@azure/msal-common 14.4.1-beta.1 → 14.6.0-alpha.0

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v14.4.1-beta.1 2023-11-14 */
+/*! @azure/msal-common v14.6.0-alpha.0 2023-12-15 */
 'use strict';
 'use strict';
 
@@ -69,6 +69,7 @@ const HttpStatus = {
     SUCCESS_RANGE_END: 299,
     REDIRECT: 302,
     CLIENT_ERROR_RANGE_START: 400,
+    UNAUTHORIZED: 401,
     CLIENT_ERROR_RANGE_END: 499,
     SERVER_ERROR_RANGE_START: 500,
     SERVER_ERROR_RANGE_END: 599,
@@ -111,59 +112,6 @@ const AADAuthorityConstants = {
     ORGANIZATIONS: "organizations",
     CONSUMERS: "consumers",
 };
-/**
- * Keys in the hashParams sent by AAD Server
- */
-const AADServerParamKeys = {
-    CLIENT_ID: "client_id",
-    REDIRECT_URI: "redirect_uri",
-    RESPONSE_TYPE: "response_type",
-    RESPONSE_MODE: "response_mode",
-    GRANT_TYPE: "grant_type",
-    CLAIMS: "claims",
-    SCOPE: "scope",
-    ERROR: "error",
-    ERROR_DESCRIPTION: "error_description",
-    ACCESS_TOKEN: "access_token",
-    ID_TOKEN: "id_token",
-    REFRESH_TOKEN: "refresh_token",
-    EXPIRES_IN: "expires_in",
-    STATE: "state",
-    NONCE: "nonce",
-    PROMPT: "prompt",
-    SESSION_STATE: "session_state",
-    CLIENT_INFO: "client_info",
-    CODE: "code",
-    CODE_CHALLENGE: "code_challenge",
-    CODE_CHALLENGE_METHOD: "code_challenge_method",
-    CODE_VERIFIER: "code_verifier",
-    CLIENT_REQUEST_ID: "client-request-id",
-    X_CLIENT_SKU: "x-client-SKU",
-    X_CLIENT_VER: "x-client-VER",
-    X_CLIENT_OS: "x-client-OS",
-    X_CLIENT_CPU: "x-client-CPU",
-    X_CLIENT_CURR_TELEM: "x-client-current-telemetry",
-    X_CLIENT_LAST_TELEM: "x-client-last-telemetry",
-    X_MS_LIB_CAPABILITY: "x-ms-lib-capability",
-    X_APP_NAME: "x-app-name",
-    X_APP_VER: "x-app-ver",
-    POST_LOGOUT_URI: "post_logout_redirect_uri",
-    ID_TOKEN_HINT: "id_token_hint",
-    DEVICE_CODE: "device_code",
-    CLIENT_SECRET: "client_secret",
-    CLIENT_ASSERTION: "client_assertion",
-    CLIENT_ASSERTION_TYPE: "client_assertion_type",
-    TOKEN_TYPE: "token_type",
-    REQ_CNF: "req_cnf",
-    OBO_ASSERTION: "assertion",
-    REQUESTED_TOKEN_USE: "requested_token_use",
-    ON_BEHALF_OF: "on_behalf_of",
-    FOCI: "foci",
-    CCS_HEADER: "X-AnchorMailbox",
-    RETURN_SPA_CODE: "return_spa_code",
-    NATIVE_BROKER: "nativebroker",
-    LOGOUT_HINT: "logout_hint",
-};
 /**
  * Claims request keys
  */
@@ -184,20 +132,6 @@ const PromptValue = {
     CREATE: "create",
     NO_SESSION: "no_session",
 };
-/**
- * SSO Types - generated to populate hints
- */
-const SSOTypes = {
-    ACCOUNT: "account",
-    SID: "sid",
-    LOGIN_HINT: "login_hint",
-    ID_TOKEN: "id_token",
-    DOMAIN_HINT: "domain_hint",
-    ORGANIZATIONS: "organizations",
-    CONSUMERS: "consumers",
-    ACCOUNT_ID: "accountIdentifier",
-    HOMEACCOUNT_ID: "homeAccountIdentifier",
-};
 /**
  * allowed values for codeVerifier
  */
@@ -274,7 +208,7 @@ const CacheType = {
  * More Cache related constants
  */
 const APP_METADATA = "appmetadata";
-const CLIENT_INFO = "client_info";
+const CLIENT_INFO$1 = "client_info";
 const THE_FAMILY_ID = "1";
 const AUTHORITY_METADATA_CONSTANTS = {
     CACHE_KEY: "authority-metadata",
@@ -376,7 +310,9 @@ const JsonWebTokenTypes = {
     Jwk: "JWK",
     Pop: "pop",
 };
-const ONE_DAY_IN_MS = 86400000;
+const ONE_DAY_IN_MS = 86400000;
+// Token renewal offset default in seconds
+const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1010,7 +946,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "14.4.1-beta.1";
+const version = "14.6.0-alpha.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1262,7 +1198,7 @@ function createRefreshTokenEntity(homeAccountId, environment, refreshToken, clie
         rtEntity.familyId = familyId;
     }
     if (expiresOn) {
-        rtEntity.expiresOn = expiresOn;
+        rtEntity.expiresOn = expiresOn.toString();
     }
     return rtEntity;
 }
@@ -1376,6 +1312,22 @@ function isServerTelemetryEntity(key, entity) {
                 entity.hasOwnProperty("cacheHits");
     }
     return validateKey && validateEntity;
+}
+/**
+ * validates if a given cache entry is "Throttling", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isThrottlingEntity(key, entity) {
+    let validateKey = false;
+    if (key) {
+        validateKey = key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
+    }
+    let validateEntity = true;
+    if (entity) {
+        validateEntity = entity.hasOwnProperty("throttleTime");
+    }
+    return validateKey && validateEntity;
 }
 
 var CacheHelpers = /*#__PURE__*/Object.freeze({
@@ -1388,7 +1340,8 @@ var CacheHelpers = /*#__PURE__*/Object.freeze({
     isCredentialEntity: isCredentialEntity,
     isIdTokenEntity: isIdTokenEntity,
     isRefreshTokenEntity: isRefreshTokenEntity,
-    isServerTelemetryEntity: isServerTelemetryEntity
+    isServerTelemetryEntity: isServerTelemetryEntity,
+    isThrottlingEntity: isThrottlingEntity
 });
 
 /*
@@ -1883,12 +1836,12 @@ class ScopeSet {
  * @param rawClientInfo
  * @param crypto
  */
-function buildClientInfo(rawClientInfo, crypto) {
+function buildClientInfo(rawClientInfo, base64Decode) {
     if (!rawClientInfo) {
         throw createClientAuthError(clientInfoEmptyError);
     }
     try {
-        const decodedClientInfo = crypto.base64Decode(rawClientInfo);
+        const decodedClientInfo = base64Decode(rawClientInfo);
         return JSON.parse(decodedClientInfo);
     }
     catch (e) {
@@ -1912,6 +1865,66 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Returns true if tenantId matches the utid portion of homeAccountId
+ * @param tenantId
+ * @param homeAccountId
+ * @returns
+ */
+function tenantIdMatchesHomeTenant(tenantId, homeAccountId) {
+    return (!!tenantId &&
+        !!homeAccountId &&
+        tenantId === homeAccountId.split(".")[1]);
+}
+function buildTenantProfileFromIdTokenClaims(homeAccountId, idTokenClaims) {
+    const { oid, sub, tid, name, tfp, acr } = idTokenClaims;
+    /**
+     * Since there is no way to determine if the authority is AAD or B2C, we exhaust all the possible claims that can serve as tenant ID with the following precedence:
+     * tid - TenantID claim that identifies the tenant that issued the token in AAD. Expected in all AAD ID tokens, not present in B2C ID Tokens.
+     * tfp - Trust Framework Policy claim that identifies the policy that was used to authenticate the user. Functions as tenant for B2C scenarios.
+     * acr - Authentication Context Class Reference claim used only with older B2C policies. Fallback in case tfp is not present, but likely won't be present anyway.
+     */
+    const tenantId = tid || tfp || acr || "";
+    return {
+        tenantId: tenantId,
+        localAccountId: oid || sub || "",
+        name: name,
+        isHomeTenant: tenantIdMatchesHomeTenant(tenantId, homeAccountId),
+    };
+}
+/**
+ * Replaces account info that varies by tenant profile sourced from the ID token claims passed in with the tenant-specific account info
+ * @param baseAccountInfo
+ * @param idTokenClaims
+ * @returns
+ */
+function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenClaims) {
+    let updatedAccountInfo = baseAccountInfo;
+    // Tenant Profile overrides passed in account info
+    if (tenantProfile) {
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...tenantProfileOverride } = tenantProfile;
+        updatedAccountInfo = { ...baseAccountInfo, ...tenantProfileOverride };
+    }
+    // ID token claims override passed in account info and tenant profile
+    if (idTokenClaims) {
+        // Ignore isHomeTenant, loginHint, and sid which are part of tenant profile but not base account info
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { isHomeTenant, ...claimsSourcedTenantProfile } = buildTenantProfileFromIdTokenClaims(baseAccountInfo.homeAccountId, idTokenClaims);
+        updatedAccountInfo = {
+            ...updatedAccountInfo,
+            ...claimsSourcedTenantProfile,
+            idTokenClaims: idTokenClaims,
+        };
+        return updatedAccountInfo;
+    }
+    return updatedAccountInfo;
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1926,6 +1939,27 @@ const AuthorityType = {
     Ciam: 3,
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Gets tenantId from available ID token claims to set as credential realm with the following precedence:
+ * 1. tid - if the token is acquired from an Azure AD tenant tid will be present
+ * 2. tfp - if the token is acquired from a modern B2C tenant tfp should be present
+ * 3. acr - if the token is acquired from a legacy B2C tenant acr should be present
+ * Downcased to match the realm case-insensitive comparison requirements
+ * @param idTokenClaims
+ * @returns
+ */
+function getTenantIdFromIdTokenClaims(idTokenClaims) {
+    if (idTokenClaims) {
+        const tenantId = idTokenClaims.tid || idTokenClaims.tfp || idTokenClaims.acr;
+        return tenantId || null;
+    }
+    return null;
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1960,8 +1994,8 @@ const ProtocolMode = {
  *      name: Full name for the account, including given name and family name,
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
+ *      tenantProfiles: Array of tenant profile objects for each tenant that the account has authenticated with in the browser
  * }
  * @internal
  */
@@ -1996,20 +2030,30 @@ class AccountEntity {
             username: this.username,
             localAccountId: this.localAccountId,
             name: this.name,
-            idTokenClaims: this.idTokenClaims,
             nativeAccountId: this.nativeAccountId,
             authorityType: this.authorityType,
+            // Deserialize tenant profiles array into a Map
+            tenantProfiles: new Map((this.tenantProfiles || []).map((tenantProfile) => {
+                return [tenantProfile.tenantId, tenantProfile];
+            })),
         };
     }
+    /**
+     * Returns true if the account entity is in single tenant format (outdated), false otherwise
+     */
+    isSingleTenant() {
+        return !this.tenantProfiles;
+    }
     /**
      * Generates account key from interface
      * @param accountInterface
      */
     static generateAccountCacheKey(accountInterface) {
+        const homeTenantId = accountInterface.homeAccountId.split(".")[1];
         const accountKey = [
             accountInterface.homeAccountId,
-            accountInterface.environment || Constants.EMPTY_STRING,
-            accountInterface.tenantId || Constants.EMPTY_STRING,
+            accountInterface.environment || "",
+            homeTenantId || accountInterface.tenantId || "",
         ];
         return accountKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     }
@@ -2017,7 +2061,7 @@ class AccountEntity {
      * Build Account cache from IdToken, clientInfo and authority/policy. Associated with AAD.
      * @param accountDetails
      */
-    static createAccount(accountDetails, authority) {
+    static createAccount(accountDetails, authority, base64Decode) {
         const account = new AccountEntity();
         if (authority.authorityType === AuthorityType.Adfs) {
             account.authorityType = CacheAccountType.ADFS_ACCOUNT_TYPE;
@@ -2028,6 +2072,10 @@ class AccountEntity {
         else {
             account.authorityType = CacheAccountType.GENERIC_ACCOUNT_TYPE;
         }
+        let clientInfo;
+        if (accountDetails.clientInfo && base64Decode) {
+            clientInfo = buildClientInfo(accountDetails.clientInfo, base64Decode);
+        }
         account.clientInfo = accountDetails.clientInfo;
         account.homeAccountId = accountDetails.homeAccountId;
         account.nativeAccountId = accountDetails.nativeAccountId;
@@ -2039,12 +2087,15 @@ class AccountEntity {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm =
-            accountDetails.idTokenClaims.tid || Constants.EMPTY_STRING;
+            clientInfo?.utid ||
+                getTenantIdFromIdTokenClaims(accountDetails.idTokenClaims) ||
+                "";
         // How do you account for MSA CID here?
         account.localAccountId =
-            accountDetails.idTokenClaims.oid ||
+            clientInfo?.uid ||
+                accountDetails.idTokenClaims.oid ||
                 accountDetails.idTokenClaims.sub ||
-                Constants.EMPTY_STRING;
+                "";
         /*
          * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
          * In most cases it will contain a single email. This field should not be relied upon if a custom
@@ -2055,10 +2106,21 @@ class AccountEntity {
         const email = accountDetails.idTokenClaims.emails
             ? accountDetails.idTokenClaims.emails[0]
             : null;
-        account.username = preferredUsername || email || Constants.EMPTY_STRING;
+        account.username = preferredUsername || email || "";
         account.name = accountDetails.idTokenClaims.name;
         account.cloudGraphHostName = accountDetails.cloudGraphHostName;
         account.msGraphHost = accountDetails.msGraphHost;
+        if (accountDetails.tenantProfiles) {
+            account.tenantProfiles = accountDetails.tenantProfiles;
+        }
+        else {
+            const tenantProfiles = [];
+            if (accountDetails.idTokenClaims) {
+                const tenantProfile = buildTenantProfileFromIdTokenClaims(accountDetails.homeAccountId, accountDetails.idTokenClaims);
+                tenantProfiles.push(tenantProfile);
+            }
+            account.tenantProfiles = tenantProfiles;
+        }
         return account;
     }
     /**
@@ -2081,6 +2143,8 @@ class AccountEntity {
         account.name = accountInfo.name;
         account.cloudGraphHostName = cloudGraphHostName;
         account.msGraphHost = msGraphHost;
+        // Serialize tenant profiles map into an array
+        account.tenantProfiles = Array.from(accountInfo.tenantProfiles?.values() || []);
         return account;
     }
     /**
@@ -2089,27 +2153,23 @@ class AccountEntity {
      * @param authType
      */
     static generateHomeAccountId(serverClientInfo, authType, logger, cryptoObj, idTokenClaims) {
-        const accountId = idTokenClaims?.sub
-            ? idTokenClaims.sub
-            : Constants.EMPTY_STRING;
-        // since ADFS does not have tid and does not set client_info
-        if (authType === AuthorityType.Adfs ||
-            authType === AuthorityType.Dsts) {
-            return accountId;
-        }
-        // for cases where there is clientInfo
-        if (serverClientInfo) {
-            try {
-                const clientInfo = buildClientInfo(serverClientInfo, cryptoObj);
-                if (clientInfo.uid && clientInfo.utid) {
-                    return `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`;
+        // since ADFS/DSTS do not have tid and does not set client_info
+        if (!(authType === AuthorityType.Adfs ||
+            authType === AuthorityType.Dsts)) {
+            // for cases where there is clientInfo
+            if (serverClientInfo) {
+                try {
+                    const clientInfo = buildClientInfo(serverClientInfo, cryptoObj.base64Decode);
+                    if (clientInfo.uid && clientInfo.utid) {
+                        return `${clientInfo.uid}.${clientInfo.utid}`;
+                    }
                 }
+                catch (e) { }
             }
-            catch (e) { }
+            logger.warning("No client info in response");
         }
         // default to "sub" claim
-        logger.verbose("No client info in response");
-        return accountId;
+        return idTokenClaims?.sub || "";
     }
     /**
      * Validates an entity: checks for all expected params
@@ -2995,25 +3055,19 @@ class CacheManager {
      * @returns Array of AccountInfo objects in cache
      */
     getAllAccounts(accountFilter) {
-        const validAccounts = [];
-        this.getAccountsFilteredBy(accountFilter || {}).forEach((accountEntity) => {
-            const accountInfo = this.getAccountInfoFromEntity(accountEntity, accountFilter);
-            if (accountInfo) {
-                validAccounts.push(accountInfo);
-            }
-        });
-        return validAccounts;
+        return this.buildTenantProfiles(this.getAccountsFilteredBy(accountFilter || {}), accountFilter);
     }
     /**
-     * Gets accountInfo object based on provided filters
+     * Gets first tenanted AccountInfo object found based on provided filters
      */
     getAccountInfoFilteredBy(accountFilter) {
         const allAccounts = this.getAllAccounts(accountFilter);
         if (allAccounts.length > 1) {
-            // If one or more accounts are found, further filter to the first account that has an ID token
-            return allAccounts.filter((account) => {
-                return !!account.idTokenClaims;
-            })[0];
+            // If one or more accounts are found, prioritize accounts that have an ID token
+            const sortedAccounts = allAccounts.sort((account) => {
+                return account.idTokenClaims ? -1 : 1;
+            });
+            return sortedAccounts[0];
         }
         else if (allAccounts.length === 1) {
             // If only one account is found, return it regardless of whether a matching ID token was found
@@ -3037,27 +3091,104 @@ class CacheManager {
             return null;
         }
     }
-    getAccountInfoFromEntity(accountEntity, accountFilter) {
-        const accountInfo = accountEntity.getAccountInfo();
-        const idToken = this.getIdToken(accountInfo);
+    /**
+     * Matches filtered account entities with cached ID tokens that match the tenant profile-specific account filters
+     * and builds the account info objects from the matching ID token's claims
+     * @param cachedAccounts
+     * @param accountFilter
+     * @returns Array of AccountInfo objects that match account and tenant profile filters
+     */
+    buildTenantProfiles(cachedAccounts, accountFilter) {
+        return cachedAccounts.flatMap((accountEntity) => {
+            return this.getAccountInfoForTenantProfiles(accountEntity, accountFilter);
+        });
+    }
+    getAccountInfoForTenantProfiles(accountEntity, accountFilter) {
+        return this.getTenantProfilesFromAccountEntity(accountEntity, accountFilter?.tenantId, accountFilter);
+    }
+    getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter) {
+        let tenantedAccountInfo = null;
+        let idTokenClaims;
+        if (tenantProfileFilter) {
+            if (!this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter)) {
+                return null;
+            }
+        }
+        const idToken = this.getIdToken(accountInfo, tokenKeys, tenantProfile.tenantId);
         if (idToken) {
-            const idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
-            if (this.idTokenClaimsMatchAccountFilter(idTokenClaims, accountFilter)) {
-                accountInfo.idToken = idToken.secret;
-                accountInfo.idTokenClaims = idTokenClaims;
-                return accountInfo;
+            idTokenClaims = extractTokenClaims(idToken.secret, this.cryptoImpl.base64Decode);
+            if (!this.idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter)) {
+                // ID token sourced claims don't match so this tenant profile is not a match
+                return null;
             }
         }
-        return accountInfo;
+        // Expand tenant profile into account info based on matching tenant profile and if available matching ID token claims
+        tenantedAccountInfo = updateAccountTenantProfileData(accountInfo, tenantProfile, idTokenClaims);
+        return tenantedAccountInfo;
     }
-    idTokenClaimsMatchAccountFilter(idTokenClaims, accountFilter) {
-        if (accountFilter) {
-            if (!!accountFilter.loginHint &&
-                !this.matchLoginHint(idTokenClaims, accountFilter.loginHint)) {
+    getTenantProfilesFromAccountEntity(accountEntity, targetTenantId, tenantProfileFilter) {
+        const accountInfo = accountEntity.getAccountInfo();
+        let searchTenantProfiles = accountInfo.tenantProfiles || new Map();
+        const tokenKeys = this.getTokenKeys();
+        // If a tenant ID was provided, only return the tenant profile for that tenant ID if it exists
+        if (targetTenantId) {
+            const tenantProfile = searchTenantProfiles.get(targetTenantId);
+            if (tenantProfile) {
+                // Reduce search field to just this tenant profile
+                searchTenantProfiles = new Map([
+                    [targetTenantId, tenantProfile],
+                ]);
+            }
+            else {
+                // No tenant profile for search tenant ID, return empty array
+                return [];
+            }
+        }
+        const matchingTenantProfiles = [];
+        searchTenantProfiles.forEach((tenantProfile) => {
+            const tenantedAccountInfo = this.getTenantedAccountInfoByFilter(accountInfo, tokenKeys, tenantProfile, tenantProfileFilter);
+            if (tenantedAccountInfo) {
+                matchingTenantProfiles.push(tenantedAccountInfo);
+            }
+        });
+        return matchingTenantProfiles;
+    }
+    tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter) {
+        if (!!tenantProfileFilter.localAccountId &&
+            !this.matchLocalAccountIdFromTenantProfile(tenantProfile, tenantProfileFilter.localAccountId)) {
+            return false;
+        }
+        if (!!tenantProfileFilter.name &&
+            !(tenantProfile.name === tenantProfileFilter.name)) {
+            return false;
+        }
+        if (tenantProfileFilter.isHomeTenant !== undefined &&
+            !(tenantProfile.isHomeTenant === tenantProfileFilter.isHomeTenant)) {
+            return false;
+        }
+        return true;
+    }
+    idTokenClaimsMatchTenantProfileFilter(idTokenClaims, tenantProfileFilter) {
+        // Tenant Profile filtering
+        if (tenantProfileFilter) {
+            if (!!tenantProfileFilter.localAccountId &&
+                !this.matchLocalAccountIdFromTokenClaims(idTokenClaims, tenantProfileFilter.localAccountId)) {
+                return false;
+            }
+            if (!!tenantProfileFilter.loginHint &&
+                !this.matchLoginHintFromTokenClaims(idTokenClaims, tenantProfileFilter.loginHint)) {
+                return false;
+            }
+            if (!!tenantProfileFilter.username &&
+                !this.matchUsername(idTokenClaims.preferred_username, tenantProfileFilter.username)) {
+                return false;
+            }
+            if (!!tenantProfileFilter.name &&
+                !this.matchName(idTokenClaims, tenantProfileFilter.name)) {
                 return false;
             }
-            if (!!accountFilter.sid &&
-                !this.matchSid(idTokenClaims, accountFilter.sid)) {
+            if (!!tenantProfileFilter.sid &&
+                !this.matchSid(idTokenClaims, tenantProfileFilter.sid)) {
                 return false;
             }
         }
@@ -3122,7 +3253,7 @@ class CacheManager {
         this.setAccessTokenCredential(credential);
     }
     /**
-     * Retrieve accounts matching all provided filters; if no filter is set, get all accounts
+     * Retrieve account entities matching all provided tenant-agnostic filters; if no filter is set, get all account entities in the cache
      * Not checking for casing as keys are all generated in lower case, remember to convert to lower case if object properties are compared
      * @param accountFilter - An object containing Account properties to filter by
      */
@@ -3130,11 +3261,12 @@ class CacheManager {
         const allAccountKeys = this.getAccountKeys();
         const matchingAccounts = [];
         allAccountKeys.forEach((cacheKey) => {
-            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId, accountFilter.tenantId)) {
+            if (!this.isAccountKey(cacheKey, accountFilter.homeAccountId)) {
                 // Don't parse value if the key doesn't match the account filters
                 return;
             }
-            const entity = this.getAccount(cacheKey);
+            const entity = this.getAccount(cacheKey, this.commonLogger);
+            // Match base account fields
             if (!entity) {
                 return;
             }
@@ -3142,12 +3274,8 @@ class CacheManager {
                 !this.matchHomeAccountId(entity, accountFilter.homeAccountId)) {
                 return;
             }
-            if (!!accountFilter.localAccountId &&
-                !this.matchLocalAccountId(entity, accountFilter.localAccountId)) {
-                return;
-            }
             if (!!accountFilter.username &&
-                !this.matchUsername(entity, accountFilter.username)) {
+                !this.matchUsername(entity.username, accountFilter.username)) {
                 return;
             }
             if (!!accountFilter.environment &&
@@ -3158,11 +3286,6 @@ class CacheManager {
                 !this.matchRealm(entity, accountFilter.realm)) {
                 return;
             }
-            // tenantId is another name for realm
-            if (!!accountFilter.tenantId &&
-                !this.matchRealm(entity, accountFilter.tenantId)) {
-                return;
-            }
             if (!!accountFilter.nativeAccountId &&
                 !this.matchNativeAccountId(entity, accountFilter.nativeAccountId)) {
                 return;
@@ -3171,8 +3294,16 @@ class CacheManager {
                 !this.matchAuthorityType(entity, accountFilter.authorityType)) {
                 return;
             }
-            if (!!accountFilter.name &&
-                !this.matchName(entity, accountFilter.name)) {
+            // If at least one tenant profile matches the tenant profile filter, add the account to the list of matching accounts
+            const tenantProfileFilter = {
+                localAccountId: accountFilter?.localAccountId,
+                name: accountFilter?.name,
+            };
+            const matchingTenantProfiles = entity.tenantProfiles?.filter((tenantProfile) => {
+                return this.tenantProfileMatchesFilter(tenantProfile, tenantProfileFilter);
+            });
+            if (matchingTenantProfiles && matchingTenantProfiles.length === 0) {
+                // No tenant profile for this account matches filter, don't add to list of matching accounts
                 return;
             }
             matchingAccounts.push(entity);
@@ -3379,7 +3510,7 @@ class CacheManager {
      * @param account
      */
     async removeAccount(accountKey) {
-        const account = this.getAccount(accountKey);
+        const account = this.getAccount(accountKey, this.commonLogger);
         if (!account) {
             return;
         }
@@ -3411,6 +3542,61 @@ class CacheManager {
         });
         await Promise.all(removedCredentials);
     }
+    /**
+     * Migrates a single-tenant account and all it's associated alternate cross-tenant account objects in the
+     * cache into a condensed multi-tenant account object with tenant profiles.
+     * @param accountKey
+     * @param accountEntity
+     * @param logger
+     * @returns
+     */
+    updateOutdatedCachedAccount(accountKey, accountEntity, logger) {
+        // Only update if account entity is defined and has no tenantProfiles object (is outdated)
+        if (accountEntity && accountEntity.isSingleTenant()) {
+            this.commonLogger?.verbose("updateOutdatedCachedAccount: Found a single-tenant (outdated) account entity in the cache, migrating to multi-tenant account entity");
+            // Get keys of all accounts belonging to user
+            const matchingAccountKeys = this.getAccountKeys().filter((key) => {
+                return key.startsWith(accountEntity.homeAccountId);
+            });
+            // Get all account entities belonging to user
+            const accountsToMerge = [];
+            matchingAccountKeys.forEach((key) => {
+                const account = this.getCachedAccountEntity(key);
+                if (account) {
+                    accountsToMerge.push(account);
+                }
+            });
+            // Set base account to home account if available, any account if not
+            const baseAccount = accountsToMerge.find((account) => {
+                return tenantIdMatchesHomeTenant(account.realm, account.homeAccountId);
+            }) || accountsToMerge[0];
+            // Populate tenant profiles built from each account entity belonging to the user
+            baseAccount.tenantProfiles = accountsToMerge.map((account) => {
+                return {
+                    tenantId: account.realm,
+                    localAccountId: account.localAccountId,
+                    name: account.name,
+                    isHomeTenant: tenantIdMatchesHomeTenant(account.realm, account.homeAccountId),
+                };
+            });
+            const updatedAccount = CacheManager.toObject(new AccountEntity(), {
+                ...baseAccount,
+            });
+            const newAccountKey = updatedAccount.generateAccountKey();
+            // Clear cache of legacy account objects that have been collpsed into tenant profiles
+            matchingAccountKeys.forEach((key) => {
+                if (key !== newAccountKey) {
+                    this.removeOutdatedAccount(accountKey);
+                }
+            });
+            // Cache updated account object
+            this.setAccount(updatedAccount);
+            logger?.verbose("Updated an outdated account entity in the cache");
+            return updatedAccount;
+        }
+        // No update is necessary
+        return accountEntity;
+    }
     /**
      * returns a boolean if the given credential is removed
      * @param credential
@@ -3450,74 +3636,73 @@ class CacheManager {
         });
         return true;
     }
-    /**
-     * Retrieve the cached credentials into a cacherecord
-     * @param account {AccountInfo}
-     * @param request {BaseAuthRequest}
-     * @param environment {string}
-     * @param performanceClient {?IPerformanceClient}
-     * @param correlationId {?string}
-     */
-    readCacheRecord(account, request, environment, performanceClient, correlationId) {
-        const tokenKeys = this.getTokenKeys();
-        const cachedAccount = this.readAccountFromCache(account);
-        const cachedIdToken = this.getIdToken(account, tokenKeys, performanceClient, correlationId);
-        const cachedAccessToken = this.getAccessToken(account, request, tokenKeys, performanceClient, correlationId);
-        const cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys, performanceClient, correlationId);
-        const cachedAppMetadata = this.readAppMetadataFromCache(environment);
-        if (cachedAccount && cachedIdToken) {
-            cachedAccount.idTokenClaims = extractTokenClaims(cachedIdToken.secret, this.cryptoImpl.base64Decode);
-        }
-        return {
-            account: cachedAccount,
-            idToken: cachedIdToken,
-            accessToken: cachedAccessToken,
-            refreshToken: cachedRefreshToken,
-            appMetadata: cachedAppMetadata,
-        };
-    }
     /**
      * Retrieve AccountEntity from cache
      * @param account
      */
     readAccountFromCache(account) {
         const accountKey = AccountEntity.generateAccountCacheKey(account);
-        return this.getAccount(accountKey);
+        return this.getAccount(accountKey, this.commonLogger);
     }
     /**
      * Retrieve IdTokenEntity from cache
      * @param account {AccountInfo}
      * @param tokenKeys {?TokenKeys}
+     * @param targetRealm {?string}
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getIdToken(account, tokenKeys, performanceClient, correlationId) {
+    getIdToken(account, tokenKeys, targetRealm, performanceClient, correlationId) {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
             credentialType: CredentialType.ID_TOKEN,
             clientId: this.clientId,
-            realm: account.tenantId,
+            realm: targetRealm,
         };
-        const idTokens = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
-        const numIdTokens = idTokens.length;
+        const idTokenMap = this.getIdTokensByFilter(idTokenFilter, tokenKeys);
+        const numIdTokens = idTokenMap.size;
         if (numIdTokens < 1) {
             this.commonLogger.info("CacheManager:getIdToken - No token found");
             return null;
         }
         else if (numIdTokens > 1) {
-            this.commonLogger.info("CacheManager:getIdToken - Multiple id tokens found, clearing them");
-            idTokens.forEach((idToken) => {
-                this.removeIdToken(generateCredentialKey(idToken));
+            let tokensToBeRemoved = idTokenMap;
+            // Multiple tenant profiles and no tenant specified, pick home account
+            if (!targetRealm) {
+                const homeIdTokenMap = new Map();
+                idTokenMap.forEach((idToken, key) => {
+                    if (idToken.realm === account.tenantId) {
+                        homeIdTokenMap.set(key, idToken);
+                    }
+                });
+                const numHomeIdTokens = homeIdTokenMap.size;
+                if (numHomeIdTokens < 1) {
+                    this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account but none match account entity tenant id, returning first result");
+                    return idTokenMap.values().next().value;
+                }
+                else if (numHomeIdTokens === 1) {
+                    this.commonLogger.info("CacheManager:getIdToken - Multiple ID tokens found for account, defaulting to home tenant profile");
+                    return homeIdTokenMap.values().next().value;
+                }
+                else {
+                    // Multiple ID tokens for home tenant profile, remove all and return null
+                    tokensToBeRemoved = homeIdTokenMap;
+                }
+            }
+            // Multiple tokens for a single tenant profile, remove all and return null
+            this.commonLogger.info("CacheManager:getIdToken - Multiple matching ID tokens found, clearing them");
+            tokensToBeRemoved.forEach((idToken, key) => {
+                this.removeIdToken(key);
             });
             if (performanceClient && correlationId) {
-                performanceClient.addFields({ multiMatchedID: idTokens.length }, correlationId);
+                performanceClient.addFields({ multiMatchedID: idTokenMap.size }, correlationId);
             }
             return null;
         }
-        this.commonLogger.info("CacheManager:getIdToken - Returning id token");
-        return idTokens[0];
+        this.commonLogger.info("CacheManager:getIdToken - Returning ID token");
+        return idTokenMap.values().next().value;
     }
     /**
      * Gets all idTokens matching the given filter
@@ -3526,7 +3711,7 @@ class CacheManager {
      */
     getIdTokensByFilter(filter, tokenKeys) {
         const idTokenKeys = (tokenKeys && tokenKeys.idToken) || this.getTokenKeys().idToken;
-        const idTokens = [];
+        const idTokens = new Map();
         idTokenKeys.forEach((key) => {
             if (!this.idTokenKeyMatchesFilter(key, {
                 clientId: this.clientId,
@@ -3536,7 +3721,7 @@ class CacheManager {
             }
             const idToken = this.getIdTokenCredential(key);
             if (idToken && this.credentialMatchesFilter(idToken, filter)) {
-                idTokens.push(idToken);
+                idTokens.set(key, idToken);
             }
         });
         return idTokens;
@@ -3581,7 +3766,7 @@ class CacheManager {
      * @param performanceClient {?IPerformanceClient}
      * @param correlationId {?string}
      */
-    getAccessToken(account, request, tokenKeys, performanceClient, correlationId) {
+    getAccessToken(account, request, tokenKeys, targetRealm, performanceClient, correlationId) {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -3599,7 +3784,7 @@ class CacheManager {
             environment: account.environment,
             credentialType: credentialType,
             clientId: this.clientId,
-            realm: account.tenantId,
+            realm: targetRealm || account.tenantId,
             target: scopes,
             tokenType: authScheme,
             keyId: request.sshKid,
@@ -3808,19 +3993,12 @@ class CacheManager {
      * @param localAccountId
      * @returns
      */
-    matchLocalAccountId(entity, localAccountId) {
-        return !!(typeof entity.localAccountId === "string" &&
-            localAccountId === entity.localAccountId);
+    matchLocalAccountIdFromTokenClaims(tokenClaims, localAccountId) {
+        const idTokenLocalAccountId = tokenClaims.oid || tokenClaims.sub;
+        return localAccountId === idTokenLocalAccountId;
     }
-    /**
-     * helper to match usernames
-     * @param entity
-     * @param username
-     * @returns
-     */
-    matchUsername(entity, username) {
-        return !!(typeof entity.username === "string" &&
-            username.toLowerCase() === entity.username.toLowerCase());
+    matchLocalAccountIdFromTenantProfile(tenantProfile, localAccountId) {
+        return tenantProfile.localAccountId === localAccountId;
     }
     /**
      * helper to match names
@@ -3828,8 +4006,19 @@ class CacheManager {
      * @param name
      * @returns true if the downcased name properties are present and match in the filter and the entity
      */
-    matchName(entity, name) {
-        return !!(name.toLowerCase() === entity.name?.toLowerCase());
+    matchName(claims, name) {
+        return !!(name.toLowerCase() === claims.name?.toLowerCase());
+    }
+    /**
+     * helper to match usernames
+     * @param entity
+     * @param username
+     * @returns
+     */
+    matchUsername(cachedUsername, filterUsername) {
+        return !!(cachedUsername &&
+            typeof cachedUsername === "string" &&
+            filterUsername?.toLowerCase() === cachedUsername.toLowerCase());
     }
     /**
      * helper to match assertion
@@ -3893,7 +4082,7 @@ class CacheManager {
      * @param realm
      */
     matchRealm(entity, realm) {
-        return !!(entity.realm && realm === entity.realm);
+        return !!(entity.realm?.toLowerCase() === realm.toLowerCase());
     }
     /**
      * helper to match nativeAccountId
@@ -3913,26 +4102,26 @@ class CacheManager {
      * @param loginHint
      * @returns
      */
-    matchLoginHint(idTokenClaims, loginHint) {
-        if (idTokenClaims?.login_hint === loginHint) {
+    matchLoginHintFromTokenClaims(tokenClaims, loginHint) {
+        if (tokenClaims.login_hint === loginHint) {
             return true;
         }
-        if (idTokenClaims.preferred_username === loginHint) {
+        if (tokenClaims.preferred_username === loginHint) {
             return true;
         }
-        if (idTokenClaims?.upn === loginHint) {
+        if (tokenClaims.upn === loginHint) {
             return true;
         }
         return false;
     }
     /**
      * Helper to match sid
-     * @param idTokenClaims
+     * @param entity
      * @param sid
      * @returns true if the sid claim is present and matches the filter
      */
     matchSid(idTokenClaims, sid) {
-        return !!(idTokenClaims?.sid && idTokenClaims.sid === sid);
+        return idTokenClaims.sid === sid;
     }
     matchAuthorityType(entity, authorityType) {
         return !!(entity.authorityType &&
@@ -4009,6 +4198,9 @@ class DefaultStorageClass extends CacheManager {
     getAccount() {
         throw createClientAuthError(methodNotImplemented);
     }
+    getCachedAccountEntity() {
+        throw createClientAuthError(methodNotImplemented);
+    }
     setIdTokenCredential() {
         throw createClientAuthError(methodNotImplemented);
     }
@@ -4075,14 +4267,15 @@ class DefaultStorageClass extends CacheManager {
     updateCredentialCacheKey() {
         throw createClientAuthError(methodNotImplemented);
     }
+    removeOutdatedAccount() {
+        throw createClientAuthError(methodNotImplemented);
+    }
 }
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-// Token renewal offset default in seconds
-const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const DEFAULT_SYSTEM_OPTIONS = {
     tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     preventCorsPreflight: false,
@@ -4330,6 +4523,119 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CLIENT_ID = "client_id";
+const REDIRECT_URI = "redirect_uri";
+const RESPONSE_TYPE = "response_type";
+const RESPONSE_MODE = "response_mode";
+const GRANT_TYPE = "grant_type";
+const CLAIMS = "claims";
+const SCOPE = "scope";
+const ERROR = "error";
+const ERROR_DESCRIPTION = "error_description";
+const ACCESS_TOKEN = "access_token";
+const ID_TOKEN = "id_token";
+const REFRESH_TOKEN = "refresh_token";
+const EXPIRES_IN = "expires_in";
+const REFRESH_TOKEN_EXPIRES_IN = "refresh_token_expires_in";
+const STATE = "state";
+const NONCE = "nonce";
+const PROMPT = "prompt";
+const SESSION_STATE = "session_state";
+const CLIENT_INFO = "client_info";
+const CODE = "code";
+const CODE_CHALLENGE = "code_challenge";
+const CODE_CHALLENGE_METHOD = "code_challenge_method";
+const CODE_VERIFIER = "code_verifier";
+const CLIENT_REQUEST_ID = "client-request-id";
+const X_CLIENT_SKU = "x-client-SKU";
+const X_CLIENT_VER = "x-client-VER";
+const X_CLIENT_OS = "x-client-OS";
+const X_CLIENT_CPU = "x-client-CPU";
+const X_CLIENT_CURR_TELEM = "x-client-current-telemetry";
+const X_CLIENT_LAST_TELEM = "x-client-last-telemetry";
+const X_MS_LIB_CAPABILITY = "x-ms-lib-capability";
+const X_APP_NAME = "x-app-name";
+const X_APP_VER = "x-app-ver";
+const POST_LOGOUT_URI = "post_logout_redirect_uri";
+const ID_TOKEN_HINT = "id_token_hint";
+const DEVICE_CODE = "device_code";
+const CLIENT_SECRET = "client_secret";
+const CLIENT_ASSERTION = "client_assertion";
+const CLIENT_ASSERTION_TYPE = "client_assertion_type";
+const TOKEN_TYPE = "token_type";
+const REQ_CNF = "req_cnf";
+const OBO_ASSERTION = "assertion";
+const REQUESTED_TOKEN_USE = "requested_token_use";
+const ON_BEHALF_OF = "on_behalf_of";
+const FOCI = "foci";
+const CCS_HEADER = "X-AnchorMailbox";
+const RETURN_SPA_CODE = "return_spa_code";
+const NATIVE_BROKER = "nativebroker";
+const LOGOUT_HINT = "logout_hint";
+const SID = "sid";
+const LOGIN_HINT = "login_hint";
+const DOMAIN_HINT = "domain_hint";
+
+var AADServerParamKeys = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    ACCESS_TOKEN: ACCESS_TOKEN,
+    CCS_HEADER: CCS_HEADER,
+    CLAIMS: CLAIMS,
+    CLIENT_ASSERTION: CLIENT_ASSERTION,
+    CLIENT_ASSERTION_TYPE: CLIENT_ASSERTION_TYPE,
+    CLIENT_ID: CLIENT_ID,
+    CLIENT_INFO: CLIENT_INFO,
+    CLIENT_REQUEST_ID: CLIENT_REQUEST_ID,
+    CLIENT_SECRET: CLIENT_SECRET,
+    CODE: CODE,
+    CODE_CHALLENGE: CODE_CHALLENGE,
+    CODE_CHALLENGE_METHOD: CODE_CHALLENGE_METHOD,
+    CODE_VERIFIER: CODE_VERIFIER,
+    DEVICE_CODE: DEVICE_CODE,
+    DOMAIN_HINT: DOMAIN_HINT,
+    ERROR: ERROR,
+    ERROR_DESCRIPTION: ERROR_DESCRIPTION,
+    EXPIRES_IN: EXPIRES_IN,
+    FOCI: FOCI,
+    GRANT_TYPE: GRANT_TYPE,
+    ID_TOKEN: ID_TOKEN,
+    ID_TOKEN_HINT: ID_TOKEN_HINT,
+    LOGIN_HINT: LOGIN_HINT,
+    LOGOUT_HINT: LOGOUT_HINT,
+    NATIVE_BROKER: NATIVE_BROKER,
+    NONCE: NONCE,
+    OBO_ASSERTION: OBO_ASSERTION,
+    ON_BEHALF_OF: ON_BEHALF_OF,
+    POST_LOGOUT_URI: POST_LOGOUT_URI,
+    PROMPT: PROMPT,
+    REDIRECT_URI: REDIRECT_URI,
+    REFRESH_TOKEN: REFRESH_TOKEN,
+    REFRESH_TOKEN_EXPIRES_IN: REFRESH_TOKEN_EXPIRES_IN,
+    REQUESTED_TOKEN_USE: REQUESTED_TOKEN_USE,
+    REQ_CNF: REQ_CNF,
+    RESPONSE_MODE: RESPONSE_MODE,
+    RESPONSE_TYPE: RESPONSE_TYPE,
+    RETURN_SPA_CODE: RETURN_SPA_CODE,
+    SCOPE: SCOPE,
+    SESSION_STATE: SESSION_STATE,
+    SID: SID,
+    STATE: STATE,
+    TOKEN_TYPE: TOKEN_TYPE,
+    X_APP_NAME: X_APP_NAME,
+    X_APP_VER: X_APP_VER,
+    X_CLIENT_CPU: X_CLIENT_CPU,
+    X_CLIENT_CURR_TELEM: X_CLIENT_CURR_TELEM,
+    X_CLIENT_LAST_TELEM: X_CLIENT_LAST_TELEM,
+    X_CLIENT_OS: X_CLIENT_OS,
+    X_CLIENT_SKU: X_CLIENT_SKU,
+    X_CLIENT_VER: X_CLIENT_VER,
+    X_MS_LIB_CAPABILITY: X_MS_LIB_CAPABILITY
+});
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4425,26 +4731,26 @@ class RequestParameterBuilder {
      * add response_type = code
      */
     addResponseTypeCode() {
-        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
+        this.parameters.set(RESPONSE_TYPE, encodeURIComponent(Constants.CODE_RESPONSE_TYPE));
     }
     /**
      * add response_type = token id_token
      */
     addResponseTypeForTokenAndIdToken() {
-        this.parameters.set(AADServerParamKeys.RESPONSE_TYPE, encodeURIComponent(`${Constants.TOKEN_RESPONSE_TYPE} ${Constants.ID_TOKEN_RESPONSE_TYPE}`));
+        this.parameters.set(RESPONSE_TYPE, encodeURIComponent(`${Constants.TOKEN_RESPONSE_TYPE} ${Constants.ID_TOKEN_RESPONSE_TYPE}`));
     }
     /**
      * add response_mode. defaults to query.
      * @param responseMode
      */
     addResponseMode(responseMode) {
-        this.parameters.set(AADServerParamKeys.RESPONSE_MODE, encodeURIComponent(responseMode ? responseMode : ResponseMode.QUERY));
+        this.parameters.set(RESPONSE_MODE, encodeURIComponent(responseMode ? responseMode : ResponseMode.QUERY));
     }
     /**
      * Add flag to indicate STS should attempt to use WAM if available
      */
     addNativeBroker() {
-        this.parameters.set(AADServerParamKeys.NATIVE_BROKER, encodeURIComponent("1"));
+        this.parameters.set(NATIVE_BROKER, encodeURIComponent("1"));
     }
     /**
      * add scopes. set addOidcScopes to false to prevent default scopes in non-user scenarios
@@ -4462,14 +4768,14 @@ class RequestParameterBuilder {
             ? [...(scopes || []), ...defaultScopes]
             : scopes || [];
         const scopeSet = new ScopeSet(requestScopes);
-        this.parameters.set(AADServerParamKeys.SCOPE, encodeURIComponent(scopeSet.printScopes()));
+        this.parameters.set(SCOPE, encodeURIComponent(scopeSet.printScopes()));
     }
     /**
      * add clientId
      * @param clientId
      */
     addClientId(clientId) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ID, encodeURIComponent(clientId));
+        this.parameters.set(CLIENT_ID, encodeURIComponent(clientId));
     }
     /**
      * add redirect_uri
@@ -4477,7 +4783,7 @@ class RequestParameterBuilder {
      */
     addRedirectUri(redirectUri) {
         RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(AADServerParamKeys.REDIRECT_URI, encodeURIComponent(redirectUri));
+        this.parameters.set(REDIRECT_URI, encodeURIComponent(redirectUri));
     }
     /**
      * add post logout redirectUri
@@ -4485,28 +4791,28 @@ class RequestParameterBuilder {
      */
     addPostLogoutRedirectUri(redirectUri) {
         RequestValidator.validateRedirectUri(redirectUri);
-        this.parameters.set(AADServerParamKeys.POST_LOGOUT_URI, encodeURIComponent(redirectUri));
+        this.parameters.set(POST_LOGOUT_URI, encodeURIComponent(redirectUri));
     }
     /**
      * add id_token_hint to logout request
      * @param idTokenHint
      */
     addIdTokenHint(idTokenHint) {
-        this.parameters.set(AADServerParamKeys.ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
+        this.parameters.set(ID_TOKEN_HINT, encodeURIComponent(idTokenHint));
     }
     /**
      * add domain_hint
      * @param domainHint
      */
     addDomainHint(domainHint) {
-        this.parameters.set(SSOTypes.DOMAIN_HINT, encodeURIComponent(domainHint));
+        this.parameters.set(DOMAIN_HINT, encodeURIComponent(domainHint));
     }
     /**
      * add login_hint
      * @param loginHint
      */
     addLoginHint(loginHint) {
-        this.parameters.set(SSOTypes.LOGIN_HINT, encodeURIComponent(loginHint));
+        this.parameters.set(LOGIN_HINT, encodeURIComponent(loginHint));
     }
     /**
      * Adds the CCS (Cache Credential Service) query parameter for login_hint
@@ -4527,7 +4833,7 @@ class RequestParameterBuilder {
      * @param sid
      */
     addSid(sid) {
-        this.parameters.set(SSOTypes.SID, encodeURIComponent(sid));
+        this.parameters.set(SID, encodeURIComponent(sid));
     }
     /**
      * add claims
@@ -4536,14 +4842,14 @@ class RequestParameterBuilder {
     addClaims(claims, clientCapabilities) {
         const mergedClaims = this.addClientCapabilitiesToClaims(claims, clientCapabilities);
         RequestValidator.validateClaims(mergedClaims);
-        this.parameters.set(AADServerParamKeys.CLAIMS, encodeURIComponent(mergedClaims));
+        this.parameters.set(CLAIMS, encodeURIComponent(mergedClaims));
     }
     /**
      * add correlationId
      * @param correlationId
      */
     addCorrelationId(correlationId) {
-        this.parameters.set(AADServerParamKeys.CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
+        this.parameters.set(CLIENT_REQUEST_ID, encodeURIComponent(correlationId));
     }
     /**
      * add library info query params
@@ -4551,13 +4857,13 @@ class RequestParameterBuilder {
      */
     addLibraryInfo(libraryInfo) {
         // Telemetry Info
-        this.parameters.set(AADServerParamKeys.X_CLIENT_SKU, libraryInfo.sku);
-        this.parameters.set(AADServerParamKeys.X_CLIENT_VER, libraryInfo.version);
+        this.parameters.set(X_CLIENT_SKU, libraryInfo.sku);
+        this.parameters.set(X_CLIENT_VER, libraryInfo.version);
         if (libraryInfo.os) {
-            this.parameters.set(AADServerParamKeys.X_CLIENT_OS, libraryInfo.os);
+            this.parameters.set(X_CLIENT_OS, libraryInfo.os);
         }
         if (libraryInfo.cpu) {
-            this.parameters.set(AADServerParamKeys.X_CLIENT_CPU, libraryInfo.cpu);
+            this.parameters.set(X_CLIENT_CPU, libraryInfo.cpu);
         }
     }
     /**
@@ -4566,10 +4872,10 @@ class RequestParameterBuilder {
      */
     addApplicationTelemetry(appTelemetry) {
         if (appTelemetry?.appName) {
-            this.parameters.set(AADServerParamKeys.X_APP_NAME, appTelemetry.appName);
+            this.parameters.set(X_APP_NAME, appTelemetry.appName);
         }
         if (appTelemetry?.appVersion) {
-            this.parameters.set(AADServerParamKeys.X_APP_VER, appTelemetry.appVersion);
+            this.parameters.set(X_APP_VER, appTelemetry.appVersion);
         }
     }
     /**
@@ -4578,7 +4884,7 @@ class RequestParameterBuilder {
      */
     addPrompt(prompt) {
         RequestValidator.validatePrompt(prompt);
-        this.parameters.set(`${AADServerParamKeys.PROMPT}`, encodeURIComponent(prompt));
+        this.parameters.set(`${PROMPT}`, encodeURIComponent(prompt));
     }
     /**
      * add state
@@ -4586,7 +4892,7 @@ class RequestParameterBuilder {
      */
     addState(state) {
         if (state) {
-            this.parameters.set(AADServerParamKeys.STATE, encodeURIComponent(state));
+            this.parameters.set(STATE, encodeURIComponent(state));
         }
     }
     /**
@@ -4594,7 +4900,7 @@ class RequestParameterBuilder {
      * @param nonce
      */
     addNonce(nonce) {
-        this.parameters.set(AADServerParamKeys.NONCE, encodeURIComponent(nonce));
+        this.parameters.set(NONCE, encodeURIComponent(nonce));
     }
     /**
      * add code_challenge and code_challenge_method
@@ -4605,8 +4911,8 @@ class RequestParameterBuilder {
     addCodeChallengeParams(codeChallenge, codeChallengeMethod) {
         RequestValidator.validateCodeChallengeParams(codeChallenge, codeChallengeMethod);
         if (codeChallenge && codeChallengeMethod) {
-            this.parameters.set(AADServerParamKeys.CODE_CHALLENGE, encodeURIComponent(codeChallenge));
-            this.parameters.set(AADServerParamKeys.CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
+            this.parameters.set(CODE_CHALLENGE, encodeURIComponent(codeChallenge));
+            this.parameters.set(CODE_CHALLENGE_METHOD, encodeURIComponent(codeChallengeMethod));
         }
         else {
             throw createClientConfigurationError(pkceParamsMissing);
@@ -4617,35 +4923,35 @@ class RequestParameterBuilder {
      * @param code
      */
     addAuthorizationCode(code) {
-        this.parameters.set(AADServerParamKeys.CODE, encodeURIComponent(code));
+        this.parameters.set(CODE, encodeURIComponent(code));
     }
     /**
      * add the `authorization_code` passed by the user to exchange for a token
      * @param code
      */
     addDeviceCode(code) {
-        this.parameters.set(AADServerParamKeys.DEVICE_CODE, encodeURIComponent(code));
+        this.parameters.set(DEVICE_CODE, encodeURIComponent(code));
     }
     /**
      * add the `refreshToken` passed by the user
      * @param refreshToken
      */
     addRefreshToken(refreshToken) {
-        this.parameters.set(AADServerParamKeys.REFRESH_TOKEN, encodeURIComponent(refreshToken));
+        this.parameters.set(REFRESH_TOKEN, encodeURIComponent(refreshToken));
     }
     /**
      * add the `code_verifier` passed by the user to exchange for a token
      * @param codeVerifier
      */
     addCodeVerifier(codeVerifier) {
-        this.parameters.set(AADServerParamKeys.CODE_VERIFIER, encodeURIComponent(codeVerifier));
+        this.parameters.set(CODE_VERIFIER, encodeURIComponent(codeVerifier));
     }
     /**
      * add client_secret
      * @param clientSecret
      */
     addClientSecret(clientSecret) {
-        this.parameters.set(AADServerParamKeys.CLIENT_SECRET, encodeURIComponent(clientSecret));
+        this.parameters.set(CLIENT_SECRET, encodeURIComponent(clientSecret));
     }
     /**
      * add clientAssertion for confidential client flows
@@ -4653,7 +4959,7 @@ class RequestParameterBuilder {
      */
     addClientAssertion(clientAssertion) {
         if (clientAssertion) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+            this.parameters.set(CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
         }
     }
     /**
@@ -4662,7 +4968,7 @@ class RequestParameterBuilder {
      */
     addClientAssertionType(clientAssertionType) {
         if (clientAssertionType) {
-            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+            this.parameters.set(CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
         }
     }
     /**
@@ -4670,28 +4976,28 @@ class RequestParameterBuilder {
      * @param clientAssertion
      */
     addOboAssertion(oboAssertion) {
-        this.parameters.set(AADServerParamKeys.OBO_ASSERTION, encodeURIComponent(oboAssertion));
+        this.parameters.set(OBO_ASSERTION, encodeURIComponent(oboAssertion));
     }
     /**
      * add grant type
      * @param grantType
      */
     addRequestTokenUse(tokenUse) {
-        this.parameters.set(AADServerParamKeys.REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
+        this.parameters.set(REQUESTED_TOKEN_USE, encodeURIComponent(tokenUse));
     }
     /**
      * add grant type
      * @param grantType
      */
     addGrantType(grantType) {
-        this.parameters.set(AADServerParamKeys.GRANT_TYPE, encodeURIComponent(grantType));
+        this.parameters.set(GRANT_TYPE, encodeURIComponent(grantType));
     }
     /**
      * add client info
      *
      */
     addClientInfo() {
-        this.parameters.set(CLIENT_INFO, "1");
+        this.parameters.set(CLIENT_INFO$1, "1");
     }
     /**
      * add extraQueryParams
@@ -4749,8 +5055,8 @@ class RequestParameterBuilder {
      */
     addPopToken(cnfString) {
         if (cnfString) {
-            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.POP);
-            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
+            this.parameters.set(TOKEN_TYPE, AuthenticationScheme.POP);
+            this.parameters.set(REQ_CNF, encodeURIComponent(cnfString));
         }
     }
     /**
@@ -4758,8 +5064,8 @@ class RequestParameterBuilder {
      */
     addSshJwk(sshJwkString) {
         if (sshJwkString) {
-            this.parameters.set(AADServerParamKeys.TOKEN_TYPE, AuthenticationScheme.SSH);
-            this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+            this.parameters.set(TOKEN_TYPE, AuthenticationScheme.SSH);
+            this.parameters.set(REQ_CNF, encodeURIComponent(sshJwkString));
         }
     }
     /**
@@ -4767,20 +5073,20 @@ class RequestParameterBuilder {
      * @param serverTelemetryManager
      */
     addServerTelemetry(serverTelemetryManager) {
-        this.parameters.set(AADServerParamKeys.X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
-        this.parameters.set(AADServerParamKeys.X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
+        this.parameters.set(X_CLIENT_CURR_TELEM, serverTelemetryManager.generateCurrentRequestHeaderValue());
+        this.parameters.set(X_CLIENT_LAST_TELEM, serverTelemetryManager.generateLastRequestHeaderValue());
     }
     /**
      * Adds parameter that indicates to the server that throttling is supported
      */
     addThrottling() {
-        this.parameters.set(AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
+        this.parameters.set(X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
     }
     /**
      * Adds logout_hint parameter for "silent" logout which prevent server account picker
      */
     addLogoutHint(logoutHint) {
-        this.parameters.set(AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
+        this.parameters.set(LOGOUT_HINT, encodeURIComponent(logoutHint));
     }
     /**
      * Utility to create a URL from the params map
@@ -5358,7 +5664,7 @@ RegionDiscovery.IMDS_OPTIONS = {
  * @internal
  */
 class Authority {
-    constructor(authority, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId) {
+    constructor(authority, networkInterface, cacheManager, authorityOptions, logger, performanceClient, correlationId, managedIdentity) {
         this.canonicalAuthority = authority;
         this._canonicalAuthority.validateAsUri();
         this.networkInterface = networkInterface;
@@ -5372,6 +5678,7 @@ class Authority {
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.correlationId = correlationId;
+        this.managedIdentity = managedIdentity || false;
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
     }
     /**
@@ -5577,7 +5884,7 @@ class Authority {
         return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
     }
     /**
-     * Boolean that returns whethr or not tenant discovery has been completed.
+     * Boolean that returns whether or not tenant discovery has been completed.
      */
     discoveryComplete() {
         return !!this.metadata;
@@ -5971,8 +6278,9 @@ class Authority {
      */
     isInKnownAuthorities() {
         const matches = this.authorityOptions.knownAuthorities.filter((authority) => {
-            return (UrlString.getDomainFromUrl(authority).toLowerCase() ===
-                this.hostnameAndPort);
+            return (authority &&
+                UrlString.getDomainFromUrl(authority).toLowerCase() ===
+                    this.hostnameAndPort);
         });
         return matches.length > 0;
     }
@@ -6009,7 +6317,10 @@ class Authority {
      * helper function to generate environment from authority object
      */
     getPreferredCache() {
-        if (this.discoveryComplete()) {
+        if (this.managedIdentity) {
+            return Constants.DEFAULT_AUTHORITY_HOST;
+        }
+        else if (this.discoveryComplete()) {
             return this.metadata.preferred_cache;
         }
         else {
@@ -6112,6 +6423,28 @@ Authority.reservedTenantDomains = new Set([
     AADAuthorityConstants.CONSUMERS,
     AADAuthorityConstants.ORGANIZATIONS,
 ]);
+/**
+ * Extract tenantId from authority
+ */
+function getTenantFromAuthorityString(authority) {
+    const authorityUrl = new UrlString(authority);
+    const authorityUrlComponents = authorityUrl.getUrlComponents();
+    /**
+     * For credential matching purposes, tenantId is the last path segment of the authority URL:
+     *  AAD Authority - domain/tenantId -> Credentials are cached with realm = tenantId
+     *  B2C Authority - domain/{tenantId}?/.../policy -> Credentials are cached with realm = policy
+     *  tenantId is downcased because B2C policies can have mixed case but tfp claim is downcased
+     */
+    const tenantId = authorityUrlComponents.PathSegments.slice(-1)[0].toLowerCase();
+    switch (tenantId) {
+        case AADAuthorityConstants.COMMON:
+        case AADAuthorityConstants.ORGANIZATIONS:
+        case AADAuthorityConstants.CONSUMERS:
+            return undefined;
+        default:
+            return tenantId;
+    }
+}
 function formatAuthorityUri(authorityUri) {
     return authorityUri.endsWith(Constants.FORWARD_SLASH)
         ? authorityUri
@@ -6297,10 +6630,12 @@ const refreshTokenExpired = "refresh_token_expired";
 // Codes potentially returned by server
 const interactionRequired = "interaction_required";
 const consentRequired = "consent_required";
-const loginRequired = "login_required";
+const loginRequired = "login_required";
+const badToken = "bad_token";
 
 var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    badToken: badToken,
     consentRequired: consentRequired,
     interactionRequired: interactionRequired,
     loginRequired: loginRequired,
@@ -6320,6 +6655,7 @@ const InteractionRequiredServerErrorMessage = [
     interactionRequired,
     consentRequired,
     loginRequired,
+    badToken,
 ];
 const InteractionRequiredAuthSubErrorMessage = [
     "message_only",
@@ -6327,11 +6663,13 @@ const InteractionRequiredAuthSubErrorMessage = [
     "basic_action",
     "user_password_expired",
     "consent_required",
+    "bad_token",
 ];
 const InteractionRequiredAuthErrorMessages = {
     [noTokensFound]: "No refresh token found in the cache. Please sign-in.",
-    [refreshTokenExpired]: "Refresh token has expired.",
     [nativeAccountUnavailable]: "The requested account is not available in the native broker. It may have been deleted or logged out. Please sign-in again using an interactive API.",
+    [refreshTokenExpired]: "Refresh token has expired.",
+    [badToken]: "Identity provider returned bad_token due to an expired or invalid refresh token. Please invoke an interactive API to resolve.",
 };
 /**
  * Interaction required errors defined by the SDK
@@ -6346,6 +6684,10 @@ const InteractionRequiredAuthErrorMessage = {
         code: nativeAccountUnavailable,
         desc: InteractionRequiredAuthErrorMessages[nativeAccountUnavailable],
     },
+    bad_token: {
+        code: badToken,
+        desc: InteractionRequiredAuthErrorMessages[badToken],
+    },
 };
 /**
  * Error thrown when user interaction is required.
@@ -6539,7 +6881,7 @@ class PopTokenGenerator {
             ? new UrlString(resourceRequestUri)
             : undefined;
         const resourceUrlComponents = resourceUrlString?.getUrlComponents();
-        return await this.cryptoUtils.signJwt({
+        return this.cryptoUtils.signJwt({
             at: payload,
             ts: TimeUtils.nowSeconds(),
             m: resourceRequestMethod?.toUpperCase(),
@@ -6746,7 +7088,7 @@ class ResponseHandler {
      * @param serverTokenResponse
      * @param authority
      */
-    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId, rtExpiresOn) {
+    async handleServerTokenResponse(serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.HandleServerTokenResponse, serverTokenResponse.correlation_id);
         // create an idToken object (not entity)
         let idTokenClaims;
@@ -6777,7 +7119,7 @@ class ResponseHandler {
         // Add keyId from request to serverTokenResponse if defined
         serverTokenResponse.key_id =
             serverTokenResponse.key_id || request.sshKid || undefined;
-        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, rtExpiresOn);
+        const cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload);
         let cacheContext;
         try {
             if (this.persistencePlugin && this.serializableCache) {
@@ -6795,10 +7137,10 @@ class ResponseHandler {
                 !forceCacheRefreshTokenResponse &&
                 cacheRecord.account) {
                 const key = cacheRecord.account.generateAccountKey();
-                const account = this.cacheStorage.getAccount(key);
+                const account = this.cacheStorage.getAccount(key, this.logger);
                 if (!account) {
                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                    return ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
+                    return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
             await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache);
@@ -6819,23 +7161,19 @@ class ResponseHandler {
      * @param idTokenObj
      * @param authority
      */
-    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload, rtExpiresOn) {
+    generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenClaims, userAssertionHash, authCodePayload) {
         const env = authority.getPreferredCache();
         if (!env) {
             throw createClientAuthError(invalidCacheEnvironment);
         }
+        const claimsTenantId = getTenantIdFromIdTokenClaims(idTokenClaims);
         // IdToken: non AAD scenarios can have empty realm
         let cachedIdToken;
         let cachedAccount;
         if (serverTokenResponse.id_token && !!idTokenClaims) {
-            cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, idTokenClaims.tid || "");
-            cachedAccount = AccountEntity.createAccount({
-                homeAccountId: this.homeAccountIdentifier,
-                idTokenClaims: idTokenClaims,
-                clientInfo: serverTokenResponse.client_info,
-                cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
-                msGraphHost: authCodePayload?.msgraph_host,
-            }, authority);
+            cachedIdToken = createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token, this.clientId, claimsTenantId || "");
+            cachedAccount = buildAccountToCache(this.cacheStorage, authority, this.homeAccountIdentifier, idTokenClaims, this.cryptoObj.base64Decode, serverTokenResponse.client_info, env, claimsTenantId, authCodePayload, undefined, // nativeAccountId
+            this.logger);
         }
         // AccessToken
         let cachedAccessToken = null;
@@ -6863,11 +7201,19 @@ class ResponseHandler {
                 ? reqTimestamp + refreshIn
                 : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, idTokenClaims?.tid || authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+            cachedAccessToken = createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token, this.clientId, claimsTenantId || authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj.base64Decode, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         let cachedRefreshToken = null;
         if (serverTokenResponse.refresh_token) {
+            let rtExpiresOn;
+            if (serverTokenResponse.refresh_token_expires_in) {
+                const rtExpiresIn = typeof serverTokenResponse.refresh_token_expires_in ===
+                    "string"
+                    ? parseInt(serverTokenResponse.refresh_token_expires_in, 10)
+                    : serverTokenResponse.refresh_token_expires_in;
+                rtExpiresOn = reqTimestamp + rtExpiresIn;
+            }
             cachedRefreshToken = createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token, this.clientId, serverTokenResponse.foci, userAssertionHash, rtExpiresOn);
         }
         // appMetadata
@@ -6927,10 +7273,8 @@ class ResponseHandler {
                 serverTokenResponse?.spa_accountid;
         }
         const accountInfo = cacheRecord.account
-            ? {
-                ...cacheRecord.account.getAccountInfo(),
-                idTokenClaims,
-            }
+            ? updateAccountTenantProfileData(cacheRecord.account.getAccountInfo(), undefined, // tenantProfile optional
+            idTokenClaims)
             : null;
         return {
             authority: authority.canonicalAuthority,
@@ -6959,6 +7303,38 @@ class ResponseHandler {
             fromNativeBroker: false,
         };
     }
+}
+function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClaims, base64Decode, clientInfo, environment, claimsTenantId, authCodePayload, nativeAccountId, logger) {
+    logger?.verbose("setCachedAccount called");
+    // Check if base account is already cached
+    const accountKeys = cacheStorage.getAccountKeys();
+    const baseAccountKey = accountKeys.find((accountKey) => {
+        return accountKey.startsWith(homeAccountId);
+    });
+    let cachedAccount = null;
+    if (baseAccountKey) {
+        cachedAccount = cacheStorage.getAccount(baseAccountKey, logger);
+    }
+    const baseAccount = cachedAccount ||
+        AccountEntity.createAccount({
+            homeAccountId,
+            idTokenClaims,
+            clientInfo,
+            environment,
+            cloudGraphHostName: authCodePayload?.cloud_graph_host_name,
+            msGraphHost: authCodePayload?.msgraph_host,
+            nativeAccountId: nativeAccountId,
+        }, authority, base64Decode);
+    const tenantProfiles = baseAccount.tenantProfiles || [];
+    if (claimsTenantId &&
+        !tenantProfiles.find((tenantProfile) => {
+            return tenantProfile.tenantId === claimsTenantId;
+        })) {
+        const newTenantProfile = buildTenantProfileFromIdTokenClaims(homeAccountId, idTokenClaims);
+        tenantProfiles.push(newTenantProfile);
+    }
+    baseAccount.tenantProfiles = tenantProfiles;
+    return baseAccount;
 }
 
 /*
@@ -7009,7 +7385,7 @@ class AuthorizationCodeClient extends BaseClient {
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin, this.performanceClient);
         // Validate response. This function throws a server error if an error is returned by the server.
         responseHandler.validateTokenResponse(response.body);
-        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId, (TimeUtils.nowSeconds() + 24 * 60 * 60).toString());
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId);
     }
     /**
      * Handles the hash fragment response from public client code request. Returns a code response used by
@@ -7054,7 +7430,7 @@ class AuthorizationCodeClient extends BaseClient {
         let ccsCredential = undefined;
         if (request.clientInfo) {
             try {
-                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils);
+                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
                 ccsCredential = {
                     credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
                     type: CcsCredentialType.HOME_ACCOUNT_ID,
@@ -7086,7 +7462,7 @@ class AuthorizationCodeClient extends BaseClient {
     async createTokenRequestBody(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateTokenRequestBody, request.correlationId);
         const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         /*
          * For hybrid spa flow, there will be a code but no verifier
@@ -7150,7 +7526,7 @@ class AuthorizationCodeClient extends BaseClient {
         let ccsCred = undefined;
         if (request.clientInfo) {
             try {
-                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils);
+                const clientInfo = buildClientInfo(request.clientInfo, this.cryptoUtils.base64Decode);
                 ccsCred = {
                     credential: `${clientInfo.uid}${Separators.CLIENT_INFO_SEPARATOR}${clientInfo.utid}`,
                     type: CcsCredentialType.HOME_ACCOUNT_ID,
@@ -7187,9 +7563,9 @@ class AuthorizationCodeClient extends BaseClient {
         // Add hybrid spa parameters if not already provided
         if (request.enableSpaAuthorizationCode &&
             (!request.tokenBodyParameters ||
-                !request.tokenBodyParameters[AADServerParamKeys.RETURN_SPA_CODE])) {
+                !request.tokenBodyParameters[RETURN_SPA_CODE])) {
             parameterBuilder.addExtraQueryParameters({
-                [AADServerParamKeys.RETURN_SPA_CODE]: "1",
+                [RETURN_SPA_CODE]: "1",
             });
         }
         return parameterBuilder.createQueryString();
@@ -7201,7 +7577,7 @@ class AuthorizationCodeClient extends BaseClient {
     async createAuthCodeUrlQueryString(request) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.AuthClientCreateQueryString, request.correlationId);
         const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.extraQueryParameters?.[AADServerParamKeys.CLIENT_ID] ||
+        parameterBuilder.addClientId(request.extraQueryParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         const requestScopes = [
             ...(request.scopes || []),
@@ -7368,6 +7744,7 @@ class AuthorizationCodeClient extends BaseClient {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+const DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS = 300; // 5 Minutes
 /**
  * OAuth2.0 refresh token client
  * @internal
@@ -7384,7 +7761,7 @@ class RefreshTokenClient extends BaseClient {
         const requestId = response.headers?.[HeaderNames.X_MS_REQUEST_ID];
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
         responseHandler.validateTokenResponse(response.body);
-        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId, request.expiresOn);
+        return invokeAsync(responseHandler.handleServerTokenResponse.bind(responseHandler), PerformanceEvents.HandleServerTokenResponse, this.logger, this.performanceClient, request.correlationId)(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId);
     }
     /**
      * Gets cached refresh token and attaches to request, then calls acquireToken API
@@ -7405,7 +7782,7 @@ class RefreshTokenClient extends BaseClient {
         // if the app is part of the family, retrive a Family refresh token if present and make a refreshTokenRequest
         if (isFOCI) {
             try {
-                return invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
+                return await invokeAsync(this.acquireTokenWithCachedRefreshToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, this.logger, this.performanceClient, request.correlationId)(request, true);
             }
             catch (e) {
                 const noFamilyRTInCache = e instanceof InteractionRequiredAuthError &&
@@ -7438,9 +7815,9 @@ class RefreshTokenClient extends BaseClient {
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
-        if (request.enableRTExpiryCheck &&
-            refreshToken.expiresOn &&
-            Number(refreshToken.expiresOn) < TimeUtils.nowSeconds() + 5 * 60) {
+        if (refreshToken.expiresOn &&
+            TimeUtils.isTokenExpired(refreshToken.expiresOn, request.refreshTokenExpirationOffsetSeconds ||
+                DEFAULT_REFRESH_TOKEN_EXPIRATION_OFFSET_SECONDS)) {
             throw createInteractionRequiredAuthError(refreshTokenExpired);
         }
         // attach cached RT size to the current measurement
@@ -7452,9 +7829,20 @@ class RefreshTokenClient extends BaseClient {
                 credential: request.account.homeAccountId,
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
-            expiresOn: refreshToken.expiresOn,
         };
-        return invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
+        try {
+            return await invokeAsync(this.acquireToken.bind(this), PerformanceEvents.RefreshTokenClientAcquireToken, this.logger, this.performanceClient, request.correlationId)(refreshTokenRequest);
+        }
+        catch (e) {
+            if (e instanceof InteractionRequiredAuthError &&
+                e.subError === badToken) {
+                // Remove bad refresh token from cache
+                this.logger.verbose("acquireTokenWithRefreshToken: bad refresh token, removing from cache");
+                const badRefreshTokenKey = generateCredentialKey(refreshToken);
+                this.cacheManager.removeRefreshToken(badRefreshTokenKey);
+            }
+            throw e;
+        }
     }
     /**
      * Constructs the network message and makes a NW call to the underlying secure token service
@@ -7489,7 +7877,7 @@ class RefreshTokenClient extends BaseClient {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientCreateTokenRequestBody, request.correlationId);
         const correlationId = request.correlationId;
         const parameterBuilder = new RequestParameterBuilder();
-        parameterBuilder.addClientId(request.tokenBodyParameters?.[AADServerParamKeys.CLIENT_ID] ||
+        parameterBuilder.addClientId(request.tokenBodyParameters?.[CLIENT_ID] ||
             this.config.authOptions.clientId);
         if (request.redirectUri) {
             parameterBuilder.addRedirectUri(request.redirectUri);
@@ -7617,25 +8005,35 @@ class SilentFlowClient extends BaseClient {
         if (!request.account) {
             throw createClientAuthError(noAccountInSilentRequest);
         }
-        const environment = request.authority || this.authority.getPreferredCache();
-        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment, this.performanceClient, request.correlationId);
-        if (!cacheRecord.accessToken) {
+        const requestTenantId = request.account.tenantId ||
+            getTenantFromAuthorityString(request.authority);
+        const tokenKeys = this.cacheManager.getTokenKeys();
+        const cachedAccessToken = this.cacheManager.getAccessToken(request.account, request, tokenKeys, requestTenantId, this.performanceClient, request.correlationId);
+        if (!cachedAccessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
-        else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+        else if (TimeUtils.wasClockTurnedBack(cachedAccessToken.cachedAt) ||
+            TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
             // must refresh due to the expires_in value
             this.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED, request.correlationId);
             throw createClientAuthError(tokenRefreshRequired);
         }
-        else if (cacheRecord.accessToken.refreshOn &&
-            TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
+        else if (cachedAccessToken.refreshOn &&
+            TimeUtils.isTokenExpired(cachedAccessToken.refreshOn, 0)) {
             // must refresh (in the background) due to the refresh_in value
             lastCacheOutcome = CacheOutcome.PROACTIVELY_REFRESHED;
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
+        const environment = request.authority || this.authority.getPreferredCache();
+        const cacheRecord = {
+            account: this.cacheManager.readAccountFromCache(request.account),
+            accessToken: cachedAccessToken,
+            idToken: this.cacheManager.getIdToken(request.account, tokenKeys, requestTenantId, this.performanceClient, request.correlationId),
+            refreshToken: null,
+            appMetadata: this.cacheManager.readAppMetadataFromCache(environment),
+        };
         this.setCacheOutcome(lastCacheOutcome, request.correlationId);
         if (this.config.serverTelemetryManager) {
             this.config.serverTelemetryManager.incrementCacheHits();
@@ -7672,31 +8070,7 @@ class SilentFlowClient extends BaseClient {
             }
             checkMaxAge(authTime, request.maxAge);
         }
-        return await ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
-    }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class ThrottlingEntity {
-    /**
-     * validates if a given cache entry is "Throttling", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isThrottlingEntity(key, entity) {
-        let validateKey = false;
-        if (key) {
-            validateKey =
-                key.indexOf(ThrottlingConstants.THROTTLING_PREFIX) === 0;
-        }
-        let validateEntity = true;
-        if (entity) {
-            validateEntity = entity.hasOwnProperty("throttleTime");
-        }
-        return validateKey && validateEntity;
+        return ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenClaims);
     }
 }
 
@@ -8039,6 +8413,83 @@ class ServerTelemetryManager {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+class StubPerformanceMeasurement {
+    startMeasurement() {
+        return;
+    }
+    endMeasurement() {
+        return;
+    }
+    flushMeasurement() {
+        return null;
+    }
+}
+class StubPerformanceClient {
+    generateId() {
+        return "callback-id";
+    }
+    startMeasurement(measureName, correlationId) {
+        return {
+            end: () => null,
+            discard: () => { },
+            add: () => { },
+            increment: () => { },
+            event: {
+                eventId: this.generateId(),
+                status: PerformanceEventStatus.InProgress,
+                authority: "",
+                libraryName: "",
+                libraryVersion: "",
+                clientId: "",
+                name: measureName,
+                startTimeMs: Date.now(),
+                correlationId: correlationId || "",
+            },
+            measurement: new StubPerformanceMeasurement(),
+        };
+    }
+    startPerformanceMeasurement() {
+        return new StubPerformanceMeasurement();
+    }
+    calculateQueuedTime() {
+        return 0;
+    }
+    addQueueMeasurement() {
+        return;
+    }
+    setPreQueueTime() {
+        return;
+    }
+    endMeasurement() {
+        return null;
+    }
+    discardMeasurements() {
+        return;
+    }
+    removePerformanceCallback() {
+        return true;
+    }
+    addPerformanceCallback() {
+        return "";
+    }
+    emitEvents() {
+        return;
+    }
+    addFields() {
+        return;
+    }
+    incrementFields() {
+        return;
+    }
+    cacheEventByCorrelationId() {
+        return;
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8080,6 +8531,7 @@ class PerformanceClient {
      * @param {string} measureName
      * @param {string} correlationId
      * @returns {IPerformanceMeasurement}
+     * @deprecated This method will be removed in the next major version
      */
     startPerformanceMeasurement(measureName, // eslint-disable-line @typescript-eslint/no-unused-vars
     correlationId // eslint-disable-line @typescript-eslint/no-unused-vars
@@ -8185,8 +8637,6 @@ class PerformanceClient {
             this.logger.info(`PerformanceClient: No correlation id provided for ${measureName}, generating`, eventCorrelationId);
         }
         this.logger.trace(`PerformanceClient: Performance measurement started for ${measureName}`, eventCorrelationId);
-        const performanceMeasurement = this.startPerformanceMeasurement(measureName, eventCorrelationId);
-        performanceMeasurement.startMeasurement();
         const inProgressEvent = {
             eventId: this.generateId(),
             status: PerformanceEventStatus.InProgress,
@@ -8210,7 +8660,7 @@ class PerformanceClient {
                     ...inProgressEvent,
                     // Properties set when event ends
                     ...event,
-                }, performanceMeasurement);
+                });
             },
             discard: () => {
                 return this.discardMeasurements(inProgressEvent.correlationId);
@@ -8221,8 +8671,8 @@ class PerformanceClient {
             increment: (fields) => {
                 return this.incrementFields(fields, inProgressEvent.correlationId);
             },
-            measurement: performanceMeasurement,
             event: inProgressEvent,
+            measurement: new StubPerformanceMeasurement(),
         };
     }
     /**
@@ -8235,7 +8685,7 @@ class PerformanceClient {
      * @param {IPerformanceMeasurement} measurement
      * @returns {(PerformanceEvent | null)}
      */
-    endMeasurement(event, measurement) {
+    endMeasurement(event) {
         const rootEvent = this.eventsByCorrelationId.get(event.correlationId);
         if (!rootEvent) {
             this.logger.trace(`PerformanceClient: Measurement not found for ${event.eventId}`, event.correlationId);
@@ -8254,13 +8704,7 @@ class PerformanceClient {
         else {
             rootEvent.incompleteSubMeasurements?.delete(event.eventId);
         }
-        measurement?.endMeasurement();
-        const durationMs = measurement?.flushMeasurement();
-        // null indicates no measurement was taken (e.g. needed performance APIs not present)
-        if (!durationMs) {
-            this.logger.trace("PerformanceClient: Performance measurement not taken", rootEvent.correlationId);
-            return null;
-        }
+        const durationMs = event.durationMs || this.getDurationMs(event.startTimeMs);
         this.logger.trace(`PerformanceClient: Performance measurement ended for ${event.name}: ${durationMs} ms`, event.correlationId);
         // Add sub-measurement attribute to root event.
         if (!isRoot) {
@@ -8447,82 +8891,15 @@ class PerformanceClient {
             }
         });
     }
-}
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class StubPerformanceMeasurement {
-    startMeasurement() {
-        return;
-    }
-    endMeasurement() {
-        return;
-    }
-    flushMeasurement() {
-        return null;
-    }
-}
-class StubPerformanceClient {
-    generateId() {
-        return "callback-id";
-    }
-    startMeasurement(measureName, correlationId) {
-        return {
-            end: () => null,
-            discard: () => { },
-            add: () => { },
-            increment: () => { },
-            event: {
-                eventId: this.generateId(),
-                status: PerformanceEventStatus.InProgress,
-                authority: "",
-                libraryName: "",
-                libraryVersion: "",
-                clientId: "",
-                name: measureName,
-                startTimeMs: Date.now(),
-                correlationId: correlationId || "",
-            },
-            measurement: new StubPerformanceMeasurement(),
-        };
-    }
-    startPerformanceMeasurement() {
-        return new StubPerformanceMeasurement();
-    }
-    calculateQueuedTime() {
-        return 0;
-    }
-    addQueueMeasurement() {
-        return;
-    }
-    setPreQueueTime() {
-        return;
-    }
-    endMeasurement() {
-        return null;
-    }
-    discardMeasurements() {
-        return;
-    }
-    removePerformanceCallback() {
-        return true;
-    }
-    addPerformanceCallback() {
-        return "";
-    }
-    emitEvents() {
-        return;
-    }
-    addFields() {
-        return;
-    }
-    incrementFields() {
-        return;
-    }
-    cacheEventByCorrelationId() {
-        return;
+    /**
+     * Returns event duration in milliseconds
+     * @param startTimeMs {number}
+     * @returns {number}
+     */
+    getDurationMs(startTimeMs) {
+        const durationMs = Date.now() - startTimeMs;
+        // Handle clock skew
+        return durationMs < 0 ? durationMs : 0;
     }
 }
 
@@ -8562,6 +8939,7 @@ exports.Constants = Constants;
 exports.CredentialType = CredentialType;
 exports.DEFAULT_CRYPTO_IMPLEMENTATION = DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = DEFAULT_SYSTEM_OPTIONS;
+exports.DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = DEFAULT_TOKEN_RENEWAL_OFFSET_SEC;
 exports.DefaultStorageClass = DefaultStorageClass;
 exports.Errors = Errors;
 exports.GrantType = GrantType;
@@ -8590,7 +8968,6 @@ exports.RefreshTokenClient = RefreshTokenClient;
 exports.RequestParameterBuilder = RequestParameterBuilder;
 exports.ResponseHandler = ResponseHandler;
 exports.ResponseMode = ResponseMode;
-exports.SSOTypes = SSOTypes;
 exports.ScopeSet = ScopeSet;
 exports.ServerError = ServerError;
 exports.ServerResponseType = ServerResponseType;
@@ -8601,21 +8978,25 @@ exports.StubPerformanceClient = StubPerformanceClient;
 exports.StubbedNetworkModule = StubbedNetworkModule;
 exports.THE_FAMILY_ID = THE_FAMILY_ID;
 exports.ThrottlingConstants = ThrottlingConstants;
-exports.ThrottlingEntity = ThrottlingEntity;
 exports.ThrottlingUtils = ThrottlingUtils;
 exports.TimeUtils = TimeUtils;
 exports.TokenCacheContext = TokenCacheContext;
 exports.UrlString = UrlString;
 exports.UrlUtils = UrlUtils;
+exports.buildAccountToCache = buildAccountToCache;
 exports.buildClientInfo = buildClientInfo;
 exports.buildClientInfoFromHomeAccountId = buildClientInfoFromHomeAccountId;
 exports.buildStaticAuthorityOptions = buildStaticAuthorityOptions;
+exports.buildTenantProfileFromIdTokenClaims = buildTenantProfileFromIdTokenClaims;
 exports.createAuthError = createAuthError;
 exports.createClientAuthError = createClientAuthError;
 exports.createClientConfigurationError = createClientConfigurationError;
 exports.createInteractionRequiredAuthError = createInteractionRequiredAuthError;
 exports.formatAuthorityUri = formatAuthorityUri;
+exports.getTenantIdFromIdTokenClaims = getTenantIdFromIdTokenClaims;
 exports.invoke = invoke;
 exports.invokeAsync = invokeAsync;
+exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
+exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
 //# sourceMappingURL=index.cjs.map