getAuthToken() is very slow and opens a popup window in Outlook in Firefox

[impworks]

Consider a very simple Teams Tab app which just invokes msTeams.authentication.getAuthToken when the user clicks a button:

https://github.com/impworks/teams-js-firefox-bug/

When opening it in Outlook for Web in Firefox, the method would take 1.5..2s and a small empty pop-up window is briefly displayed in the process:

The same page works instantly and without any popup in all other combinations of app and browser (takes less than 10 ms):

• Teams Desktop
• Teams for Web (Chrome)
• Teams for Web (Firefox)
• Outlook Desktop
• Outlook for Web (Chrome)
• M365 Copilot (Chrome)
• M365 Copilot (Firefox)

In our production application several components are requesting the token independently for their own purposes, which makes the window appear many times one after another, with some requests failing with very confusing errors due to a timeout. The exception is being originally thrown from this location in the SDK source code:

And the inner error has the following data in it:

[sayali-MSFT]

Hello @impworks ,Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[sayali-MSFT]

Hello @impworks,
This appears to be specific to the Outlook Web + Firefox host implementation rather than the app itself.
microsoftTeams.authentication.getAuthToken() consistently takes ~1.5–2s and briefly opens an empty popup only in Outlook Web on Firefox, while all other tested host/browser combinations complete in <10ms.

The behavior looks like a fallback MSAL popup/token acquisition flow that may be timing out intermittently (timed_out / msaljs.errors#timed_out). As a mitigation, apps should avoid multiple concurrent getAuthToken() calls and instead centralize/cache token acquisition.

[impworks]

@sayali-MSFT thank you for the reply.
I implemented the centralized token acquisition and caching as a temporary solution. The token needs to be obtained, cached, and also parsed to get its expiration time, which is a big flimsy hack when implemented on the application side: we are re-implementing the logic that is obviously already implemented properly in the host and works on all platforms - except for this particular combination. Is there any estimate on when / whether we can expect a proper fix?

[sayali-MSFT]

Hello @impworks ,
I understand the workaround, but at the moment we don't have any public ETA or confirmed fix timeline for this issue. Based on the repro, this still looks like a host-specific problem in Outlook Web + Firefox rather than an application-side issue.

Your concern is completely valid though — implementing client-side token orchestration, expiration parsing, and refresh coordination effectively duplicates logic that should already be handled by the host/SDK layer. Since the same code path works correctly in Teams/M365 and other browsers, this seems more like a platform inconsistency than expected behavior.

For now, the centralized caching approach is probably the safest mitigation, but it would definitely help if the Outlook Web host could align its getAuthToken() behavior with the other hosts/browsers.