[Bug] Cache misses in client_credentials when authority is specified at request level, cloud is not global and region is used

 var cca = ConfidentialClientApplicationBuilder.Create("client_id")              
              .WithClientSecret("secret")
              .WithAzureRegion("eastus")            
              .Build();

            var result = await cca.AcquireTokenForClient(new[] { "https://graph.ppe.windows.net/.default" })
                           .WithAuthority("https://login.windows-ppe.net/17b189bc-2b81-4ec5-aa51-3e628cbc931b")
                           .ExecuteAsync();

            Assert.AreEqual(TokenSource.IdentityProvider, result.AuthenticationResultMetadata.TokenSource);

            var result2 = await cca.AcquireTokenForClient(new[] { "https://graph.ppe.windows.net/.default" })
                       .WithAuthority("https://login.windows-ppe.net/17b189bc-2b81-4ec5-aa51-3e628cbc931b")
                       .ExecuteAsync();

            // fails
            Assert.AreEqual(TokenSource.Cache, result2.AuthenticationResultMetadata.TokenSource);

Workaround: Add .WithAuthority("https://login.windows-ppe.net/common") or any authority of the same cloud to the application builder.

 var cca = ConfidentialClientApplicationBuilder.Create("client_id")              
              .WithClientSecret("secret")
              .WithAzureRegion("eastus")            
              .WithAuthority("https://login.windows-ppe.net/common")              
              .Build();

[mancyc]

I hit this issue in national clouds where caching was not working because app.GetAccounts() call returned no accounts, thereby resulting in throttling from ESTS. Upgrading from 4.31.0 to latest version(4.35) fixed the issue.

[bgavrilMS]

We do need it for flows where users / accounts are involved, because otherwise you cannot do app.GetAccounts(). But for client_credentials flow, I don’t see why we would require it? We can just use the authority override.

Do you want to make the programming model more consistent between AcquireTokenForClient and other AcquireToken* calls and require that the 2 authorities have the same host? Throw an exception if they do not?