[Ramses Sanchez-Hernandez (ramsessanchez)]

BLOCKED — changes required before merge. This deliberately reapplies #3833 unchanged after revert #3895 so the feature has a reviewable PR again. The known Authentication assembly-isolation regression is reproduced below. Do not merge this version; the isolation guards must remain intact.

Relates to #2023 and #3806; reapplies #3833 after #3895.

Changes proposed in this pull request

• Explicitly cherry-pick original squash commit 5dd9caa95adf5dc74cd4a1bde16ebeccd81f567e (Allow getting an access token using the broker, Allow getting an access token using the broker #3833), preserving Stephan van Rooij's original authorship and author date and the existing co-author attribution.
• Base the replacement on refreshed main, after confirming Revert #3833 to restore Authentication assembly isolation #3895 merged at 2026-11-05T01:48:31Z as 8824ce39ab53ba6b9e1984a3e5ee7daf2d0270b8.
• Restore exactly the original 12-file patch: 434 insertions and 1 deletion. The resulting tracked tree is identical to the original squash commit. This adds Get-MgAccessToken, session token caching, token metadata, tests, and documentation. Broker sign-out code predates Allow getting an access token using the broker #3833 and is not part of this patch.
• Intentionally do not fix the known isolation issue in this reapplication; this PR is the place to request that change.

Required review change: preserve the isolation boundary

src/Authentication/Authentication/Cmdlets/GetMgAccessToken.cs, around lines 99–109, directly uses Azure.Core AccessToken, the returned TokenCredential, and TokenRequestContext to acquire/cache/refresh tokens. This introduces an Azure.Core assembly reference into Microsoft.Graph.Authentication.dll, which runs in PowerShell's default load context rather than the private dependency context.

Move token acquisition, caching, and refresh behind an API in Microsoft.Graph.Authentication.Core, exposing only non-Azure boundary types to the cmdlet assembly. Do not weaken, remove, or broaden the allowlist of the isolation guards. Both CmdletAssemblyMustNotReferenceIsolatedDependencies and CmdletAssemblyOnlyReferencesAllowedAssemblies must pass before this can merge.

This is the blocker originally seen in #3864, build 259330, before workload generation. The revert #3895 was validated with 93/93 Authentication tests passing on each of net8.0 and net472.

Actual local validation of this reapplication

Executed on Windows:

dotnet test src\Authentication\Authentication.Test\Microsoft.Graph.Authentication.Test.csproj --verbosity quiet --logger "trx;LogFilePrefix=authentication-reapplied" --results-directory <session-artifacts>\test-results

Target	Passed	Failed	Total
net8.0	92	2	94
net472	92	2	94

Both targets build and execute. The command exits with code 1, with exactly the expected failures on each target:

• CmdletAssemblyMustNotReferenceIsolatedDependencies: Microsoft.Graph.Authentication.dll references isolated assemblies: Azure.Core. Move the offending code into Microsoft.Graph.Authentication.Core.
• CmdletAssemblyOnlyReferencesAllowedAssemblies: Microsoft.Graph.Authentication.dll has unexpected references: Azure.Core.

No other Authentication unit tests failed or were skipped. An initial --no-restore attempt reported missing project.assets.json; the run above restored assets and completed. Restore/build also emitted existing package advisory warnings for System.Security.Cryptography.Xml 8.0.4 and obsolete-API/xUnit analyzer warnings; no dependency changes were made. Interactive broker flows and the PowerShell/Pester suite were not run.

git diff --exit-code 5dd9caa95adf5dc74cd4a1bde16ebeccd81f567e HEAD succeeded, confirming the reapplication introduces no additional tracked changes.

Other links

• Original feature: Allow getting an access token using the broker #3833
• Merged revert: Revert #3833 to restore Authentication assembly isolation #3895
• Original failing build context: update open api docs #3864

[Ramses Sanchez-Hernandez (ramsessanchez)]

Hi Stephan van Rooij (@svrooij) , it looks like I merged your original pr prematurely. There was an issue at build/test time because the isolation boundary was not preserved in this implementation. Could you take a look here? Feel free to add to this branch and marge any changes here. It will automatically trigger CI runs.