title: How can I handle MicrosoftIdentityWebChallengeUserException when TokenAcquisition fails?
body: <p>I'm building a webapp and keep encountering the following error when I restart the app and try to request a token using <code>ITokenAcquisition.GetTokenForUserAsync</code></p>
  <blockquote>
  <p>&quot;One or more errors occurred. (IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. See <a href="https://aka.ms/ms-id-web/ca_incremental-consent" rel="nofollow noreferrer">https://aka.ms/ms-id-web/ca_incremental-consent</a>. )&quot;</p>
  </blockquote>
  <p>I'm authenticating Users against Azure AD using Microsoft.Identity.Web.</p>
  <p>When I inspect the token cache, it is empty after restarting the app. If the user was already signed in from an earlier session or because they are using a Domain joined device they seem to bypass the cache.</p>
  <p>How do I force reauthentication or add a token to the cache?</p>
  <p>Startup.cs</p>
  <pre><code>       public void ConfigureServices(IServiceCollection services)
         {
             services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
             {
                 // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                 options.CheckConsentNeeded = context =&gt; true;
                 options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
                 // Handling SameSite cookie according to https://docs.microsoft.com/en-us/aspnet/core/security/samesite?view=aspnetcore-3.1
                 options.HandleSameSiteCookieCompatibility();
             });
             // Sign-in users with the Microsoft identity platform
             services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
                 .EnableTokenAcquisitionToCallDownstreamApi(new[] { &quot;https://database.windows.net//.default&quot; })
                 .AddInMemoryTokenCaches();
  
             services.AddAuthorization(options =&gt;
             {
                 // By default, all incoming requests will be authorized according to the default policy
                 options.FallbackPolicy = options.DefaultPolicy;
             });
  
             services.AddDbContext&lt;MyDatabaseContext&gt;(options =&gt;
                     options.UseSqlServer(Configuration.GetConnectionString(&quot;MyAzureConnection&quot;)));
  
             services.AddRazorPages()
                 .AddRazorRuntimeCompilation()
                 .AddMvcOptions(o =&gt; o.Filters.Add(new AuthorizeFilter()))
                 .AddMicrosoftIdentityUI();
  
         }
  </code></pre>
  <p>My DbContext where I request the token</p>
  <pre><code>        public MyDatabaseContext (ITokenAcquisition tokenAcquisition,
                              DbContextOptions&lt;MyDatabaseContext&gt; options)
                              : base(options)
          {
              _tokenAcquisition = tokenAcquisition;
              var token = _tokenAcquisition.GetAccessTokenForUserAsync(new[] {&quot;https://database.windows.net//.default&quot;});
              var connection = (SqlConnection)Database.GetDbConnection();
              connection.AccessToken = token.GetAwaiter().GetResult();
          }
  </code></pre>
  <p>All my PageModels are decorated with <code>[AuthorizeForScopes(ScopeKeySection = &quot;AzureSQL:BaseUrl&quot;)]</code></p>