There are code paths through MSAL which wrapping credentials (e.g. InteractiveBrowserCredential) don't intercept. For example, MSAL applications create a new HTTP client (via a private method) every time they redeem a refresh token rather than reuse the clients they create at construction (and which we replace with an adapter).

Some MSAL application code paths also directly call into requests. For example, a public application's get_accounts method may send instance discovery requests.