) => {
                 setTimeout(() => {
-                    reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+                    reject(createBrowserAuthError(timedOut, "", "failed_to_redirect"));
                 }, options.timeout);
             });
         }
@@ -17966,7 +18065,7 @@
             catch (e) {
                 throw createNetworkError(createBrowserAuthError(window.navigator.onLine
                     ? getRequestFailed
-                    : noNetworkConnectivity), undefined, undefined, e);
+                    : noNetworkConnectivity, ""), undefined, undefined, e);
             }
             responseHeaders = getHeaderDict(response.headers);
             try {
@@ -17978,7 +18077,7 @@
                 };
             }
             catch (e) {
-                throw createNetworkError(createBrowserAuthError(failedToParseResponse), responseStatus, responseHeaders, e);
+                throw createNetworkError(createBrowserAuthError(failedToParseResponse, ""), responseStatus, responseHeaders, e);
             }
         }
         /**
@@ -18003,7 +18102,7 @@
             catch (e) {
                 throw createNetworkError(createBrowserAuthError(window.navigator.onLine
                     ? postRequestFailed
-                    : noNetworkConnectivity), undefined, undefined, e);
+                    : noNetworkConnectivity, ""), undefined, undefined, e);
             }
             responseHeaders = getHeaderDict(response.headers);
             try {
@@ -18015,7 +18114,7 @@
                 };
             }
             catch (e) {
-                throw createNetworkError(createBrowserAuthError(failedToParseResponse), responseStatus, responseHeaders, e);
+                throw createNetworkError(createBrowserAuthError(failedToParseResponse, ""), responseStatus, responseHeaders, e);
             }
         }
     }
@@ -18036,7 +18135,7 @@
             return headers;
         }
         catch (e) {
-            throw createNetworkError(createBrowserAuthError(failedToBuildHeaders), undefined, undefined, e);
+            throw createNetworkError(createBrowserAuthError(failedToBuildHeaders, ""), undefined, undefined, e);
         }
     }
     /**
@@ -18053,7 +18152,7 @@
             return headerDict;
         }
         catch (e) {
-            throw createBrowserAuthError(failedToParseHeaders);
+            throw createBrowserAuthError(failedToParseHeaders, "");
         }
     }
 
@@ -18156,14 +18255,14 @@
         // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
         if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
             userInputAuth?.OIDCOptions) {
-            const logger = new Logger(providedSystemOptions.loggerOptions);
-            logger.warning(JSON.stringify(createClientConfigurationError(cannotSetOIDCOptions)), "");
+            const logger = new Logger(providedSystemOptions.loggerOptions, name, version);
+            logger.warning(JSON.stringify(createClientConfigurationError(cannotSetOIDCOptions, "")), "");
         }
         // Throw an error if user has set allowPlatformBroker to true with OIDC protocol mode
         if (userInputSystem?.protocolMode &&
             userInputSystem.protocolMode === ProtocolMode.OIDC &&
             providedSystemOptions?.allowPlatformBroker) {
-            throw createClientConfigurationError(cannotAllowPlatformBroker);
+            throw createClientConfigurationError(cannotAllowPlatformBroker, "");
         }
         const overlayedConfig = {
             auth: {
@@ -18287,7 +18386,7 @@
                         extensionHandshakeTimedOut: true,
                         success: false,
                     });
-                    reject(createBrowserAuthError(nativeHandshakeTimeout));
+                    reject(createBrowserAuthError(nativeHandshakeTimeout, ""));
                     this.handshakeResolvers.delete(req.responseId);
                 }, this.handshakeTimeoutMs); // Use a reasonable timeout in milliseconds here
             });
@@ -18333,7 +18432,7 @@
                     success: false,
                     extensionInstalled: false,
                 });
-                handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled));
+                handshakeResolver.reject(createBrowserAuthError(nativeExtensionNotInstalled, ""));
             }
         }
         /**
@@ -18356,19 +18455,19 @@
                     this.logger.trace(`'${this.platformAuthType}' - Received response from browser extension`, correlationId);
                     this.logger.tracePii(`'${this.platformAuthType}' - Received response from browser extension: '${JSON.stringify(response)}'`, correlationId);
                     if (response.status !== "Success") {
-                        resolver.reject(createNativeAuthError(response.code, response.description, response.ext));
+                        resolver.reject(createNativeAuthError(response.code, correlationId, response.description, response.ext));
                     }
                     else if (response.result) {
                         if (response.result["code"] &&
                             response.result["description"]) {
-                            resolver.reject(createNativeAuthError(response.result["code"], response.result["description"], response.result["ext"]));
+                            resolver.reject(createNativeAuthError(response.result["code"], correlationId, response.result["description"], response.result["ext"]));
                         }
                         else {
                             resolver.resolve(response.result);
                         }
                     }
                     else {
-                        throw createAuthError(unexpectedError, "Event does not contain result.");
+                        throw createAuthError(unexpectedError, correlationId, "Event does not contain result.");
                     }
                     this.resolvers.delete(request.responseId);
                 }
@@ -18417,7 +18516,7 @@
                 return response;
             }
             else {
-                throw createAuthError(unexpectedError, "Response missing expected properties.");
+                throw createAuthError(unexpectedError, "", "Response missing expected properties.");
             }
         }
         /**
@@ -18541,7 +18640,7 @@
                         errorResponse.error &&
                         errorResponse.error.code) {
                         this.logger.trace(`'${this.platformAuthType}' - platform broker returned error response`, correlationId);
-                        throw createNativeAuthError(errorResponse.error.code, errorResponse.error.description, {
+                        throw createNativeAuthError(errorResponse.error.code, correlationId, errorResponse.error.description, {
                             error: parseInt(errorResponse.error.errorCode),
                             protocol_error: errorResponse.error.protocolError,
                             status: errorResponse.error.status,
@@ -18550,7 +18649,7 @@
                     }
                 }
             }
-            throw createAuthError(unexpectedError, "Response missing expected properties.");
+            throw createAuthError(unexpectedError, correlationId, "Response missing expected properties.");
         }
         convertToPlatformBrokerResponse(response, correlationId) {
             this.logger.trace(`'${this.platformAuthType}' - convertToNativeResponse called`, correlationId);
@@ -18634,7 +18733,7 @@
         // throw an error if allowPlatformBroker is not enabled and allowPlatformBrokerWithDOM is enabled
         if (!config.system.allowPlatformBroker &&
             config.experimental.allowPlatformBrokerWithDOM) {
-            throw createClientConfigurationError(invalidPlatformBrokerConfiguration);
+            throw createClientConfigurationError(invalidPlatformBrokerConfiguration, "");
         }
         if (!config.system.allowPlatformBroker) {
             logger.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false", correlationId);
@@ -18812,7 +18911,7 @@
                 // Close the synchronous popup if an error is thrown before the window unload event is registered
                 popupParams.popup?.close();
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 throw e;
@@ -18903,7 +19002,7 @@
                                 timeout: this.config.system.redirectNavigationTimeout,
                                 noHistory: false,
                             };
-                            const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, getCurrentUri());
+                            const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, getCurrentUri(), this.correlationId);
                             await this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
                         }
                         popupParams.popup?.close();
@@ -18913,7 +19012,7 @@
                 // Redirect bridge requires "state" param to work properly
                 validRequest.state = setRequestState(this.browserCrypto, validRequest.state || "", {
                     interactionType: InteractionType.Popup,
-                });
+                }, validRequest.correlationId);
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validRequest);
                 this.eventHandler.emitEvent(EventType.LOGOUT_SUCCESS, validRequest.correlationId, InteractionType.Popup, validRequest);
@@ -18929,7 +19028,7 @@
                         timeout: this.config.system.redirectNavigationTimeout,
                         noHistory: false,
                     };
-                    const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, getCurrentUri());
+                    const absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, getCurrentUri(), this.correlationId);
                     this.logger.verbose("Redirecting main window to url specified in the request", this.correlationId);
                     this.logger.verbosePii(`Redirecting main window to: '${absoluteUrl}'`, this.correlationId);
                     await this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
@@ -18942,7 +19041,7 @@
                 // Close the synchronous popup if an error is thrown before the window unload event is registered
                 popupParams.popup?.close();
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 this.eventHandler.emitEvent(EventType.LOGOUT_FAILURE, this.correlationId, InteractionType.Popup, null, e);
@@ -18965,7 +19064,7 @@
             else {
                 // Throw error if request URL is empty.
                 this.logger.error("Navigate url is empty", this.correlationId);
-                throw createBrowserAuthError(emptyNavigateUri);
+                throw createBrowserAuthError(emptyNavigateUri, this.correlationId);
             }
         }
         /**
@@ -18997,7 +19096,7 @@
                 }
                 // Popup will be null if popups are blocked
                 if (!popupWindow) {
-                    throw createBrowserAuthError(emptyWindowError);
+                    throw createBrowserAuthError(emptyWindowError, this.correlationId);
                 }
                 try {
                     popupWindow.document.title = "Microsoft Authentication";
@@ -19020,7 +19119,7 @@
             }
             catch (e) {
                 this.logger.error(`error opening popup '${e.message}'`, this.correlationId);
-                throw createBrowserAuthError(popupWindowError);
+                throw createBrowserAuthError(popupWindowError, this.correlationId);
             }
         }
         /**
@@ -19150,7 +19249,7 @@
             }
             catch (e) {
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                 }
                 window.removeEventListener("pageshow", handleBackButton);
                 throw e;
@@ -19191,7 +19290,7 @@
             }
             catch (e) {
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 throw e;
@@ -19217,7 +19316,7 @@
             form.submit();
             return new Promise((resolve, reject) => {
                 setTimeout(() => {
-                    reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+                    reject(createBrowserAuthError(timedOut, "", "failed_to_redirect"));
                 }, this.config.system.redirectNavigationTimeout);
             });
         }
@@ -19234,7 +19333,7 @@
             form.submit();
             return new Promise((resolve, reject) => {
                 setTimeout(() => {
-                    reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+                    reject(createBrowserAuthError(timedOut, "", "failed_to_redirect"));
                 }, this.config.system.redirectNavigationTimeout);
             });
         }
@@ -19306,7 +19405,7 @@
                     let processHashOnRedirect = true;
                     if (!loginRequestUrl) {
                         // Redirect to home page if login request url is empty
-                        const homepage = getHomepage();
+                        const homepage = getHomepage(this.correlationId);
                         // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                         this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
                         this.logger.warning("Unable to get valid login request url from cache, redirecting to home page", this.correlationId);
@@ -19328,7 +19427,7 @@
             }
             catch (e) {
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 throw e;
@@ -19358,7 +19457,7 @@
             let response = getDeserializedResponse(responseString);
             if (response) {
                 try {
-                    validateInteractionType(response, this.browserCrypto, InteractionType.Redirect);
+                    validateInteractionType(response, this.browserCrypto, InteractionType.Redirect, this.correlationId);
                 }
                 catch (e) {
                     if (e instanceof AuthError) {
@@ -19389,7 +19488,7 @@
         async handleResponse(serverParams, request, codeVerifier, serverTelemetryManager) {
             const state = serverParams.state;
             if (!state) {
-                throw createBrowserAuthError(noStateInHash);
+                throw createBrowserAuthError(noStateInHash, request.correlationId);
             }
             const { authority, azureCloudOptions, extraQueryParameters, account } = request;
             if (serverParams.ear_jwe) {
@@ -19440,7 +19539,7 @@
             else {
                 // Throw error if request URL is empty.
                 this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty", this.correlationId);
-                throw createBrowserAuthError(emptyNavigateUri);
+                throw createBrowserAuthError(emptyNavigateUri, this.correlationId);
             }
         }
         /**
@@ -19481,7 +19580,7 @@
                 // Redirect bridge requires "state" param to work properly
                 validLogoutRequest.state = setRequestState(this.browserCrypto, validLogoutRequest.state || "", {
                     interactionType: InteractionType.Redirect,
-                });
+                }, validLogoutRequest.correlationId);
                 // Create logout string and navigate user window to logout.
                 const logoutUri = authClient.getLogoutUri(validLogoutRequest);
                 if (validLogoutRequest.account?.homeAccountId) {
@@ -19517,7 +19616,7 @@
             }
             catch (e) {
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 this.eventHandler.emitEvent(EventType.LOGOUT_FAILURE, this.correlationId, InteractionType.Redirect, null, e);
@@ -19532,7 +19631,7 @@
          */
         getRedirectStartPage(requestStartPage) {
             const redirectStartPage = requestStartPage || window.location.href;
-            const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri());
+            const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(redirectStartPage, getCurrentUri(), this.correlationId);
             // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
             validateUrl(absoluteRedirectStartPage, this.logger, this.correlationId);
             return absoluteRedirectStartPage;
@@ -19552,7 +19651,7 @@
         if (!requestUrl) {
             // Throw error if request URL is empty.
             logger.info("Navigate url is empty", correlationId);
-            throw createBrowserAuthError(emptyNavigateUri);
+            throw createBrowserAuthError(emptyNavigateUri, correlationId);
         }
         frame.src = requestUrl;
         return frame;
@@ -19669,7 +19768,7 @@
             }
             catch (e) {
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 if (!authClient ||
@@ -19757,7 +19856,7 @@
             const { serverParams } = await this.silentAuthorizeHelper(authClient, silentRequest);
             const correlationId = silentRequest.correlationId;
             // Validate the response - this checks for errors and validates state
-            validateAuthorizationResponse(serverParams, silentRequest.state);
+            validateAuthorizationResponse(serverParams, silentRequest.state, correlationId);
             // Verify a valid authorization code is present
             if (!serverParams.code) {
                 this.logger.warning("SSO verification response did not contain an authorization code", correlationId);
@@ -19771,7 +19870,7 @@
          */
         logout() {
             // Synchronous so we must reject
-            return Promise.reject(createBrowserAuthError(silentLogoutUnsupported));
+            return Promise.reject(createBrowserAuthError(silentLogoutUnsupported, ""));
         }
         /**
          * Helper which acquires an authorization code silently using a hidden iframe from given url
@@ -19865,7 +19964,7 @@
             });
             // Send request to renew token. Auth module will throw errors if token cannot be renewed.
             return invokeAsync(refreshTokenClient.acquireTokenByRefreshToken.bind(refreshTokenClient), RefreshTokenClientAcquireTokenByRefreshToken, this.logger, this.performanceClient, request.correlationId)(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch((e) => {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
                 throw e;
             });
@@ -19875,7 +19974,7 @@
          */
         logout() {
             // Synchronous so we must reject
-            return Promise.reject(createBrowserAuthError(silentLogoutUnsupported));
+            return Promise.reject(createBrowserAuthError(silentLogoutUnsupported, ""));
         }
         /**
          * Creates a Refresh Client with the given authority, or the default authority.
@@ -19927,7 +20026,7 @@
         async acquireToken(request) {
             // Auth code payload is required
             if (!request.code) {
-                throw createBrowserAuthError(authCodeRequired);
+                throw createBrowserAuthError(authCodeRequired, this.correlationId);
             }
             // Create silent request
             const silentRequest = await invokeAsync(initializeAuthorizationRequest, StandardInteractionClientInitializeAuthorizationRequest, this.logger, this.performanceClient, this.correlationId)(request, InteractionType.Silent, this.config, this.browserCrypto, this.browserStorage, this.logger, this.performanceClient, 
@@ -19965,7 +20064,7 @@
             }
             catch (e) {
                 if (e instanceof AuthError) {
-                    e.setCorrelationId(this.correlationId);
+                    e.correlationId = this.correlationId;
                     serverTelemetryManager.cacheFailedRequest(e);
                 }
                 throw e;
@@ -19976,7 +20075,7 @@
          */
         logout() {
             // Synchronous so we must reject
-            return Promise.reject(createBrowserAuthError(silentLogoutUnsupported));
+            return Promise.reject(createBrowserAuthError(silentLogoutUnsupported, ""));
         }
     }
 
@@ -20696,7 +20795,7 @@
             try {
                 if (request.code && request.nativeAccountId) {
                     // Throw error in case server returns both spa_code and spa_accountid in exchange for auth code.
-                    throw createBrowserAuthError(spaCodeAndNativeAccountIdPresent);
+                    throw createBrowserAuthError(spaCodeAndNativeAccountIdPresent, correlationId);
                 }
                 else if (request.code) {
                     const hybridAuthCode = request.code;
@@ -20759,11 +20858,11 @@
                         return result;
                     }
                     else {
-                        throw createBrowserAuthError(unableToAcquireTokenFromNativePlatform);
+                        throw createBrowserAuthError(unableToAcquireTokenFromNativePlatform, correlationId);
                     }
                 }
                 else {
-                    throw createBrowserAuthError(authCodeOrNativeAccountIdRequired);
+                    throw createBrowserAuthError(authCodeOrNativeAccountIdRequired, correlationId);
                 }
             }
             catch (e) {
@@ -20825,7 +20924,7 @@
                     const silentCacheClient = this.createSilentCacheClient(commonRequest.correlationId);
                     return invokeAsync(silentCacheClient.acquireToken.bind(silentCacheClient), SilentCacheClientAcquireToken, this.logger, this.performanceClient, commonRequest.correlationId)(commonRequest);
                 default:
-                    throw createClientAuthError(tokenRefreshRequired);
+                    throw createClientAuthError(tokenRefreshRequired, commonRequest.correlationId);
             }
         }
         /**
@@ -20843,7 +20942,7 @@
                     const silentRefreshClient = this.createSilentRefreshClient(commonRequest.correlationId);
                     return invokeAsync(silentRefreshClient.acquireToken.bind(silentRefreshClient), SilentRefreshClientAcquireToken, this.logger, this.performanceClient, commonRequest.correlationId)(commonRequest);
                 default:
-                    throw createClientAuthError(tokenRefreshRequired);
+                    throw createClientAuthError(tokenRefreshRequired, commonRequest.correlationId);
             }
         }
         /**
@@ -20952,7 +21051,7 @@
                     ? toSecondsFromDate(result.expiresOn)
                     : 0, result.extExpiresOn
                     ? toSecondsFromDate(result.extExpiresOn)
-                    : 0, base64Decode, undefined, // refreshOn
+                    : 0, base64Decode, request.correlationId || "", undefined, // refreshOn
                 result.tokenType, undefined, // userAssertionHash
                 request.sshKid);
                 if (request.resource) {
@@ -20977,7 +21076,7 @@
             const correlationId = this.getRequestCorrelationId(request);
             this.logger.trace("acquireTokenNative called", correlationId);
             if (!this.platformAuthProvider) {
-                throw createBrowserAuthError(nativeConnectionNotEstablished);
+                throw createBrowserAuthError(nativeConnectionNotEstablished, correlationId);
             }
             const nativeClient = new PlatformAuthInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, apiId, this.performanceClient, this.platformAuthProvider, accountId || this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
             return invokeAsync(nativeClient.acquireToken.bind(nativeClient), NativeInteractionClientAcquireToken, this.logger, this.performanceClient, correlationId)(request, cacheLookupPolicy);
@@ -21221,7 +21320,7 @@
             this.logger.verbose("acquireTokenSilent called", correlationId);
             const account = request.account || this.getActiveAccount();
             if (!account) {
-                throw createBrowserAuthError(noAccountError);
+                throw createBrowserAuthError(noAccountError, correlationId);
             }
             return this.acquireTokenSilentDeduped(request, account, correlationId)
                 .then((result) => {
@@ -21240,7 +21339,7 @@
                 .catch((error) => {
                 if (error instanceof AuthError) {
                     // Ensures PWB scenarios can correctly match request to response
-                    error.setCorrelationId(correlationId);
+                    error.correlationId = correlationId;
                 }
                 atsMeasurement.end({
                     success: false,
@@ -21398,7 +21497,7 @@
                         this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow", silentRequest.correlationId);
                         this.platformAuthProvider = undefined; // Prevent future requests from continuing to attempt
                         // Cache will not contain tokens, given that previous WAM requests succeeded. Skip cache and RT renewal and go straight to iframe renewal
-                        throw createClientAuthError(tokenRefreshRequired);
+                        throw createClientAuthError(tokenRefreshRequired, silentRequest.correlationId);
                     }
                     throw e;
                 });
@@ -21507,7 +21606,7 @@
                 this.logger.verbose("The SDK can only be used in a browser environment.", "");
                 throw new UnsupportedEnvironmentError();
             }
-            this.logger = this.logger.clone(DefaultPackageInfo.SKU, DefaultPackageInfo.VERSION);
+            this.logger = this.logger.clone(name, DefaultPackageInfo.VERSION);
             this.customAuthConfig = operatingContext.getCustomAuthConfig();
             this.authority = new CustomAuthAuthority(this.customAuthConfig.auth.authority, this.customAuthConfig, this.networkClient, this.browserStorage, this.logger, this.performanceClient, this.customAuthConfig.customAuth?.authApiProxyUrl);
             const interactionClientFactory = new CustomAuthInterationClientFactory(this.customAuthConfig, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, customAuthApiClient ??