src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs:766

• The parent-window delegate is captured on the cached PublicClientApplication, but the static PCA cache key does not include the new SetParentActivityOrWindow callback. A later provider instance with the same authority/client/redirect can reuse an app built with an earlier provider's delegate, causing WAM prompts to be parented to the wrong window (or to ignore the later callback). Include the callback identity in the cache key or avoid capturing provider instance state in the cached app.

                builder.WithParentActivityOrWindow(GetBrokerParentWindow);
            }
            #else
            builder.WithParentActivityOrWindow(GetBrokerParentWindow);

src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs:752

• The tests added for this feature only exercise the setter and do not verify that Windows PCA construction actually enables the broker or wires the parent-window callback. Please add unit coverage around CreateClientAppInstance (or an observable wrapper) so regressions in the WAM configuration are caught without relying solely on manual integration testing.

        if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
        {
            builder.WithBroker(new BrokerOptions(BrokerOptions.OperatingSystems.Windows));

specs/002-wam-broker/spec.md:70

• This API description says Func can return IWin32Window, but the implementation only accepts IntPtr from this callback and silently ignores any other object type before falling back to console detection. Please either document only the supported return type or handle IWin32Window here as described.

      // Cross-platform API to set the parent window/activity for WAM dialog
      // On Windows: accepts IntPtr (window handle) or IWin32Window via Func<object>
      // On Unix: no-op (WAM not available)
      public void SetParentActivityOrWindow(Func<object> parentActivityOrWindowFunc);
  

  specs/002-wam-broker/spec.md:131

  • This rollout note is inaccurate: SetIWin32WindowFunc is not changed to delegate to SetParentActivityOrWindow; it still stores a separate _iWin32WindowFunc and the new callback is independent. Please update the spec or implementation so consumers and maintainers do not rely on a delegation behavior that is not present.

  - WAM broker is **always enabled** on Windows when using PCA flows
  - No opt-in connection string keyword needed (aligns with MSAL PCA compliance requirements)
  - Existing `SetIWin32WindowFunc` remains as a backward-compatible API on .NET Framework, delegating to `SetParentActivityOrWindow`
  

  src/Microsoft.Data.SqlClient.Extensions/Azure/src/ActiveDirectoryAuthenticationProvider.cs:749

  • This comment overstates the behavior: the code still uses AcquireTokenByIntegratedWindowsAuth, AcquireTokenByUsernamePassword, and AcquireTokenWithDeviceCode for those modes, so broker configuration does not make every supported authentication mode a WAM flow. Please narrow the comment to the modes MSAL will actually broker or update the acquisition paths accordingly.

          // Enable WAM broker on Windows for all supported authentication modes.
          // The broker provides enhanced security by enabling device-based Conditional Access
          // policies through the Windows Account Manager (WAM).