Library version used
4.83.1 - 4.85.0
.NET version
net10
windowsAppSDK 2.2.0
visual studio 2026
windows 11
Scenario
PublicClient - desktop app
Is this a new or an existing app?
The app is in production, and I have upgraded to a new version of MSAL
Issue description and reproduction steps
When I need to test MSAL authentication on a WINUI app, I use the example https://github.com/Azure-Samples/ms-identity-netcore-winui
Up until version 4.83.1 of the Microsoft.Identity.Client.Extensions.Msal package, everything worked fine. Starting with version 4.83.3, the behavior changes as follows:
When signing out with RemoveAsync, a subsequent call to AcquireTokenSilent, for a sign-in with a WAM broker, still finds the token and doesn't require interactive authentication.
Up until version 4.83.1, however, AcquireTokenInteractive was called correctly.
Everything happens in method SignInUserAndAcquireAccessToken of the MSALClientHelper.cs file.
You can test this behavior by downloading the code from the GitHub repository https://github.com/Azure-Samples/ms-identity-netcore-winui and trying to run it with different versions of this package from 4.83.1 to 4.83.3 and all next versions.
Relevant code snippets
public async Task<string> SignInUserAndAcquireAccessToken(string[] scopes)
{
var existingUser = await FetchSignedInUserFromCache().ConfigureAwait(false);
try
{
// 1. Try to sign-in the previously signed-in account
if (existingUser != null)
{
this.AuthResult = await this.PublicClientApplication.AcquireTokenSilent(scopes, existingUser)
.ExecuteAsync().ConfigureAwait(false);
}
else
{
if (this.IsBrokerInitialized)
{
Console.WriteLine("No accounts found in the cache. Trying Window's default account.");
this.AuthResult = await this.PublicClientApplication
.AcquireTokenSilent(scopes, Microsoft.Identity.Client.PublicClientApplication.OperatingSystemAccount)
.ExecuteAsync()
.ConfigureAwait(false);
}
else
{
this.AuthResult = await SignInUserInteractivelyAsync(scopes);
}
}
}
catch (MsalUiRequiredException ex)
{
// A MsalUiRequiredException happened on AcquireTokenSilentAsync. This indicates you need to call AcquireTokenInteractive to acquire a token interactively
Debug.WriteLine($"MsalUiRequiredException: {ex.Message}");
// Must be called from UI thread
this.AuthResult = await this.PublicClientApplication.AcquireTokenInteractive(scopes)
.WithLoginHint(existingUser?.Username ?? String.Empty)
.ExecuteAsync()
.ConfigureAwait(false);
}
catch (MsalException msalEx)
{
Debug.WriteLine($"Error Acquiring Token:{Environment.NewLine}{msalEx}");
}
return this.AuthResult.AccessToken;
}
Expected behavior
Up until version 4.83.1, after signing out with RemoveAsync, calling this method to sign in again with the WAM broker causes the call to AcquireTokenSilent to throw a "failed_to_acquire_token_silently_from_broker" exception. So, within the catch branch, call AcquireTokenInteractive and present the window for entering authentication.
Why has the behavior changed since version 4.83.3 and the exception is no longer thrown?
Does this perhaps require different code?
Identity provider
Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)
Regression
MSAL version: 4.83.1
Solution and workarounds
use version 4.83.1 and stop upgrading to next version
Library version used
4.83.1 - 4.85.0
.NET version
net10
windowsAppSDK 2.2.0
visual studio 2026
windows 11
Scenario
PublicClient - desktop app
Is this a new or an existing app?
The app is in production, and I have upgraded to a new version of MSAL
Issue description and reproduction steps
When I need to test MSAL authentication on a WINUI app, I use the example https://github.com/Azure-Samples/ms-identity-netcore-winui
Up until version 4.83.1 of the Microsoft.Identity.Client.Extensions.Msal package, everything worked fine. Starting with version 4.83.3, the behavior changes as follows:
When signing out with RemoveAsync, a subsequent call to AcquireTokenSilent, for a sign-in with a WAM broker, still finds the token and doesn't require interactive authentication.
Up until version 4.83.1, however, AcquireTokenInteractive was called correctly.
Everything happens in method SignInUserAndAcquireAccessToken of the MSALClientHelper.cs file.
You can test this behavior by downloading the code from the GitHub repository https://github.com/Azure-Samples/ms-identity-netcore-winui and trying to run it with different versions of this package from 4.83.1 to 4.83.3 and all next versions.
Relevant code snippets
Expected behavior
Up until version 4.83.1, after signing out with RemoveAsync, calling this method to sign in again with the WAM broker causes the call to AcquireTokenSilent to throw a "failed_to_acquire_token_silently_from_broker" exception. So, within the catch branch, call AcquireTokenInteractive and present the window for entering authentication.
Why has the behavior changed since version 4.83.3 and the exception is no longer thrown?
Does this perhaps require different code?
Identity provider
Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)
Regression
MSAL version: 4.83.1
Solution and workarounds
use version 4.83.1 and stop upgrading to next version