diff --git a/src/azure-cli-core/azure/cli/core/auth/credential_adaptor.py b/src/azure-cli-core/azure/cli/core/auth/credential_adaptor.py
index dc97b48e6b2..53fc3dffb5c 100644
--- a/src/azure-cli-core/azure/cli/core/auth/credential_adaptor.py
+++ b/src/azure-cli-core/azure/cli/core/auth/credential_adaptor.py
@@ -57,12 +57,13 @@ def signed_session(self, session=None):
     def get_token(self, *scopes, **kwargs):
         logger.debug("CredentialAdaptor.get_token: scopes=%r, kwargs=%r", scopes, kwargs)
 
-        # SDK azure-keyvault-keys 4.5.0b5 passes tenant_id as kwargs, but we don't support tenant_id for now,
-        # so discard it.
-        kwargs.pop('tenant_id', None)
+        # Discard unsupported kwargs: tenant_id, enable_cae
+        filtered_kwargs = {}
+        if 'data' in kwargs:
+            filtered_kwargs['data'] = kwargs['data']
 
         scopes = _normalize_scopes(scopes)
-        token, _ = self._get_token(scopes, **kwargs)
+        token, _ = self._get_token(scopes, **filtered_kwargs)
         return token
 
     def get_auxiliary_tokens(self, *scopes, **kwargs):