in src/Authentication/MsalExtensions.cs [42:54]
public static AcquireTokenSilentParameterBuilder WithAccountTenantId(this AcquireTokenSilentParameterBuilder builder, IAccount account)
{
// Workaround for https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/3077
// Even if using the organizations tenant the presence of an MSA will attempt to use the consumers tenant
// which is not supported by the Azure DevOps application. Detect this case and use the first party tenant.
if (Guid.TryParse(account.HomeAccountId?.TenantId, out Guid accountTenantId) && accountTenantId == MsalConstants.MsaAccountTenant)
{
builder = builder.WithTenantId(MsalConstants.FirstPartyTenant.ToString());
}
return builder;
}