[wonwuakpa-msft]

Pull Request Checklist

Please leverage this checklist as a reminder to address commonly occurring feedback when submitting a pull request to make sure your PR can be reviewed quickly:

See the detailed list in the contributing guide.

• C++ Guidelines
• Doxygen docs
• Unit tests
• No unwanted commits/changes
• Descriptive title/description
  • PR is single purpose
  • Related issue listed
• Comments in source
• No typos
• Update changelog
• Not work-in-progress
• External references or docs updated
• Self review of PR done
• Any breaking changes?

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The blobs test target cannot compile because of a duplicate test definition and an invalid SessionProvider constructor call, and four new concurrency tests leave sessions disabled in Auto mode.

3 open issues

• Use ContainerSessionProvider in the shared-provider test · New
• Remove duplicate AutoModeAllowsCustomEndpointConstruction test · New
• Enable sessions in the concurrency tests · New

What changed in this PR

This PR addresses concurrent Blob session requests falling back to bearer authentication while another caller is creating a session.

Changes:

• Adds per-container locking to serialize session creation and refresh.
• Uses bounded waits with cancellation checks and cached-session rechecks.
• Adds concurrency regression tests and makes the test credential counter atomic.

File	Description
sdk/​storage/​azure-storage-blobs/​test/​ut/​session_authentication_test.cpp	Adds tests for concurrent creation, container independence, cancellation, and failure handling.
sdk/​storage/​azure-storage-blobs/​src/​private/​token_credential_session_provider.hpp	Adds a timed session-creation mutex to each container cache entry.
sdk/​storage/​azure-storage-blobs/​src/​private/​token_credential_session_provider.cpp	Coordinates concurrent session creation with cancellable waits and cache rechecks.

_{Review effort: Balanced}

[JinmingHu (Jinming-Hu)]

The production code change looks reasonable to me. However, the added tests are failing CI. Could we remove the test-code changes from this PR? The recently added session-feature tests already provide some indirect regression coverage for the updated code.

Please also update the  SessionMode::Enabled  documentation in  blob_options.hpp to explain that requests without a usable cached session wait for an in-flight session acquisition rather than immediately falling back to bearer authentication.