In *some* cases - 'nameid' claim does not contain user id in getAppToken() call

Hi,

We're using the method getAppToken() (https://docs.microsoft.com/en-us/javascript/api/azure-devops-extension-sdk/#getapptoken--) for authenticating to our backend, as described in this document:
https://docs.microsoft.com/en-us/azure/devops/extend/develop/auth?view=azure-devops#authenticating-requests-to-your-service. When validating the generated token in our backend, we get a claim nameid that contains a Guid. In most cases, this is the user Id of the logged in user. However, in approximately 1 out of 10 cases, we see that the nameid claim from the token does not correspond to the user Id of the user. Instead, it is some other Guid (we don't know what).

We haven't been able to find a pattern in cases where it does / does not work correctly :( can you provide guidance how to pinpoint the issue ?

Here's a link to the referenced method:
https://github.com/microsoft/azure-devops-extension-sdk/blob/4f44715f582e173e6fd35ebcf97ed33d50e64dec/src/SDK.ts#L341

Start with src/SDK.ts at getAppToken() and the linked authentication documentation. Compare the nameid claim with the logged-in user's ID across the reported cases and look for a reproducible pattern. Done means identifying the cause or documenting the expected claim semantics and a reliable way to validate the user identity.