Calling PublicClientApplication.acquireTokenInteractive() with NativeBrokerPlugin hangs

[mmaitre314]

Core Library

MSAL Node (@azure/msal-node)

Core Library Version

3.8.10

Wrapper Library

MSAL Node Extensions (@azure/msal-node-extensions)

Wrapper Library Version

1.5.32

Public or Confidential Client?

Public

Description

Calling acquireTokenInteractive() on PublicClientApplication with NativeBrokerPlugin set on Windows sometimes just hangs and never returns. Logs stop after Calling native interop SignIn API. How can this be avoided?

Logs:

[trace] [Sun, 29 Mar 2026 21:34:49 GMT] : [3833f552-98ef-4fa6-b858-bcc674a57f45] : @azure/msal-node@3.8.10 : Trace - acquireTokenInteractive called
[trace] [Sun, 29 Mar 2026 21:34:49 GMT] : [3833f552-98ef-4fa6-b858-bcc674a57f45] : @azure/msal-node-extensions@1.5.32 : Trace - NativeBrokerPlugin - acquireTokenInteractive called
[trace] [Sun, 29 Mar 2026 21:34:49 GMT] : [3833f552-98ef-4fa6-b858-bcc674a57f45] : @azure/msal-node-extensions@1.5.32 : Trace - NativeBrokerPlugin - chooseRedirectUriByPlatform called
[info] [Sun, 29 Mar 2026 21:34:49 GMT] : [3833f552-98ef-4fa6-b858-bcc674a57f45] : @azure/msal-node-extensions@1.5.32 : Info - NativeBrokerPlugin - No Redirect URI provided, using default
[trace] [Sun, 29 Mar 2026 21:34:49 GMT] : [3833f552-98ef-4fa6-b858-bcc674a57f45] : @azure/msal-node-extensions@1.5.32 : Trace - NativeBrokerPlugin - generateRequestParameters called
[info] [Sun, 29 Mar 2026 21:34:49 GMT] : [3833f552-98ef-4fa6-b858-bcc674a57f45] : @azure/msal-node-extensions@1.5.32 : Info - Calling native interop SignIn API

Error Message

No response

MSAL Logs

No response

Network Trace (Preferrably Fiddler)

• Sent
• Pending

MSAL Configuration

Configuration set in code. See code snippets below.

Relevant Code Snippets

const brokerPlugin = new NativeBrokerPlugin();

      const loggerCallback = (level: LogLevel, message: string): void => {
        switch (level) {
          case LogLevel.Error: this.logger.error(message); break;
          case LogLevel.Warning: this.logger.warn(message); break;
          case LogLevel.Info: this.logger.info(message); break;
          case LogLevel.Verbose: this.logger.debug(message); break;
          case LogLevel.Trace: this.logger.trace(message); break;
          default: this.logger.warn(message); break;
        }
      };

      const pca = new PublicClientApplication({
        auth: { "04b07795-8ddb-461a-bbee-02f9e1bf7b46" },
        broker: { nativeBrokerPlugin: brokerPlugin },
        system: {
          loggerOptions: {
            loggerCallback,
            logLevel: LogLevel.Trace,
            piiLoggingEnabled: false,
          },
        },
      });

      result = await pca.acquireTokenInteractive({ scopes: [scope], openBrowser: this.openBrowser });

Reproduction Steps

Call acquireTokenInteractive() as shown in the code snippets.

Expected Behavior

The call to acquireTokenInteractive() always completes, potentially with an exception if the inputs were invalid.

Identity Provider

Entra ID (formerly Azure AD) / MSA

Browsers Affected (Select all that apply)

None (Server)

Regression

No response