Office365-REST-Python-Client 3.0.0__py3-none-any.whl → 3.1.0__py3-none-any.whl

office365/reports/root.py

@@ -4,8 +4,14 @@ from typing import Optional, Union
 from office365.directory.authentication.methods.root import AuthenticationMethodsRoot
 from office365.directory.permissions.require_permission import require_permission
 from office365.entity import Entity
+from office365.entity_collection import EntityCollection
 from office365.partners.partners import Partners
-from office365.reports.internal.queries.create_report_query import create_report_query
+from office365.reports.internal.queries.create_report_query import (
+    create_report_query,
+    create_report_stream_query,
+)
+from office365.reports.print_usage_by_printer import PrintUsageByPrinter
+from office365.reports.print_usage_by_user import PrintUsageByUser
 from office365.reports.report import Report
 from office365.reports.security.root import SecurityReportsRoot
 from office365.runtime.client_result import ClientResult
@@ -84,9 +90,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getEmailActivityUserCounts", period)
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getEmailActivityUserCounts", period)
 
     def get_email_activity_user_detail(self, period: str) -> ClientResult[bytes]:
         """Get details about email activity users have performed.
@@ -96,10 +100,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getEmailActivityUserDetail", period, return_stream=True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getEmailActivityUserDetail", period)
 
     def get_email_app_usage_apps_user_counts(self, period: str) -> ClientResult[Report]:
         """Get the count of unique users per email app.
@@ -109,10 +110,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getEmailAppUsageAppsUserCounts", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getEmailAppUsageAppsUserCounts", period)
 
     def get_email_app_usage_user_counts(self, period) -> ClientResult[bytes]:
         """Get the count of unique users that connected to Exchange Online using any email app.
@@ -122,12 +120,8 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getEmailAppUsageUserCounts", period, True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getEmailAppUsageUserCounts", period)
 
-    ###
     def get_email_app_usage_user_detail(self, period: str) -> ClientResult[bytes]:
         """Get details about which activities users performed on the various email apps.
 
@@ -136,10 +130,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getEmailAppUsageUserDetail", period, True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getEmailAppUsageUserDetail", period)
 
     def get_mailbox_usage_storage(self, period: str) -> ClientResult[bytes]:
         """Get the amount of storage used in your organization.
@@ -149,10 +140,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getMailboxUsageStorage", period, True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getMailboxUsageStorage", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_m365_app_user_counts(self, period: Optional[str] = None) -> ClientResult[bytes]:
@@ -177,16 +165,11 @@ class ReportRoot(Entity):
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_office365_activation_counts(self):
         """Get the count of Microsoft 365 activations on desktops and devices."""
-        qry = create_report_query(self, "getOffice365ActivationCounts")
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getOffice365ActivationCounts")
 
     def get_office365_activations_user_counts(self) -> ClientResult[Report]:
         """Get the count of Microsoft 365 activations on desktops and devices."""
-        qry = create_report_query(self, "getOffice365ActivationsUserCounts")
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getOffice365ActivationsUserCounts")
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_onedrive_activity_file_counts(self, period: str) -> ClientResult[Report]:
@@ -197,10 +180,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getOneDriveActivityFileCounts", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getOneDriveActivityFileCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_onedrive_activity_user_counts(self, period: str) -> ClientResult[Report]:
@@ -211,10 +191,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getOneDriveActivityUserCounts", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getOneDriveActivityUserCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_onedrive_activity_user_detail(self, period: str):
@@ -225,9 +202,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getOneDriveActivityUserDetail", period)
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getOneDriveActivityUserDetail", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_onedrive_usage_file_counts(self, period: str) -> ClientResult[Report]:
@@ -239,10 +214,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getOneDriveUsageFileCounts", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getOneDriveUsageFileCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_onedrive_usage_storage(self, period) -> ClientResult[bytes]:
@@ -253,9 +225,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getOneDriveUsageStorage", period)
-        self.context.add_query(qry)
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getOneDriveUsageStorage", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_mailbox_usage_detail(self, period) -> ClientResult[Report]:
@@ -266,9 +236,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getMailboxUsageDetail", period)
-        self.context.add_query(qry)
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getMailboxUsageDetail", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_mailbox_usage_mailbox_counts(self, period: str) -> ClientResult[bytes]:
@@ -280,10 +248,7 @@ class ReportRoot(Entity):
               for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
               the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getMailboxUsageMailboxCounts", period, True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getMailboxUsageMailboxCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_mailbox_usage_quota_status_mailbox_counts(self, period: str):
@@ -292,9 +257,7 @@ class ReportRoot(Entity):
           for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
           the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getMailboxUsageQuotaStatusMailboxCounts", period)
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getMailboxUsageQuotaStatusMailboxCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_sharepoint_activity_pages(self, period: str):
@@ -305,9 +268,7 @@ class ReportRoot(Entity):
             for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents
             the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getSharePointActivityPages", period)
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getSharePointActivityPages", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_teams_user_activity_user_counts(self, period: str) -> ClientResult[Report]:
@@ -317,10 +278,7 @@ class ReportRoot(Entity):
         Args:
             period (str): Specifies the length of time over which the report is aggregated.
         """
-        qry = create_report_query(self, "getTeamsUserActivityUserCounts", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getTeamsUserActivityUserCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_sharepoint_activity_user_counts(self, period: str):
@@ -332,9 +290,7 @@ class ReportRoot(Entity):
             The supported values for {period_value} are: D7, D30, D90, and D180. These values follow the
             format Dn where n represents the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getSharePointActivityUserCounts", period)
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getSharePointActivityUserCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_sharepoint_activity_user_detail(self, period: str):
@@ -345,9 +301,7 @@ class ReportRoot(Entity):
             The supported values for {period_value} are: D7, D30, D90, and D180. These values follow the
             format Dn where n represents the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getSharePointActivityUserDetail", period)
-        self.context.add_query(qry)
-        return qry.return_type
+        return create_report_query(self, "getSharePointActivityUserDetail", period)
 
     def get_sharepoint_site_usage_detail(self, period: str) -> ClientResult[Report]:
         """Get details about SharePoint site usage.
@@ -357,10 +311,7 @@ class ReportRoot(Entity):
             The supported values for {period_value} are: D7, D30, D90, and D180. These values follow the format
             Dn where n represents the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getSharePointSiteUsageDetail", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getSharePointSiteUsageDetail", period)
 
     def get_sharepoint_site_usage_site_counts(self, period: str) -> ClientResult[Report]:
         """Get the trend of total and active site count during the reporting period.
@@ -370,10 +321,7 @@ class ReportRoot(Entity):
             The supported values for {period_value} are: D7, D30, D90, and D180. These values follow the format
             Dn where n represents the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getSharePointSiteUsageSiteCounts", period)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_query(self, "getSharePointSiteUsageSiteCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_teams_team_counts(self, period: str) -> ClientResult[bytes]:
@@ -384,10 +332,7 @@ class ReportRoot(Entity):
             The supported values for {period_value} are: D7, D30, D90, and D180. These values follow the
             format Dn where n represents the number of days over which the report is aggregated. Required.
         """
-        qry = create_report_query(self, "getTeamsTeamCounts", period, return_stream=True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getTeamsTeamCounts", period)
 
     @require_permission(delegated=["Reports.Read.All"], application=["Reports.Read.All"])
     def get_teams_user_activity_counts(self, period: str) -> ClientResult[bytes]:
@@ -395,10 +340,7 @@ class ReportRoot(Entity):
         Get the number of Microsoft Teams activities by activity type.
         The activities are performed by Microsoft Teams licensed users.
         """
-        qry = create_report_query(self, "getTeamsUserActivityCounts", period, return_stream=True)
-        self.context.add_query(qry)
-        assert qry.return_type is not None
-        return qry.return_type  # type: ignore[return-type]
+        return create_report_stream_query(self, "getTeamsUserActivityCounts", period)
 
     @odata(name="authenticationMethods")
     @property
@@ -412,15 +354,55 @@ class ReportRoot(Entity):
     @property
     def partners(self) -> Partners:
         """Represents billing details for a Microsoft direct partner."""
-        return self.properties.get(
-            "partners",
-            Partners(self.context, ResourcePath("partners", self.resource_path)),
-        )
+        return self.properties.get("partners", Partners(self.context, ResourcePath("partners", self.resource_path)))
 
     @property
     def security(self) -> SecurityReportsRoot:
         """Container for navigation properties for Azure AD authentication methods resources."""
         return self.properties.get(
-            "security",
-            SecurityReportsRoot(self.context, ResourcePath("security", self.resource_path)),
+            "security", SecurityReportsRoot(self.context, ResourcePath("security", self.resource_path))
+        )
+
+    @property
+    def daily_print_usage_by_printer(self) -> EntityCollection[PrintUsageByPrinter]:
+        """Gets the dailyPrintUsageByPrinter property"""
+        return self.properties.get(
+            "dailyPrintUsageByPrinter",
+            EntityCollection[PrintUsageByPrinter](
+                self.context, PrintUsageByPrinter, ResourcePath("dailyPrintUsageByPrinter", self.resource_path)
+            ),
+        )
+
+    @property
+    def daily_print_usage_by_user(self) -> EntityCollection[PrintUsageByUser]:
+        """Gets the dailyPrintUsageByUser property"""
+        return self.properties.get(
+            "dailyPrintUsageByUser",
+            EntityCollection[PrintUsageByUser](
+                self.context, PrintUsageByUser, ResourcePath("dailyPrintUsageByUser", self.resource_path)
+            ),
+        )
+
+    @property
+    def monthly_print_usage_by_printer(self) -> EntityCollection[PrintUsageByPrinter]:
+        """Gets the monthlyPrintUsageByPrinter property"""
+        return self.properties.get(
+            "monthlyPrintUsageByPrinter",
+            EntityCollection[PrintUsageByPrinter](
+                self.context, PrintUsageByPrinter, ResourcePath("monthlyPrintUsageByPrinter", self.resource_path)
+            ),
         )
+
+    @property
+    def monthly_print_usage_by_user(self) -> EntityCollection[PrintUsageByUser]:
+        """Gets the monthlyPrintUsageByUser property"""
+        return self.properties.get(
+            "monthlyPrintUsageByUser",
+            EntityCollection[PrintUsageByUser](
+                self.context, PrintUsageByUser, ResourcePath("monthlyPrintUsageByUser", self.resource_path)
+            ),
+        )
+
+    @property
+    def entity_type_name(self) -> str:
+        return "microsoft.graph.ReportRoot"

office365/runtime/auth/authentication_context.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import sys
+import threading
 from datetime import datetime, timedelta, timezone
 from typing import Any, Callable, Dict, List, Union
 
@@ -14,8 +15,9 @@ from office365.runtime.auth.providers.cookie_provider import CookieAuthProvider
 from office365.runtime.auth.providers.saml_token_provider import SamlTokenProvider
 from office365.runtime.auth.token_response import TokenResponse
 from office365.runtime.auth.user_credential import UserCredential
+from office365.runtime.decorators import deprecated
 from office365.runtime.http.request_options import RequestOptions
-from office365.runtime.utilities import deprecated, get_absolute_url
+from office365.runtime.http.url import get_absolute_url
 
 
 def _get_authorization_header(token: Any) -> str:
@@ -31,6 +33,7 @@ class AuthenticationContext:
         environment: AzureEnvironment = AzureEnvironment.Global,
         allow_ntlm: bool = False,
         browser_mode: bool = False,
+        authority: str | None = None,
     ):
         """
         Initialize authentication context
@@ -40,14 +43,35 @@ class AuthenticationContext:
             environment: Office 365 Cloud Environment endpoint (default: AzureEnvironment.Global)
             allow_ntlm: Whether NTLM authentication is enabled (default: False)
             browser_mode: Enable browser authentication (default: False)
+            authority: Override the MSAL authority URL, e.g. for Entra External ID (CIAM):
+                https://<tenant>.ciamlogin.com
         """
         self.url = url.rstrip("/")
         self._authenticate = None
         self._cached_token = None
         self._environment = environment
+        self._lock = threading.RLock()
         self._allow_ntlm = allow_ntlm
         self._browser_mode = browser_mode
         self._token_expires = datetime.max.replace(tzinfo=timezone.utc)
+        self._authority = authority
+
+    def _get_authority_url(self, tenant: str) -> str:
+        """MSAL authority URL, overridable for Entra External ID (CIAM) tenants."""
+        if self._authority is not None:
+            return self._authority
+        return f"{get_login_authority(self._environment)}/{tenant}"
+
+    def with_authority(self, authority: str) -> Self:
+        """Override the MSAL authority URL, e.g. for Entra External ID (CIAM) tenants:
+
+            https://<tenant>.ciamlogin.com
+
+        Args:
+            authority: Full authority URL used by all subsequent token acquisitions
+        """
+        self._authority = authority
+        return self
 
     def with_client_secret(
         self,
@@ -72,7 +96,7 @@ class AuthenticationContext:
             scopes = [f"{resource}/.default"]
 
         def _acquire_token():
-            authority_url = f"{get_login_authority(self._environment)}/{tenant}"
+            authority_url = self._get_authority_url(tenant)
             import msal
 
             app = msal.ConfidentialClientApplication(
@@ -121,7 +145,7 @@ class AuthenticationContext:
                 private_key = f.read()
 
         def _acquire_token():
-            authority_url = f"{get_login_authority(self._environment)}/{tenant}"
+            authority_url = self._get_authority_url(tenant)
             credentials = {
                 "thumbprint": thumbprint,
                 "private_key": private_key,
@@ -161,7 +185,7 @@ class AuthenticationContext:
 
             app = msal.PublicClientApplication(
                 client_id,
-                authority=f"{get_login_authority(self._environment)}/{tenant}",
+                authority=self._get_authority_url(tenant),
                 client_credential=None,
             )
             result = app.acquire_token_interactive(scopes=scopes)
@@ -191,7 +215,7 @@ class AuthenticationContext:
 
             app = msal.PublicClientApplication(
                 client_id,
-                authority=f"{get_login_authority(self._environment)}/{tenant}",
+                authority=self._get_authority_url(tenant),
                 client_credential=None,
             )
 
@@ -223,15 +247,17 @@ class AuthenticationContext:
             request_time = datetime.now(timezone.utc)
 
             if self._cached_token is None or request_time > self._token_expires:
-                token_res = token_func()
-                if isinstance(token_res, TokenResponse):
-                    self._cached_token = token_res
-                else:
-                    self._cached_token = TokenResponse.from_json(token_res)
-
-                if hasattr(self._cached_token, "expiresIn"):  # type: ignore[reportAttributeAccessIssue]
-                    expires_in = self._cached_token.expiresIn  # type: ignore[reportAttributeAccessIssue]
-                    self._token_expires = request_time + timedelta(seconds=int(expires_in))
+                with self._lock:
+                    if self._cached_token is None or request_time > self._token_expires:
+                        token_res = token_func()
+                        if isinstance(token_res, TokenResponse):
+                            self._cached_token = token_res
+                        else:
+                            self._cached_token = TokenResponse.from_json(token_res)
+
+                        if hasattr(self._cached_token, "expiresIn"):  # type: ignore[reportAttributeAccessIssue]
+                            expires_in = self._cached_token.expiresIn  # type: ignore[reportAttributeAccessIssue]
+                            self._token_expires = request_time + timedelta(seconds=int(expires_in))
             request.set_header("Authorization", _get_authorization_header(self._cached_token))
 
         self._authenticate = _authenticate
@@ -271,7 +297,7 @@ class AuthenticationContext:
         """
         import msal
 
-        authority_url = f"{get_login_authority(self._environment)}/{tenant}"
+        authority_url = self._get_authority_url(tenant)
 
         app = msal.PublicClientApplication(
             authority=authority_url,

office365/runtime/auth/entra/authentication_context.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import sys
+import threading
 from typing import Any, Callable, Dict, List, Optional
 
 from typing_extensions import Self
@@ -22,11 +23,14 @@ class AuthenticationContext:
         scopes: List[str] | None = None,
         token_cache: Any = None,
         environment: AzureEnvironment = AzureEnvironment.Global,
+        authority: str | None = None,
     ):
         """Args:
         tenant (str): Tenant name, for example: contoso.onmicrosoft.com
         scopes (list[str] or None): Scopes requested to access an API
         token_cache (Any): Default cache is in memory only, Refer https://msal-python.readthedocs.io/en/latest/#msal.SerializableTokenCache
+        authority (str or None): Override the MSAL authority URL, e.g. for Entra External ID (CIAM):
+            https://<tenant>.ciamlogin.com
         """
         self._tenant = tenant
         if scopes is None:
@@ -36,12 +40,15 @@ class AuthenticationContext:
         self._token_callback = None
         self._environment = environment
         self._client_id: str | None = None
+        self._authority = authority
+        self._lock = threading.Lock()
 
     def acquire_token(self) -> TokenResponse:
-        """Acquire access token"""
+        """Acquire access token (single-flight under concurrent batches)."""
         if not self._token_callback:
             raise ValueError("Token callback is not set.")
-        token_resp = self._token_callback()
+        with self._lock:
+            token_resp = self._token_callback()
         token = TokenResponse.from_json(token_resp)
         return token
 
@@ -196,4 +203,17 @@ class AuthenticationContext:
 
     @property
     def authority_url(self) -> str:
+        if self._authority is not None:
+            return self._authority
         return f"{get_login_authority(self._environment)}/{self._tenant}"
+
+    def with_authority(self, authority: str) -> Self:
+        """Override the MSAL authority URL, e.g. for Entra External ID (CIAM) tenants:
+
+            https://<tenant>.ciamlogin.com
+
+        Args:
+            authority: Full authority URL used by all subsequent token acquisitions
+        """
+        self._authority = authority
+        return self

office365/runtime/auth/providers/acs_token_provider.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
+import threading
 from typing import Optional
+from urllib.parse import urlparse
 
 import requests
 
@@ -9,7 +11,6 @@ from office365.runtime.auth.authentication_provider import AuthenticationProvide
 from office365.runtime.auth.client_credential import ClientCredential
 from office365.runtime.auth.token_response import TokenResponse
 from office365.runtime.http.request_options import RequestOptions
-from office365.runtime.utilities import urlparse
 
 
 class ACSTokenProvider(AuthenticationProvider):
@@ -36,11 +37,14 @@ class ACSTokenProvider(AuthenticationProvider):
         self._credential = credential
         self._cached_token: Optional[TokenResponse] = None
         self._environment = environment
+        self._lock = threading.Lock()
 
     def authenticate_request(self, request: RequestOptions) -> None:
         """Authenticate the request with an access token."""
         if self._cached_token is None:
-            self._cached_token = self.get_app_only_access_token()
+            with self._lock:
+                if self._cached_token is None:
+                    self._cached_token = self.get_app_only_access_token()
         request.set_header("Authorization", self._cached_token.authorization_header)
 
     def get_app_only_access_token(self) -> TokenResponse:

office365/runtime/auth/providers/cookie_provider.py

@@ -1,3 +1,4 @@
+import threading
 from datetime import datetime, timedelta, timezone
 from typing import Callable, Dict, Optional, Union
 
@@ -23,6 +24,7 @@ class CookieAuthProvider(AuthenticationProvider):
         self._ttl_seconds = ttl_seconds
         self._cached_auth_cookies: Optional[AuthCookies] = None
         self._acquired_at: Optional[datetime] = None
+        self._lock = threading.Lock()
 
     def refresh(self) -> None:
         """Clears the cached cookies so that the next request reacquires them."""
@@ -60,9 +62,11 @@ class CookieAuthProvider(AuthenticationProvider):
     def _ensure_cookies_cached(self) -> None:
         now_utc = datetime.now(timezone.utc)
         if self._is_expired(now_utc):
-            cookies = self._acquire_from_source()
-            self._cached_auth_cookies = cookies
-            self._acquired_at = now_utc
+            with self._lock:
+                if self._is_expired(now_utc):
+                    cookies = self._acquire_from_source()
+                    self._cached_auth_cookies = cookies
+                    self._acquired_at = now_utc
 
     def authenticate_request(self, request) -> None:
         """Sets the Cookie header using cached or freshly acquired cookies."""

office365/runtime/auth/providers/saml_token_provider.py

@@ -1,4 +1,5 @@
 import os
+import threading
 import uuid
 from datetime import datetime, timezone
 from typing import Dict, Optional
@@ -60,6 +61,7 @@ class SamlTokenProvider(AuthenticationProvider, office365.logger.LoggerContext):
         self.error = ""
         self._credential = credential
         self._cached_auth_cookies: Optional[AuthCookies] = None
+        self._lock = threading.Lock()
         self.__ns_prefixes = {
             "S": "{http://www.w3.org/2003/05/soap-envelope}",
             "s": "{http://www.w3.org/2003/05/soap-envelope}",
@@ -84,8 +86,10 @@ class SamlTokenProvider(AuthenticationProvider, office365.logger.LoggerContext):
 
         request_time = datetime.now(timezone.utc)
         if self._cached_auth_cookies is None or request_time >= self._sts_profile.expires:
-            self._sts_profile.reset()
-            self._cached_auth_cookies = self.get_authentication_cookie()
+            with self._lock:
+                if self._cached_auth_cookies is None or request_time >= self._sts_profile.expires:
+                    self._sts_profile.reset()
+                    self._cached_auth_cookies = self.get_authentication_cookie()
         logger.debug_secrets(self._cached_auth_cookies)  # type: ignore[reportAttributeAccessIssue]
         request.set_header("Cookie", self._cached_auth_cookies.cookie_header)
 

office365/runtime/auth/sts_profile.py

@@ -1,7 +1,7 @@
 from datetime import datetime, timedelta, timezone
+from urllib.parse import urlparse
 
 from office365.azure_env import AzureEnvironment, get_login_authority
-from office365.runtime.utilities import urlparse
 
 
 class STSProfile: