This implements complex handling for Azure identity Token credentials by creating new pre-configured ChainedTokenCredential which know about common AzDO Task called AzureCLI@2
There are few cases how you can preconfigure this and provide identity to the DefaultIdentityTokenCredential class.

1. Enable addSpnToEnvironment property on AzureCLI@2 params. This will use idToken and other provided environment vars to configure WorkloadIdentityCredential
2. Provide SYSTEM_ACCESSTOKEN environment variable by assigning it to System.AccessToken Azure pipeline variable. Access token together with all provided environment variables will enable AzurePipelineCredential
3. If none of these are available AzureCliCredential fallback is still there wrapped to AzureCliCredentialWithAzNoUpdateWrapper which will run command for disabling az update mechanism before first token acquire call.

In Feed publishing task where this authentication is used all of these are wrapped to in-memory short lived cache of tokens.
You can see that one in TokenCredentialShortCache class. It works again as wrapper of TokenCredential and caches only for really small amount of time not to affect timeouts defined by specific implementations.