Handle null scopes in MsalAuth.cs more robustly

src/libraries/Authentication/Authentication.Msal/MsalAuth.cs

@@ -210,7 +210,12 @@
             AssertionHelpers.ThrowIfNullOrWhiteSpace(agentAppInstanceId, nameof(agentAppInstanceId));
             AssertionHelpers.ThrowIfNullOrWhiteSpace(agenticUserId, nameof(agenticUserId));
 
-            var cacheKey = $"{agentAppInstanceId}/{agenticUserId}/{string.Join(";", scopes)}";
+            string k1 = "";
+            if ( scopes != null )
+            {
+                k1 = string.Join(";", scopes);
+            }
+            var cacheKey = $"{agentAppInstanceId}/{upn}/{k1}";
             var value = _agenticTokenCache.Get(cacheKey);
             if (value != null)
             {
@@ -250,11 +255,16 @@
             var tokenEndpoint = _connectionSettings.Authority != null 
                 ? $"{_connectionSettings.Authority}/oauth2/v2.0/token"
                 : $"https://login.microsoftonline.com/{_connectionSettings.TenantId}/oauth2/v2.0/token";
-
+
+            string scp = "";
+            if (scopes != null)
+            {
+                scp = string.Join(" ", scopes);
+            }
             var parameters = new Dictionary<string, string>
             {
                 { "client_id", agentAppInstanceId },
-                { "scope", string.Join(" ", scopes) },
+                { "scope", scp },
                 { "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" },
                 { "client_assertion", agentToken },
                 { "user_id", agenticUserId },