di

GladwinJohnson · GladwinJohnson · commit f4a843cc6f91 · 2025-05-21T11:41:20.000-07:00
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/DefaultManagedIdentityHttpClientFactory.cs b/src/Microsoft.Identity.Web.TokenAcquisition/DefaultManagedIdentityHttpClientFactory.cs
@@ -0,0 +1,27 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System.Net.Http;
+using Microsoft.Identity.Client;
+
+namespace Microsoft.Identity.Web
+{
+    /// <summary>
+    /// Adapts the base class <see cref="IHttpClientFactory"/> to MSAL's
+    /// <see cref="IMsalHttpClientFactory"/> so managed-identity code
+    /// can stay DI-friendly without static hooks.
+    /// </summary>
+    internal sealed class DefaultManagedIdentityHttpClientFactory
+        : IManagedIdentityHttpClientFactory,
+          IMsalHttpClientFactory
+    {
+        private readonly IHttpClientFactory _http;
+
+        public DefaultManagedIdentityHttpClientFactory(IHttpClientFactory http) =>
+            _http = http;
+
+        public IMsalHttpClientFactory Create() => this;
+
+        public HttpClient GetHttpClient() => _http.CreateClient();
+    }
+}
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/IManagedIdentityHttpClientFactory.cs b/src/Microsoft.Identity.Web.TokenAcquisition/IManagedIdentityHttpClientFactory.cs
@@ -0,0 +1,16 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using Microsoft.Identity.Client;
+
+namespace Microsoft.Identity.Web
+{
+    /// <summary>
+    /// Internal abstraction so unit-tests can supply a custom
+    /// <see cref="IMsalHttpClientFactory"/>.
+    /// </summary>
+    internal interface IManagedIdentityHttpClientFactory
+    {
+        IMsalHttpClientFactory Create();
+    }
+}
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net462/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net472/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net6.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net6.0/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net7.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net7.0/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net8.0/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/net9.0/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/InternalAPI.Unshipped.txt b/src/Microsoft.Identity.Web.TokenAcquisition/PublicAPI/netstandard2.0/InternalAPI.Unshipped.txt
@@ -1,7 +1,8 @@
-Microsoft.Identity.Web.ManagedIdentityTestHooks
-Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.ManagedIdentityTestHooks.HttpClientFactoryOverride.set -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.DefaultManagedIdentityHttpClientFactory(System.Net.Http.IHttpClientFactory! http) -> void
+Microsoft.Identity.Web.DefaultManagedIdentityHttpClientFactory.GetHttpClient() -> System.Net.Http.HttpClient!
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory
+Microsoft.Identity.Web.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
+Microsoft.Identity.Web.TokenAcquisition.IManagedIdentityHttpClientFactory.Create() -> Microsoft.Identity.Client.IMsalHttpClientFactory!
 const Microsoft.Identity.Web.IDWebErrorMessage.ExceptionAcquiringTokenForConfidentialClient = "IDW10501: Exception acquiring token for a confidential client: " -> string!
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.HttpClientFactoryOverride.get -> Microsoft.Identity.Client.IMsalHttpClientFactory?
-static Microsoft.Identity.Web.TestOnly.TokenAcquirerTestHooks.UseTestHttpClientFactory(Microsoft.Identity.Client.IMsalHttpClientFactory! factory) -> void
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerTestHooks.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquirerTestHooks.cs
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.ManagedIdentity.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.ManagedIdentity.cs
@@ -9,8 +9,6 @@
 using Microsoft.Identity.Abstractions;
 using Microsoft.Identity.Client;
 using Microsoft.Identity.Client.AppConfig;
-using Microsoft.Identity.Web.TestOnly;
-using Microsoft.IdentityModel.Tokens;
 
 namespace Microsoft.Identity.Web
 {
@@ -22,6 +20,7 @@ internal partial class TokenAcquisition
         private readonly ConcurrentDictionary<string, IManagedIdentityApplication> _managedIdentityApplicationsByClientId = new();
         private readonly SemaphoreSlim _managedIdSemaphore = new(1, 1);
         private const string SystemAssignedManagedIdentityKey = "SYSTEM";
+        private readonly IManagedIdentityHttpClientFactory _miHttpFactory;
 
         /// <summary>
         /// Gets a cached ManagedIdentityApplication object or builds a new one if not found.
@@ -104,13 +103,7 @@ private IManagedIdentityApplication BuildManagedIdentityApplication(
                 miBuilder.WithClientCapabilities(capabilities);
             }
 
-            // TEST-ONLY: if a test has supplied a factory, use it; otherwise stay default
-            // Default factory is handled by MSAL
-            if (TokenAcquirerTestHooks.HttpClientFactoryOverride is not null)
-            { 
-                miBuilder.WithHttpClientFactory(
-                TokenAcquirerTestHooks.HttpClientFactoryOverride);
-            }
+            miBuilder.WithHttpClientFactory(_miHttpFactory.Create());
 
             return miBuilder.Build();
 
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs b/src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs
@@ -108,6 +108,9 @@ public TokenAcquisition(
             _credentialsLoader = credentialsLoader;
             _certificatesObserver = serviceProvider.GetService<ICertificatesObserver>();
             tokenAcquisitionExtensionOptionsMonitor = serviceProvider.GetService<IOptionsMonitor<TokenAcquisitionExtensionOptions>>();
+
+            _miHttpFactory = serviceProvider.GetService<IManagedIdentityHttpClientFactory>()
+                   ?? new DefaultManagedIdentityHttpClientFactory(httpClientFactory);
         }
 
 #if NET6_0_OR_GREATER
diff --git a/src/Microsoft.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiServiceCollectionExtensions.cs b/src/Microsoft.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiServiceCollectionExtensions.cs
@@ -6,6 +6,7 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 
 namespace Microsoft.Identity.Web
 {
@@ -36,6 +37,11 @@ public static MicrosoftIdentityWebApiAuthenticationBuilderWithConfiguration AddM
             bool subscribeToJwtBearerMiddlewareDiagnosticsEvents = false)
         {
             AuthenticationBuilder builder = services.AddAuthentication(jwtBearerScheme);
+
+            services.AddHttpClient();
+            services.TryAddSingleton<IManagedIdentityHttpClientFactory,
+                                     DefaultManagedIdentityHttpClientFactory>();
+
             return builder.AddMicrosoftIdentityWebApi(
                 configuration,
                 configSectionName,
diff --git a/tests/Microsoft.Identity.Web.Test/ManagedIdentityCaeTests.cs b/tests/Microsoft.Identity.Web.Test/ManagedIdentityCaeTests.cs
@@ -1,18 +1,14 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
-using System;
-using System.Collections.Generic;
-using System.Net.Http;
-using System.Net;
 using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Identity.Abstractions;
 using Microsoft.Identity.Client;
 using Microsoft.Identity.Web.Test.Common.Mocks;
 using Microsoft.Identity.Web.TestOnly;
 using Xunit;
-using System.Text;
+using Microsoft.Identity.Web.Test;
 
 namespace Microsoft.Identity.Web.Tests.Certificateless
 {
@@ -36,9 +32,8 @@ public async Task ManagedIdentity_ReturnsBearerHeader()
             mockHttp.AddMockHandler(
                 MockHttpCreator.CreateMsiTokenHandler(accessToken: MockToken));
 
-            // uses TokenAcquirerTestHooks.HttpClientFactoryOverride so that every IMDS / MSI call
-            // is routed through mocked responses using IMsalHttpClientFactory.
-            TokenAcquirerTestHooks.UseTestHttpClientFactory(mockHttp);
+            factory.Services.AddSingleton<IManagedIdentityHttpClientFactory>(
+                _ => new TestManagedIdentityHttpFactory(mockHttp));
 
             IAuthorizationHeaderProvider headerProvider = factory.Build()
                                         .GetRequiredService<IAuthorizationHeaderProvider>();
@@ -62,18 +57,19 @@ public async Task UserAssigned_MI_Caching_and_Claims()
         {
             // Arrange
             TokenAcquirerFactoryTesting.ResetTokenAcquirerFactoryInTest();
-            var fac = TokenAcquirerFactory.GetDefaultInstance();
-            var mocks = new MockHttpClientFactory();
+            var factory = TokenAcquirerFactory.GetDefaultInstance();
+            var mockHttp = new MockHttpClientFactory();
 
             // a = token-1        b = cached token (i.e. token-1)
             // c = token-2        d = token-3
-            mocks.AddMockHandler(MockHttpCreator.CreateMsiTokenHandler("token-1")); // a
-            mocks.AddMockHandler(MockHttpCreator.CreateMsiTokenHandler("token-2")); // c
-            mocks.AddMockHandler(MockHttpCreator.CreateMsiTokenHandler("token-3")); // d
+            mockHttp.AddMockHandler(MockHttpCreator.CreateMsiTokenHandler("token-1")); // a
+            mockHttp.AddMockHandler(MockHttpCreator.CreateMsiTokenHandler("token-2")); // c
+            mockHttp.AddMockHandler(MockHttpCreator.CreateMsiTokenHandler("token-3")); // d
 
-            TokenAcquirerTestHooks.UseTestHttpClientFactory(mocks);
+            factory.Services.AddSingleton<IManagedIdentityHttpClientFactory>(
+                _ => new TestManagedIdentityHttpFactory(mockHttp));
 
-            var provider = fac.Build();
+            var provider = factory.Build();
             var tokens = provider.GetRequiredService<ITokenAcquisition>();
 
             // helper
@@ -120,7 +116,8 @@ public async Task SystemAssigned_MSI_Forwards_ClientCapabilities_InQuery()
 
             var mockHttp = new MockHttpClientFactory();
             mockHttp.AddMockHandler(captureHandler);
-            TokenAcquirerTestHooks.UseTestHttpClientFactory(mockHttp);
+            factory.Services.AddSingleton<IManagedIdentityHttpClientFactory>(
+                _ => new TestManagedIdentityHttpFactory(mockHttp));
 
             // Enable capabilities cp1,cp2
             factory.Services.Configure<MicrosoftIdentityApplicationOptions>(opts =>
diff --git a/tests/Microsoft.Identity.Web.Test/TestManagedIdentityHttpFactory.cs b/tests/Microsoft.Identity.Web.Test/TestManagedIdentityHttpFactory.cs
@@ -0,0 +1,15 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using Microsoft.Identity.Client;
+
+namespace Microsoft.Identity.Web.Test
+{
+    internal sealed class TestManagedIdentityHttpFactory : IManagedIdentityHttpClientFactory
+    {
+        private readonly IMsalHttpClientFactory _msalHttpClientFactory;
+        public TestManagedIdentityHttpFactory(IMsalHttpClientFactory msalHttpClientFactory)
+            => _msalHttpClientFactory = msalHttpClientFactory;
+        public IMsalHttpClientFactory Create() => _msalHttpClientFactory;
+    }
+}
