Cache service principal access tokens across operations - #29858
Open
keystroke wants to merge 2 commits into
Open
Cache service principal access tokens across operations#29858keystroke wants to merge 2 commits into
keystroke wants to merge 2 commits into
Conversation
| Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status. |
Contributor
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request re-enables effective service principal (app-only) access token reuse in Az.Accounts by introducing a separate, process-local MSAL token cache for app-only credentials, while keeping the existing user-token cache isolated to avoid prior collisions.
Changes:
- Added a shared in-memory app-only token cache (
GetAppTokenCachePersistenceOptions) and wired it into service principal and client assertion credentials. - Ensured app-only tokens are cleared when app-only accounts disconnect and when token caches/contexts are cleared.
- Added regression tests validating the shared app-only cache is reused across authentications and remains distinct from the user-token cache.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/Accounts/Authenticators/ServicePrincipalAuthenticator.cs | Uses the new app-only cache persistence options for client secret/certificate credentials. |
| src/Accounts/Authenticators/ClientAssertionAuthenticator.cs | Uses the new app-only cache persistence options for client assertion credentials. |
| src/Accounts/Authentication/Factories/AuthenticationFactory.cs | Clears app-only token cache when removing service principal / client assertion accounts. |
| src/Accounts/Authentication/Authentication/TokenCache/SharedTokenCacheProvider.cs | Clears app-only cache when clearing the shared cache. |
| src/Accounts/Authentication/Authentication/TokenCache/PowerShellTokenCacheProvider.cs | Introduces shared in-memory app-only cache options and clearing API. |
| src/Accounts/Authentication/Authentication/TokenCache/InMemoryTokenCacheProvider.cs | Clears app-only cache when clearing the in-memory provider cache. |
| src/Accounts/Authentication/Authentication/TokenCache/InMemoryTokenCacheOptions.cs | Adds a thread-safe Clear() operation for the in-memory cache payload. |
| src/Accounts/Authentication.Test/AuthenticatorsTest/ServicePrincipalAuthenticatorTests.cs | Adds regression tests for shared app-only cache reuse and clearing behavior. |
| src/Accounts/Accounts/ChangeLog.md | Documents the behavior change and references the fixed issue. |
| src/Accounts/Accounts/Account/DisconnectAzureRmAccount.cs | Clears app-only cache on disconnect for app-only accounts in non-current-user scope. |
Author
|
/azp run |
Contributor
|
Commenter does not have sufficient privileges for PR 29858 in repo Azure/azure-powershell |
keystroke
marked this pull request as ready for review
July 18, 2026 00:30
Contributor
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
/azp run |
Contributor
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Service principal authentication currently creates a new Azure.Identity credential for each Azure PowerShell operation. Because service principal cache persistence was disabled, every credential starts with an empty MSAL cache and requests a new access token.
This change introduces a separate process-local cache for app-only tokens and shares it across recreated service principal and client assertion credentials. The existing user-token cache remains isolated, avoiding the user/app cache collision that caused service principal caching to be disabled previously. App tokens are cleared when app-only accounts disconnect and when contexts are cleared.
Regression coverage verifies that repeated service principal authentication receives the same app-only cache while remaining separate from the user cache.
Fixes #29857
Mandatory Checklist
Please choose the target release of Azure PowerShell. (⚠️ Target release is a different concept from API readiness. Please click below links for details.)
Check this box to confirm: I have read the Submitting Changes section of
CONTRIBUTING.mdand reviewed the following information:ChangeLog.mdfile(s) appropriatelysrc/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.## Upcoming Releaseheader in the past tense.ChangeLog.mdif no new release is required, such as fixing test case only.