diff --git a/sdk/core/azure-core/azure/core/pipeline/policies/_authentication.py b/sdk/core/azure-core/azure/core/pipeline/policies/_authentication.py
index 4af2d9312327..0492fabc47a6 100644
--- a/sdk/core/azure-core/azure/core/pipeline/policies/_authentication.py
+++ b/sdk/core/azure-core/azure/core/pipeline/policies/_authentication.py
@@ -89,9 +89,10 @@ def on_request(self, request):
         """
         self._enforce_https(request)
 
+        # new token is needed if token is None or token is expired
         if self._need_new_token:
             self._token = self._credential.get_token(*self._scopes)
-            self._update_headers(request.http_request.headers, self._token.token)
+        self._update_headers(request.http_request.headers, self._token.token)  # ignore
 
 
 class AzureKeyCredentialPolicy(SansIOHTTPPolicy):