[Bug] KeyNotFoundException during retry for getting Managed Identity token

[kwlin]

Library version used

4.78.0

.NET version

.NET 9.0 SDK
.NET 8.0 Target Framework

Scenario

ManagedIdentityClient - managed identity

Is this a new or an existing app?

The app is in production, I haven't upgraded MSAL, but started seeing this issue

Issue description and reproduction steps

We are seeing in our logging: KeyNotFoundExceptions with the retry mechanisme for aquiring token from the Managed Identity endpoint.

The error messages/stack traces:

False MSAL 4.76.0.0 MSAL.NetCore .NET 8.0.21 Linux [2025-12-09 07:00:33Z - eba86310-d513-4244-b369-c2b97226fa48] [Managed Identity] Exception: The given key 'client-request-id' was not present in the dictionary.

False MSAL 4.76.0.0 MSAL.NetCore .NET 8.0.21 Linux [2025-12-09 07:00:33Z - eba86310-d513-4244-b369-c2b97226fa48] Exception type: Microsoft.Identity.Client.MsalServiceException
, ErrorCode: managed_identity_request_failed
HTTP StatusCode 0
CorrelationId eba86310-d513-4244-b369-c2b97226fa48
---> Inner Exception Details
Exception type: System.Collections.Generic.KeyNotFoundException
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at Microsoft.Identity.Client.Http.HttpManager.SendRequestAsync(Uri endpoint, IDictionary`2 headers, HttpContent body, HttpMethod method, ILoggerAdapter logger, Boolean doNotThrow, X509Certificate2 bindingCertificate, Func`5 validateServerCert, CancellationToken cancellationToken, IRetryPolicy retryPolicy, Int32 retryCount)
at Microsoft.Identity.Client.ManagedIdentity.AbstractManagedIdentity.AuthenticateAsync(AcquireTokenForManagedIdentityParameters parameters, CancellationToken cancellationToken)

=== End of inner exception stack trace ===
To see full exception details, enable PII Logging. See https://aka.ms/msal-net-logging
at Microsoft.Identity.Client.ManagedIdentity.AbstractManagedIdentity.CreateAndThrowException(String errorCode, String errorMessage, Exception innerException, ManagedIdentitySource source)
at Microsoft.Identity.Client.ManagedIdentity.AbstractManagedIdentity.HandleException(Exception ex, ManagedIdentitySource managedIdentitySource, String additionalInfo)
at Microsoft.Identity.Client.ManagedIdentity.AbstractManagedIdentity.AuthenticateAsync(AcquireTokenForManagedIdentityParameters parameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ManagedIdentityAuthRequest.SendTokenRequestForManagedIdentityAsync(ILoggerAdapter logger, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ManagedIdentityAuthRequest.GetAccessTokenAsync(CancellationToken cancellationToken, ILoggerAdapter logger)
at Microsoft.Identity.Client.Internal.Requests.ManagedIdentityAuthRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)

Relevant code snippets

Could this line of code the cause of KeyNotFoundException and fail the retry mechanisme?

                    var correlationId = headers[OAuth2Header.CorrelationId];
                    string correlationIdMsg = headers.ContainsKey(OAuth2Header.CorrelationId) ?
                                                $" CorrelationId: {correlationId}" :
                                                string.Empty;

...

https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/964a07449f9d5183828fbd0e1e9d4d3e9b6d80c7/src/client/Microsoft.Identity.Client/Http/HttpManager.cs#L143C20-L143C77

Expected behavior

No response

Identity provider

Other

Regression

No response

Solution and workarounds

[bgavrilMS]

Yes, thanks for raising. Looks like a recent change #5364 where we were trying to include correlation id.

We will get it fixed, but please note that error would still occur.

[kwlin]

Yes, hopefully we will get the actual error to analyse 😄 instead of KeyNotFoundException