Bug report: Federated Identity for ADO fails refreshing a token

Ok, so the below yaml will fail:

- task: AzurePowerShell@5
  displayName: 'Login using Service Connection'
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
  inputs:
    azureSubscription: 'MyServiceConnection'
    ScriptType: 'InlineScript'
    azurePowerShellVersion: LatestVersion
    Inline: |
      m365 login --authType federatedIdentity


- task: PowerShell@2
  inputs:
    targetType: 'inline'
    script: |
      m365 spo app add # etc etc

It will fail on the second task, executing a command against sharepoint.

So the point is that the CLI tries to request an additional access token for a 'new' resource (SharePoint).
When signing in, it got an access token scoped to the MS Graph.
When executing an SPO command it will request a token scoped to the SPO API.
But the expected environment variables are empty in the second PowerShell task. So the task fails.

The best workaround would be to always use the AzurePowerShell task, like this:

- task: AzurePowerShell@5
  displayName: 'Login using Service Connection'
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
  inputs:
    azureSubscription: 'MyServiceConnection'
    ScriptType: 'InlineScript'
    azurePowerShellVersion: LatestVersion
    Inline: |
      m365 login --authType federatedIdentity

- task: AzurePowerShell@5
  displayName: 'Get SPO stuff'
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
  inputs:
    azureSubscription: 'MyServiceConnection'
    ScriptType: 'InlineScript'
    azurePowerShellVersion: LatestVersion
    Inline: |
      m365 spo app add # etc etc

But this shouldn't be necessary.

I suggest we save the system access token / OIDC Url / Subscription Id, App Id, tenant Id in the connection list.