Add PartitionAppTokenCacheByAudience to partition the app token cache by resource (#3979)

Apps that acquire app tokens (client credentials) for many resources using the
same client and tenant accumulate all tokens in a single {clientId}_{tenantId}
cache partition, making AcquireTokenForClient cache lookups O(n) in the number of
resources.

Add a MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience opt-in (config
bindable, flows into MergedOptions like UseFastUnboundedCache). When enabled,
TokenAcquisition derives the resource from the requested /.default scope
and calls MSAL's WithCachePartitionKey("resource", resource), which partitions both
MSAL's internal cache and the serialized in-memory cache blob per resource, keeping
reads O(1).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2d02b5ca-22b5-4b48-840a-de79786b3f9d

Author: gladjohn

src/Microsoft.Identity.Web.TokenAcquisition/MergedOptions.cs

@@ -86,6 +86,7 @@ public ConfidentialClientApplicationOptions ConfidentialClientApplicationOptions
         internal static void UpdateMergedOptionsFromMicrosoftIdentityOptions(MicrosoftIdentityOptions microsoftIdentityOptions, MergedOptions mergedOptions)
         {
             mergedOptions.UseFastUnboundedCache |= microsoftIdentityOptions.UseFastUnboundedCache;
+            mergedOptions.PartitionAppTokenCacheByAudience |= microsoftIdentityOptions.PartitionAppTokenCacheByAudience;
 
 #if NET5_0_OR_GREATER
             mergedOptions.MapInboundClaims = microsoftIdentityOptions.MapInboundClaims;

src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityOptions.cs

@@ -105,6 +105,24 @@ public class MicrosoftIdentityOptions : OpenIdConnectOptions
         /// 
         public bool UseFastUnboundedCache { get; set; }
 
+        /// 
+        /// When set to , the application token cache (client credentials,
+        /// i.e. AcquireTokenForClient) is partitioned by the audience (resource) of the
+        /// requested token.
+        /// 
+        /// Applications that acquire app tokens for many resources using the same client and tenant
+        /// otherwise accumulate all of those tokens in a single cache partition, which makes cache
+        /// lookups O(n) in the number of resources. Enabling this adds the resource (derived from the
+        /// requested <resource>/.default scope) as a non-protocol-affecting cache key
+        /// component, so each resource gets its own partition and cache reads stay O(1).
+        /// 
+        /// 
+        /// Defaults to . This can be set via configuration, e.g.
+        /// "AzureAd": { "PartitionAppTokenCacheByAudience": true }.
+        /// 
+        /// 
+        public bool PartitionAppTokenCacheByAudience { get; set; }
+
         /// 
         /// Enables legacy ADAL cache serialization and deserialization.
         /// Performance improvements when working with MSAL only apps.

src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/NetCore/PublicAPI.Unshipped.txt

@@ -1,4 +1,6 @@
 #nullable enable
+Microsoft.Identity.Web.MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience.get -> bool
+Microsoft.Identity.Web.MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience.set -> void
 Microsoft.Identity.Web.MicrosoftIdentityOptions.UseFastUnboundedCache.get -> bool
 Microsoft.Identity.Web.MicrosoftIdentityOptions.UseFastUnboundedCache.set -> void
 Microsoft.Identity.Web.TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted.get -> System.Func?

src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/NetFramework/PublicAPI.Unshipped.txt

@@ -1,4 +1,6 @@
 #nullable enable
+Microsoft.Identity.Web.MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience.get -> bool
+Microsoft.Identity.Web.MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience.set -> void
 Microsoft.Identity.Web.MicrosoftIdentityOptions.UseFastUnboundedCache.get -> bool
 Microsoft.Identity.Web.MicrosoftIdentityOptions.UseFastUnboundedCache.set -> void
 Microsoft.Identity.Web.TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted.get -> System.Func?

src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

@@ -978,6 +978,18 @@ private async Task GetAuthenticationResultForAppInternalAs
                    .AcquireTokenForClient(new[] { scope }.Except(_scopesRequestedByMsal))
                    .WithSendX5C(mergedOptions.SendX5C);
 
+            // Partition the app token cache by audience (resource) so each downstream resource lands
+            // in its own cache partition. This keeps AcquireTokenForClient cache reads O(1) for apps
+            // that acquire tokens for many resources with the same client and tenant. The resource is
+            // derived from the requested "/.default" scope and added via MSAL's
+            // WithCachePartitionKey as a non-protocol-affecting cache key component (it is not sent to
+            // the token endpoint), which partitions both MSAL's internal cache and the serialized
+            // in-memory cache blob.
+            if (mergedOptions.PartitionAppTokenCacheByAudience)
+            {
+                builder.WithCachePartitionKey(CacheKeyResourceComponent, GetResourceFromScope(scope));
+            }
+
             if (isTokenBinding)
             {
                 builder.WithMtlsProofOfPossession();
@@ -1157,6 +1169,21 @@ private void AddExtraBodyParametersIfNeeded(TokenAcquisitionOptions tokenAcquisi
             }
         }
 
+        // Cache key component name used to partition the app token cache by resource/audience
+        // (see MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience).
+        private const string CacheKeyResourceComponent = "resource";
+
+        // Derives the resource (audience) from a client-credential scope of the form
+        // "/.default". The scope is validated to end with "/.default" earlier in the app
+        // token flow, so the suffix is stripped to obtain a stable per-resource partition value.
+        private static string GetResourceFromScope(string scope)
+        {
+            const string defaultSuffix = "/.default";
+            return scope.EndsWith(defaultSuffix, StringComparison.OrdinalIgnoreCase)
+                ? scope.Substring(0, scope.Length - defaultSuffix.Length)
+                : scope;
+        }
+
         private MergedOptions GetMergedOptions(string? authenticationScheme, TokenAcquisitionOptions? tokenAcquisitionOptions)
         {
             MergedOptions mergedOptions;

tests/Microsoft.Identity.Web.Test/TokenAcquisitionTests.cs

@@ -234,6 +234,70 @@ public async Task AppToken_InMemoryCache_UseFastUnboundedCache_SkipsSerializatio
             Assert.Equal(0, memoryCache.Count);
         }
 
+        /// 
+        /// With MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience = true, app tokens for two
+        /// different resources are stored under separate cache keys (each resource is its own
+        /// partition via MSAL's WithCachePartitionKey), so the backing IMemoryCache has one entry per
+        /// resource.
+        /// 
+        [Fact]
+        public async Task AppToken_PartitionByAudience_UsesSeparateCacheEntryPerResource()
+        {
+            // Arrange
+            var tokenAcquirerFactory = InitTokenAcquirerFactory();
+            string uniqueClientId = Guid.NewGuid().ToString();
+            tokenAcquirerFactory.Services.Configure<MicrosoftIdentityApplicationOptions>(
+                options => options.ClientId = uniqueClientId);
+            tokenAcquirerFactory.Services.Configure<MicrosoftIdentityOptions>(
+                options => options.PartitionAppTokenCacheByAudience = true);
+
+            IServiceProvider serviceProvider = tokenAcquirerFactory.Build();
+            var mockHttpClient = serviceProvider.GetRequiredService<IMsalHttpClientFactory>() as MockHttpClientFactory;
+            mockHttpClient!.AddMockHandler(CreateClientCredentialsTokenHandler(accessToken: "token-resource-1"));
+            mockHttpClient.AddMockHandler(CreateClientCredentialsTokenHandler(accessToken: "token-resource-2"));
+
+            var memoryCache = (MemoryCache)serviceProvider.GetRequiredService<IMemoryCache>();
+            IAuthorizationHeaderProvider authorizationHeaderProvider =
+                serviceProvider.GetRequiredService<IAuthorizationHeaderProvider>();
+
+            // Act — acquire app tokens for two distinct resources.
+            await authorizationHeaderProvider.CreateAuthorizationHeaderForAppAsync("https://resource1.example.com/.default");
+            await authorizationHeaderProvider.CreateAuthorizationHeaderForAppAsync("https://resource2.example.com/.default");
+
+            // Assert — one cache partition (entry) per resource.
+            Assert.Equal(2, memoryCache.Count);
+        }
+
+        /// 
+        /// Without PartitionAppTokenCacheByAudience, app tokens for different resources share the same
+        /// {clientId}_{tenantId} cache key, so the backing IMemoryCache holds a single (shared) entry.
+        /// 
+        [Fact]
+        public async Task AppToken_WithoutPartitionByAudience_SharesSingleCacheEntry()
+        {
+            // Arrange
+            var tokenAcquirerFactory = InitTokenAcquirerFactory();
+            string uniqueClientId = Guid.NewGuid().ToString();
+            tokenAcquirerFactory.Services.Configure<MicrosoftIdentityApplicationOptions>(
+                options => options.ClientId = uniqueClientId);
+
+            IServiceProvider serviceProvider = tokenAcquirerFactory.Build();
+            var mockHttpClient = serviceProvider.GetRequiredService<IMsalHttpClientFactory>() as MockHttpClientFactory;
+            mockHttpClient!.AddMockHandler(CreateClientCredentialsTokenHandler(accessToken: "token-resource-1"));
+            mockHttpClient.AddMockHandler(CreateClientCredentialsTokenHandler(accessToken: "token-resource-2"));
+
+            var memoryCache = (MemoryCache)serviceProvider.GetRequiredService<IMemoryCache>();
+            IAuthorizationHeaderProvider authorizationHeaderProvider =
+                serviceProvider.GetRequiredService<IAuthorizationHeaderProvider>();
+
+            // Act
+            await authorizationHeaderProvider.CreateAuthorizationHeaderForAppAsync("https://resource1.example.com/.default");
+            await authorizationHeaderProvider.CreateAuthorizationHeaderForAppAsync("https://resource2.example.com/.default");
+
+            // Assert — both resources share a single {clientId}_{tenantId} partition.
+            Assert.Equal(1, memoryCache.Count);
+        }
+
         /// 
         /// Tests that a caught  is not re-logged by Microsoft.Identity.Web,
         /// since MSAL.NET already logs it. Re-logging produced duplicate log entries.