Lower log level to Debug; add forceRefresh cache bypass test

Changed log statements in AuthenticationService from Information to Debug to reduce log verbosity. Added a unit test to ensure forceRefresh bypasses the token cache in MicrosoftGraphTokenProvider.

Author: sellakumaran

src/Microsoft.Agents.A365.DevTools.Cli/Services/AuthenticationService.cs

@@ -124,14 +124,14 @@ public async Task<string> GetAccessTokenAsync(
                         }
                         else
                         {
-                            _logger.LogInformation("Using cached authentication token for {ResourceUrl} (tenant: {TenantId})",
+                            _logger.LogDebug("Using cached authentication token for {ResourceUrl} (tenant: {TenantId})",
                                 resourceUrl, tenantId);
                             return cachedToken.AccessToken;
                         }
                     }
                     else
                     {
-                        _logger.LogInformation("Using cached authentication token for {ResourceUrl}", resourceUrl);
+                        _logger.LogDebug("Using cached authentication token for {ResourceUrl}", resourceUrl);
                         return cachedToken.AccessToken;
                     }
                 }
@@ -187,8 +187,8 @@ private async Task<TokenInfo> AuthenticateInteractivelyAsync(
                 // This creates the format required by Azure AD for the TokenRequestContext: {resourceAppId}/{scope}
                 // Example: "ea9ffc3e-8a23-4a7d-836d-234d7c7565c1/McpServers.Mail.All"
                 scopes = explicitScopes.Select(s => $"{resourceUrl}/{s}").ToArray();
-                _logger.LogInformation("Using explicit scopes for authentication: {Scopes}", string.Join(", ", explicitScopes));
-                _logger.LogInformation("Formatted as: {FormattedScopes}", string.Join(", ", scopes));
+                _logger.LogDebug("Using explicit scopes for authentication: {Scopes}", string.Join(", ", explicitScopes));
+                _logger.LogDebug("Formatted as: {FormattedScopes}", string.Join(", ", scopes));
             }
             else
             {
@@ -225,13 +225,13 @@ private async Task<TokenInfo> AuthenticateInteractivelyAsync(
                     scope = resourceUrl.EndsWith("/.default", StringComparison.OrdinalIgnoreCase)
                         ? resourceUrl
                         : $"{resourceUrl}/.default";
-                    _logger.LogInformation("Using custom resource for authentication: {Resource}", resourceUrl);
+                    _logger.LogDebug("Using custom resource for authentication: {Resource}", resourceUrl);
                 }
                 scopes = [scope];
-                _logger.LogInformation($"Token scope: {scope}");
+                _logger.LogDebug("Token scope: {Scope}", scope);
             }
 
-            _logger.LogInformation("Authenticating for tenant: {TenantId}", effectiveTenantId);
+            _logger.LogDebug("Authenticating for tenant: {TenantId}", effectiveTenantId);
 
             // Use provided client ID or default to PowerShell client ID
             effectiveClientId = string.IsNullOrWhiteSpace(clientId) 

src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/MicrosoftGraphTokenProviderTests.cs

@@ -348,4 +348,38 @@ public async Task GetMgGraphAccessTokenAsync_EscapesSingleQuotesInClientAppId()
         // Assert
         token.Should().Be(expectedToken);
     }
+
+    [Fact]
+    public async Task GetMgGraphAccessTokenAsync_WithForceRefresh_BypassesCache()
+    {
+        // Arrange
+        var tenantId = "12345678-1234-1234-1234-123456789abc";
+        var scopes = new[] { "AgentIdentityBlueprint.DeleteRestore.All" };
+        var clientAppId = "87654321-4321-4321-4321-cba987654321";
+        // Valid JWT with a future exp claim (year 2099)
+        var msalToken = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzZWxsYWsiLCJleHAiOjQwNzA5MDg4MDB9.signature";
+        var callCount = 0;
+
+        var provider = new MicrosoftGraphTokenProvider(_executor, _logger)
+        {
+            MsalTokenAcquirerOverride = (_, _, _, _) =>
+            {
+                callCount++;
+                return Task.FromResult<string?>(msalToken);
+            }
+        };
+
+        // Prime the cache with a first call
+        await provider.GetMgGraphAccessTokenAsync(tenantId, scopes, false, clientAppId);
+        callCount.Should().Be(1);
+
+        // Act — second call with forceRefresh: true should bypass the cache
+        var token = await provider.GetMgGraphAccessTokenAsync(tenantId, scopes, false, clientAppId, forceRefresh: true);
+
+        // Assert
+        token.Should().Be(msalToken);
+        callCount.Should().Be(2,
+            because: "forceRefresh: true must evict the cached token and re-invoke MSAL, " +
+                     "ensuring a stale CAE-revoked token is not reused");
+    }
 }