diff --git a/NuGet.sln b/NuGet.sln
index fa083edf30c..7433d46c73a 100644
--- a/NuGet.sln
+++ b/NuGet.sln
@@ -624,7 +624,7 @@ Global
 		{50E33DA2-AF14-486D-81B8-BD8409744A38} = {08F523EC-3C2A-4A00-A54C-2E54C5AC856B}
 		{23725516-0A6E-48F9-A148-B5E3FA515B13} = {00CE0FBE-DA5A-4AD8-B0D6-04ECE6B04F0D}
 		{5039C2F9-CAD9-4162-849C-5EF7E3CE03D9} = {01BC4531-1E25-48D7-A8FD-A47D6FEC47FB}
-		{3DB4EDE3-B57B-498C-9EA9-A8BF8D9D4B2B} = {01BC4531-1E25-48D7-A8FD-A47D6FEC47FB}
+		{3DB4EDE3-B57B-498C-9EA9-A8BF8D9D4B2B} = {7323F93B-D141-4001-BB9E-7AF14031143E}
 		{6157BF46-D371-4126-A7F1-ED6E23F77ACD} = {01BC4531-1E25-48D7-A8FD-A47D6FEC47FB}
 		{9EA84487-C70C-420C-9674-75CF19F43757} = {01BC4531-1E25-48D7-A8FD-A47D6FEC47FB}
 		{F7837EEB-1B49-482F-8722-EB35BA0937CC} = {01BC4531-1E25-48D7-A8FD-A47D6FEC47FB}
diff --git a/runTests.ps1 b/runTests.ps1
index 80f0f78e5ce..60515972e67 100644
--- a/runTests.ps1
+++ b/runTests.ps1
@@ -87,9 +87,9 @@ Invoke-BuildStep 'Cleaning package cache' {
     -skip:(-not $CI) `
     -ev +BuildErrors
 
-Invoke-BuildStep 'Running /t:RestoreVS15' {
+Invoke-BuildStep 'Running /t:RestoreVS' {
 
-    & $MSBuildExe build\build.proj /t:RestoreVS15 /p:Configuration=$Configuration /p:ReleaseLabel=$ReleaseLabel /p:BuildNumber=$BuildNumber /v:m /m:1
+    & $MSBuildExe build\build.proj /t:RestoreVS /p:Configuration=$Configuration /p:ReleaseLabel=$ReleaseLabel /p:BuildNumber=$BuildNumber /v:m /m:1
 
     if (-not $?)
     {
diff --git a/src/NuGet.Clients/NuGet.CommandLine/Commands/Command.cs b/src/NuGet.Clients/NuGet.CommandLine/Commands/Command.cs
index 228dc9c2ae2..a176ed81484 100644
--- a/src/NuGet.Clients/NuGet.CommandLine/Commands/Command.cs
+++ b/src/NuGet.Clients/NuGet.CommandLine/Commands/Command.cs
@@ -15,6 +15,7 @@
 using NuGet.Credentials;
 using NuGet.Protocol;
 using NuGet.Protocol.Core.Types;
+using NuGet.Protocol.Plugins;
 
 namespace NuGet.CommandLine
 {
@@ -78,7 +79,8 @@ public string CurrentDirectory
 
         protected internal CoreV2.NuGet.IPackageRepositoryFactory RepositoryFactory { get; set; }
 
-        private Lazy<MsBuildToolset> MsBuildToolset {
+        private Lazy<MsBuildToolset> MsBuildToolset
+        {
             get
             {
                 if (_defaultMsBuildToolset == null)
@@ -211,7 +213,7 @@ private async Task<IEnumerable<ICredentialProvider>> GetCredentialProvidersAsync
             var pluginProviders = new PluginCredentialProviderBuilder(extensionLocator, Settings, Console)
                 .BuildAll(Verbosity.ToString())
                 .ToList();
-            var securePluginProviders =  await (new SecurePluginCredentialProviderBuilder(pluginManager: PluginManager.Instance, canShowDialog: true, logger: Console)).BuildAllAsync();
+            var securePluginProviders = await (new SecurePluginCredentialProviderBuilder(PluginManager.Instance, canShowDialog: true, logger: Console)).BuildAllAsync();
 
             providers.Add(new CredentialProviderAdapter(new SettingsCredentialProvider(SourceProvider, Console)));
             providers.AddRange(securePluginProviders);
diff --git a/src/NuGet.Clients/NuGet.PackageManagement.PowerShellCmdlets/NuGet.PackageManagement.PowerShellCmdlets.csproj b/src/NuGet.Clients/NuGet.PackageManagement.PowerShellCmdlets/NuGet.PackageManagement.PowerShellCmdlets.csproj
index c5c68e06bd2..e9e3a2f3554 100644
--- a/src/NuGet.Clients/NuGet.PackageManagement.PowerShellCmdlets/NuGet.PackageManagement.PowerShellCmdlets.csproj
+++ b/src/NuGet.Clients/NuGet.PackageManagement.PowerShellCmdlets/NuGet.PackageManagement.PowerShellCmdlets.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), 'README.md'))\build\common.legacy.props" />
   <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
@@ -77,10 +77,7 @@
   <ItemGroup>
     <ProjectReference Include="$(NuGetCoreSrcDirectory)NuGet.Resolver\NuGet.Resolver.csproj" />
     <ProjectReference Include="..\NuGet.PackageManagement.VisualStudio\NuGet.PackageManagement.VisualStudio.csproj" />
-    <ProjectReference Include="..\NuGet.VisualStudio\NuGet.VisualStudio.csproj">
-      <Project>{e5556bc6-a7fd-4d8e-8a7d-7648df1d7471}</Project>
-      <Name>NuGet.VisualStudio</Name>
-    </ProjectReference>
+    <ProjectReference Include="..\NuGet.VisualStudio\NuGet.VisualStudio.csproj" />
     <ProjectReference Include="..\NuGet.VisualStudio.Common\NuGet.VisualStudio.Common.csproj" />
   </ItemGroup>
   <ItemGroup>
diff --git a/src/NuGet.Clients/NuGet.PackageManagement.VisualStudio/DefaultVSCredentialServiceProvider.cs b/src/NuGet.Clients/NuGet.PackageManagement.VisualStudio/DefaultVSCredentialServiceProvider.cs
index 849ab7d8a14..3926f925886 100644
--- a/src/NuGet.Clients/NuGet.PackageManagement.VisualStudio/DefaultVSCredentialServiceProvider.cs
+++ b/src/NuGet.Clients/NuGet.PackageManagement.VisualStudio/DefaultVSCredentialServiceProvider.cs
@@ -11,7 +11,7 @@
 using NuGet.Common;
 using NuGet.Credentials;
 using NuGet.ProjectManagement;
-using NuGet.Protocol.Core.Types;
+using NuGet.Protocol.Plugins;
 using NuGet.VisualStudio;
 using IAsyncServiceProvider = Microsoft.VisualStudio.Shell.IAsyncServiceProvider;
 
@@ -150,4 +150,4 @@ private void LogCredentialProviderError(Exception exception, string failureMessa
                 exception);
         }
     }
-}
+}
\ No newline at end of file
diff --git a/src/NuGet.Core/NuGet.Credentials/DefaultCredentialServiceUtility.cs b/src/NuGet.Core/NuGet.Credentials/DefaultCredentialServiceUtility.cs
index 0c76f14afca..5415e2bbf66 100644
--- a/src/NuGet.Core/NuGet.Credentials/DefaultCredentialServiceUtility.cs
+++ b/src/NuGet.Core/NuGet.Credentials/DefaultCredentialServiceUtility.cs
@@ -8,7 +8,7 @@
 using NuGet.Common;
 using NuGet.Configuration;
 using NuGet.Protocol;
-using NuGet.Protocol.Core.Types;
+using NuGet.Protocol.Plugins;
 
 namespace NuGet.Credentials
 {
@@ -45,6 +45,5 @@ private static async Task<IEnumerable<ICredentialProvider>> GetCredentialProvide
             }
             return providers;
         }
-
     }
-}
+}
\ No newline at end of file
diff --git a/src/NuGet.Core/NuGet.Credentials/SecurePluginCredentialProvider.cs b/src/NuGet.Core/NuGet.Credentials/SecurePluginCredentialProvider.cs
index 6b4622d4c44..d620d44814a 100644
--- a/src/NuGet.Core/NuGet.Credentials/SecurePluginCredentialProvider.cs
+++ b/src/NuGet.Core/NuGet.Credentials/SecurePluginCredentialProvider.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Collections.Generic;
 using System.Globalization;
 using System.Linq;
 using System.Net;
@@ -41,7 +40,6 @@ public sealed class SecurePluginCredentialProvider : ICredentialProvider
         // We use this to avoid needlessly instantiating plugins if they don't support authentication.
         private bool _isAnAuthenticationPlugin = true;
 
-
         /// <summary>
         /// Create a credential provider based on provided plugin
         /// </summary>
@@ -89,34 +87,42 @@ public async Task<CredentialResponse> GetAsync(Uri uri, IWebProxy proxy, Credent
                 return taskResponse;
             }
 
-            var creationResult = await _pluginManager.TryGetSourceAgnosticPluginAsync(_discoveredPlugin, OperationClaim.Authentication, cancellationToken);
+            Tuple<bool, PluginCreationResult> result = await _pluginManager.TryGetSourceAgnosticPluginAsync(_discoveredPlugin, OperationClaim.Authentication, cancellationToken);
+
+            bool wasSomethingCreated = result.Item1;
 
-            if (creationResult.Item1) // status of the source creation
+            if (wasSomethingCreated)
             {
-                var plugin = creationResult.Item2; // plugin creation result
-                if (!string.IsNullOrEmpty(plugin.Message))
+                PluginCreationResult creationResult = result.Item2;
+
+                if (!string.IsNullOrEmpty(creationResult.Message))
                 {
                     // There is a potential here for double logging as the CredentialService itself catches the exceptions and tries to log it.
-                    // In reality the logger in the Credential Service will be null because the first request always comes from a resource provider (ServiceIndex provider) 
-                    _logger.LogError(plugin.Message);
+                    // In reality the logger in the Credential Service will be null because the first request always comes from a resource provider (ServiceIndex provider).
+                    _logger.LogError(creationResult.Message);
+
+                    if (creationResult.Exception != null)
+                    {
+                        _logger.LogDebug(creationResult.Exception.ToString());
+                    }
                     _isAnAuthenticationPlugin = false;
-                    throw new PluginException(plugin.Message); // Throwing here will block authentication and ensure that the complete operation fails 
+                    throw new PluginException(creationResult.Message, creationResult.Exception); // Throwing here will block authentication and ensure that the complete operation fails.
                 }
 
-                _isAnAuthenticationPlugin = plugin.Claims.Contains(OperationClaim.Authentication);
+                _isAnAuthenticationPlugin = creationResult.Claims.Contains(OperationClaim.Authentication);
 
                 if (_isAnAuthenticationPlugin)
                 {
-                    AddOrUpdateLogger(plugin.Plugin);
-                    await SetPluginLogLevelAsync(plugin, _logger, cancellationToken);
+                    AddOrUpdateLogger(creationResult.Plugin);
+                    await SetPluginLogLevelAsync(creationResult, _logger, cancellationToken);
 
                     if (proxy != null)
                     {
-                        await SetProxyCredentialsToPlugin(uri, proxy, plugin, cancellationToken);
+                        await SetProxyCredentialsToPlugin(uri, proxy, creationResult, cancellationToken);
                     }
 
                     var request = new GetAuthenticationCredentialsRequest(uri, isRetry, nonInteractive, _canShowDialog);
-                    var credentialResponse = await plugin.Plugin.Connection.SendRequestAndReceiveResponseAsync<GetAuthenticationCredentialsRequest, GetAuthenticationCredentialsResponse>(
+                    var credentialResponse = await creationResult.Plugin.Connection.SendRequestAndReceiveResponseAsync<GetAuthenticationCredentialsRequest, GetAuthenticationCredentialsResponse>(
                         MessageMethod.GetAuthenticationCredentials,
                         request,
                         cancellationToken);
@@ -124,13 +130,11 @@ public async Task<CredentialResponse> GetAsync(Uri uri, IWebProxy proxy, Credent
                     {
                         _logger.LogWarning(
                             string.Format(
-                                    CultureInfo.CurrentCulture,
-                                    Resources.SecurePluginWarning_UseInteractiveOption)
-                                    );
+                                CultureInfo.CurrentCulture,
+                                Resources.SecurePluginWarning_UseInteractiveOption));
                     }
 
                     taskResponse = GetAuthenticationCredentialsResponseToCredentialResponse(credentialResponse);
-
                 }
             }
             else
@@ -214,4 +218,4 @@ private static CredentialResponse GetAuthenticationCredentialsResponseToCredenti
             return taskResponse;
         }
     }
-}
+}
\ No newline at end of file
diff --git a/src/NuGet.Core/NuGet.Protocol/Plugins/PluginCreationResult.cs b/src/NuGet.Core/NuGet.Protocol/Plugins/PluginCreationResult.cs
index 0a57f1689ec..e330a666036 100644
--- a/src/NuGet.Core/NuGet.Protocol/Plugins/PluginCreationResult.cs
+++ b/src/NuGet.Core/NuGet.Protocol/Plugins/PluginCreationResult.cs
@@ -1,4 +1,4 @@
-// Copyright (c) .NET Foundation. All rights reserved.
+// Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
@@ -21,6 +21,11 @@ public sealed class PluginCreationResult
         /// </summary>
         public string Message { get; }
 
+        /// <summary>
+        /// Gets the exception caught.  May be <c>null</c>.
+        /// </summary>
+        public Exception Exception { get; }
+
         /// <summary>
         /// Gets a plugin.
         /// </summary>
@@ -77,5 +82,24 @@ public PluginCreationResult(string message)
 
             Message = message;
         }
+
+        /// <summary>
+        /// Instantiates a new <see cref="PluginCreationResult" /> class.
+        /// </summary>
+        /// <param name="message">A message why a plugin could not be created.</param>
+        /// <param name="exception">An exception.</param>
+        /// <exception cref="ArgumentException">Thrown if <paramref name="message" />
+        /// is either <c>null</c> or an empty string.</exception>
+        /// <exception cref="ArgumentNullException">Thrown if <paramref name="exception" /> is <c>null</c>.</exception>
+        public PluginCreationResult(string message, Exception exception)
+            : this(message)
+        {
+            if (exception == null)
+            {
+                throw new ArgumentNullException(nameof(exception));
+            }
+
+            Exception = exception;
+        }
     }
 }
\ No newline at end of file
diff --git a/src/NuGet.Core/NuGet.Protocol/Plugins/PluginFactory.cs b/src/NuGet.Core/NuGet.Protocol/Plugins/PluginFactory.cs
index 17c8db82cd9..5536d124bb6 100644
--- a/src/NuGet.Core/NuGet.Protocol/Plugins/PluginFactory.cs
+++ b/src/NuGet.Core/NuGet.Protocol/Plugins/PluginFactory.cs
@@ -391,7 +391,7 @@ private void OnPluginProcessExited(object sender, EventArgs e, string pluginId,
             }
         }
 
-        private void SendCloseRequest(IPlugin plugin)
+        private static void SendCloseRequest(IPlugin plugin)
         {
             var message = plugin.Connection.MessageDispatcher.CreateMessage(
                 MessageType.Request,
diff --git a/src/NuGet.Core/NuGet.Protocol/Plugins/PluginManager.cs b/src/NuGet.Core/NuGet.Protocol/Plugins/PluginManager.cs
index 37232543512..40167827d2d 100644
--- a/src/NuGet.Core/NuGet.Protocol/Plugins/PluginManager.cs
+++ b/src/NuGet.Core/NuGet.Protocol/Plugins/PluginManager.cs
@@ -13,10 +13,10 @@
 using NuGet.Common;
 using NuGet.Configuration;
 using NuGet.Packaging;
-using NuGet.Protocol.Plugins;
+using NuGet.Protocol.Core.Types;
 using NuGet.Shared;
 
-namespace NuGet.Protocol.Core.Types
+namespace NuGet.Protocol.Plugins
 {
     /// <summary>
     /// A plugin manager. This manages all the live plugins and their operation claims.
@@ -24,8 +24,8 @@ namespace NuGet.Protocol.Core.Types
     /// </summary>
     public sealed class PluginManager : IPluginManager, IDisposable
     {
-        private static readonly Lazy<IPluginManager> Lazy = new Lazy<IPluginManager>(() => new PluginManager());
-        public static IPluginManager Instance => Lazy.Value;
+        private static readonly Lazy<IPluginManager> _lazy = new Lazy<IPluginManager>(() => new PluginManager());
+        public static IPluginManager Instance => _lazy.Value;
 
         private ConnectionOptions _connectionOptions;
         private Lazy<IPluginDiscoverer> _discoverer;
@@ -36,7 +36,7 @@ public sealed class PluginManager : IPluginManager, IDisposable
         private string _rawPluginPaths;
 
         private static Lazy<int> _currentProcessId = new Lazy<int>(GetCurrentProcessId);
-        private Lazy<string> _pluginsCacheDirectory = new Lazy<string>(() => SettingsUtility.GetPluginsCacheFolder());
+        private Lazy<string> _pluginsCacheDirectoryPath;
 
         /// <summary>
         /// Gets an environment variable reader.
@@ -49,29 +49,21 @@ private PluginManager()
             Initialize(
                 new EnvironmentVariableWrapper(),
                 new Lazy<IPluginDiscoverer>(InitializeDiscoverer),
-                (TimeSpan idleTimeout) => new PluginFactory(idleTimeout));
+                (TimeSpan idleTimeout) => new PluginFactory(idleTimeout),
+                new Lazy<string>(() => SettingsUtility.GetPluginsCacheFolder()));
         }
 
-        /// <summary>
-        /// Creates a new plugin manager
-        /// </summary>
-        /// <remarks>This is public to facilitate unit testing. This should not be called from product code</remarks>
-        /// <param name="reader">An environment variable reader.</param>
-        /// <param name="pluginDiscoverer">A lazy plugin discoverer.</param>
-        /// <param name="pluginFactoryCreator">A plugin factory creator.</param>
-        /// <exception cref="ArgumentNullException">Thrown if <paramref name="reader" /> is <c>null</c>.</exception>
-        /// <exception cref="ArgumentNullException">Thrown if <paramref name="pluginDiscoverer" />
-        /// is <c>null</c>.</exception>
-        /// <exception cref="ArgumentNullException">Thrown if <paramref name="pluginFactoryCreator" />
-        /// is <c>null</c>.</exception>
-        public PluginManager(IEnvironmentVariableReader reader,
+        internal PluginManager(
+            IEnvironmentVariableReader reader,
             Lazy<IPluginDiscoverer> pluginDiscoverer,
-            Func<TimeSpan, IPluginFactory> pluginFactoryCreator)
+            Func<TimeSpan, IPluginFactory> pluginFactoryCreator,
+            Lazy<string> pluginsCacheDirectoryPath)
         {
             Initialize(
                 reader,
                 pluginDiscoverer,
-                pluginFactoryCreator);
+                pluginFactoryCreator,
+                pluginsCacheDirectoryPath);
         }
 
         /// <summary>
@@ -202,7 +194,7 @@ private async Task<Tuple<bool, PluginCreationResult>> TryCreatePluginAsync(
             CancellationToken cancellationToken)
         {
             PluginCreationResult pluginCreationResult = null;
-            var cacheEntry = new PluginCacheEntry(_pluginsCacheDirectory.Value, result.PluginFile.Path, requestKey.PackageSourceRepository);
+            var cacheEntry = new PluginCacheEntry(_pluginsCacheDirectoryPath.Value, result.PluginFile.Path, requestKey.PackageSourceRepository);
 
             return await ConcurrencyUtilities.ExecuteWithFileLockedAsync(
                 cacheEntry.CacheFileName,
@@ -225,13 +217,13 @@ private async Task<Tuple<bool, PluginCreationResult>> TryCreatePluginAsync(
 
                                 // We still make the GetOperationClaims call even if we have the operation claims cached. This is a way to self-update the cache.
                                 var operationClaims = await _pluginOperationClaims.GetOrAdd(
-                                       requestKey,
-                                       key => new Lazy<Task<IReadOnlyList<OperationClaim>>>(() =>
-                                       GetPluginOperationClaimsAsync(
-                                           plugin,
-                                           packageSourceRepository,
-                                           serviceIndex,
-                                           cancellationToken))).Value;
+                                    requestKey,
+                                    key => new Lazy<Task<IReadOnlyList<OperationClaim>>>(() =>
+                                    GetPluginOperationClaimsAsync(
+                                        plugin,
+                                        packageSourceRepository,
+                                        serviceIndex,
+                                        cancellationToken))).Value;
 
                                 if (!EqualityUtility.SequenceEqualWithNullCheck(operationClaims, cacheEntry.OperationClaims))
                                 {
@@ -251,12 +243,12 @@ private async Task<Tuple<bool, PluginCreationResult>> TryCreatePluginAsync(
                         }
                         catch (Exception e)
                         {
-                            // Have a clear error message when the plugin creation fails.
                             pluginCreationResult = new PluginCreationResult(
                                 string.Format(CultureInfo.CurrentCulture,
-                                Strings.Plugin_ProblemStartingPlugin,
-                                result.PluginFile.Path,
-                                e.Message));
+                                    Strings.Plugin_ProblemStartingPlugin,
+                                    result.PluginFile.Path,
+                                    e.Message),
+                                e);
                         }
                     }
                     return new Tuple<bool, PluginCreationResult>(pluginCreationResult != null, pluginCreationResult);
@@ -268,9 +260,9 @@ private async Task<Tuple<bool, PluginCreationResult>> TryCreatePluginAsync(
         private async Task<Lazy<IPluginMulticlientUtilities>> PerformOneTimePluginInitializationAsync(IPlugin plugin, CancellationToken cancellationToken)
         {
             var utilities = _pluginUtilities.GetOrAdd(
-                                plugin.Id,
-                                path => new Lazy<IPluginMulticlientUtilities>(
-                                    () => new PluginMulticlientUtilities()));
+                plugin.Id,
+                path => new Lazy<IPluginMulticlientUtilities>(
+                    () => new PluginMulticlientUtilities()));
 
             await utilities.Value.DoOncePerPluginLifetimeAsync(
                 MessageMethod.MonitorNuGetProcessExit.ToString(),
@@ -284,15 +276,18 @@ await utilities.Value.DoOncePerPluginLifetimeAsync(
                 MessageMethod.Initialize.ToString(),
                 () => InitializePluginAsync(plugin, _connectionOptions.RequestTimeout, cancellationToken),
                 cancellationToken);
+
             return utilities;
         }
 
         private void Initialize(IEnvironmentVariableReader reader,
             Lazy<IPluginDiscoverer> pluginDiscoverer,
-            Func<TimeSpan, IPluginFactory> pluginFactoryCreator)
+            Func<TimeSpan, IPluginFactory> pluginFactoryCreator,
+            Lazy<string> pluginsCacheDirectoryPath)
         {
             EnvironmentVariableReader = reader ?? throw new ArgumentNullException(nameof(reader));
             _discoverer = pluginDiscoverer ?? throw new ArgumentNullException(nameof(pluginDiscoverer));
+            _pluginsCacheDirectoryPath = pluginsCacheDirectoryPath ?? throw new ArgumentNullException(nameof(pluginsCacheDirectoryPath));
 
             if (pluginFactoryCreator == null)
             {
diff --git a/src/NuGet.Core/NuGet.Protocol/Properties/AssemblyInfo.cs b/src/NuGet.Core/NuGet.Protocol/Properties/AssemblyInfo.cs
index f4af1d93a4a..fec189bd53a 100644
--- a/src/NuGet.Core/NuGet.Protocol/Properties/AssemblyInfo.cs
+++ b/src/NuGet.Core/NuGet.Protocol/Properties/AssemblyInfo.cs
@@ -7,9 +7,11 @@
 [assembly: CLSCompliant(true)]
 
 #if SIGNED_BUILD
+[assembly: InternalsVisibleTo("NuGet.Credentials.Test, PublicKey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9")]
 [assembly: InternalsVisibleTo("NuGet.Protocol.Tests, PublicKey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9")]
 [assembly: InternalsVisibleTo("DynamicProxyGenAssembly2, PublicKey=0024000004800000940000000602000000240000525341310004000001000100c547cac37abd99c8db225ef2f6c8a3602f3b3606cc9891605d02baa56104f4cfc0734aa39b93bf7852f7d9266654753cc297e7d2edfe0bac1cdcf9f717241550e0a7b191195b7667bb4f64bcb8e2121380fd1d9d46ad2d92d2d15605093924cceaf74c4861eff62abf69b9291ed0a340e113be11e6a7d3113e92484cf7045cc7")]
 #else
+[assembly: InternalsVisibleTo("NuGet.Credentials.Test")]
 [assembly: InternalsVisibleTo("NuGet.Protocol.Tests")]
 [assembly: InternalsVisibleTo("DynamicProxyGenAssembly2")]
 #endif
\ No newline at end of file
diff --git a/src/NuGet.Core/NuGet.Protocol/Providers/PluginResourceProvider.cs b/src/NuGet.Core/NuGet.Protocol/Providers/PluginResourceProvider.cs
index f7383156784..4f10f77487c 100644
--- a/src/NuGet.Core/NuGet.Protocol/Providers/PluginResourceProvider.cs
+++ b/src/NuGet.Core/NuGet.Protocol/Providers/PluginResourceProvider.cs
@@ -2,18 +2,10 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Collections.Concurrent;
-using System.Collections.Generic;
-using System.Diagnostics;
-using System.Globalization;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
-using Newtonsoft.Json.Linq;
-using NuGet.Common;
-using NuGet.Packaging;
 using NuGet.Protocol.Plugins;
-using NuGet.Shared;
 
 namespace NuGet.Protocol.Core.Types
 {
@@ -23,7 +15,6 @@ namespace NuGet.Protocol.Core.Types
     /// <remarks>This is unsealed only to facilitate testing.</remarks>
     public class PluginResourceProvider : ResourceProvider
     {
-
         private readonly IPluginManager _pluginManager;
 
         public PluginResourceProvider() : this(PluginManager.Instance)
diff --git a/src/NuGet.Core/NuGet.Protocol/Strings.Designer.cs b/src/NuGet.Core/NuGet.Protocol/Strings.Designer.cs
index f33ed778076..007c7cc4340 100644
--- a/src/NuGet.Core/NuGet.Protocol/Strings.Designer.cs
+++ b/src/NuGet.Core/NuGet.Protocol/Strings.Designer.cs
@@ -781,7 +781,7 @@ internal static string Plugin_PackageDownloadFailed {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Problem starting the plugin  &apos;{0}&apos;. {1}.
+        ///   Looks up a localized string similar to Problem starting the plugin &apos;{0}&apos;. {1}.
         /// </summary>
         internal static string Plugin_ProblemStartingPlugin {
             get {
diff --git a/src/NuGet.Core/NuGet.Protocol/Strings.resx b/src/NuGet.Core/NuGet.Protocol/Strings.resx
index 72bc903a1f4..7041fb58171 100644
--- a/src/NuGet.Core/NuGet.Protocol/Strings.resx
+++ b/src/NuGet.Core/NuGet.Protocol/Strings.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -516,7 +516,7 @@ The "ms" should be localized to the abbreviation for milliseconds.</comment>
     <value>Downloading a package from a plugin is not supported since unsigned packages are not allowed and package download plugins do not support signed package verification.</value>
   </data>
   <data name="Plugin_ProblemStartingPlugin" xml:space="preserve">
-    <value>Problem starting the plugin  '{0}'. {1}</value>
+    <value>Problem starting the plugin '{0}'. {1}</value>
     <comment>0 - plugin path, 1 - error message </comment>
   </data>
   <data name="PushCommandSkipDuplicateAdvertise" xml:space="preserve">
diff --git a/test/NuGet.Core.Tests/NuGet.Credentials.Test/PluginManagerMock.cs b/test/NuGet.Core.Tests/NuGet.Credentials.Test/PluginManagerMock.cs
index 491457671cf..800d8df41c6 100644
--- a/test/NuGet.Core.Tests/NuGet.Credentials.Test/PluginManagerMock.cs
+++ b/test/NuGet.Core.Tests/NuGet.Credentials.Test/PluginManagerMock.cs
@@ -11,13 +11,12 @@
 using NuGet.Common;
 using NuGet.Configuration;
 using NuGet.Protocol;
-using NuGet.Protocol.Core.Types;
 using NuGet.Protocol.Plugins;
+using NuGet.Test.Utility;
 using NuGet.Versioning;
 
 namespace NuGet.Credentials.Test
 {
-
     internal sealed class TestExpectation
     {
         internal IEnumerable<OperationClaim> OperationClaims { get; }
@@ -35,8 +34,6 @@ internal sealed class TestExpectation
         public bool CanShowDialog { get; }
 
         internal TestExpectation(
-            string serviceIndexJson,
-            string sourceUri,
             IEnumerable<OperationClaim> operationClaims,
             ConnectionOptions connectionOptions,
             SemanticVersion pluginVersion,
@@ -47,14 +44,9 @@ internal TestExpectation(
             string proxyUsername = null,
             string proxyPassword = null,
             bool pluginLaunched = true,
-            bool canShowDialog = true
-            )
+            bool canShowDialog = true)
         {
-            var serviceIndex = string.IsNullOrEmpty(serviceIndexJson)
-                ? null : new ServiceIndexResourceV3(JObject.Parse(serviceIndexJson), DateTime.UtcNow);
-
             OperationClaims = operationClaims;
-            OperationClaimsSourceRepository = sourceUri;
             ClientConnectionOptions = connectionOptions;
             PluginVersion = pluginVersion;
             Uri = uri;
@@ -79,15 +71,17 @@ internal sealed class PluginManagerMock : IDisposable
 
         internal PluginManager PluginManager { get; }
 
-        private string _pluginFilePath;
+        private readonly string _pluginFilePath;
+        private readonly TestDirectory _testDirectory;
 
         internal PluginManagerMock(
-                string pluginFilePath,
-                PluginFileState pluginFileState,
-                TestExpectation expectations)
+            string pluginFilePath,
+            PluginFileState pluginFileState,
+            TestExpectation expectations)
         {
             _pluginFilePath = pluginFilePath;
             _expectations = expectations;
+            _testDirectory = TestDirectory.Create();
 
             _reader = new Mock<IEnvironmentVariableReader>(MockBehavior.Strict);
             EnsureAllEnvironmentVariablesAreCalled(pluginFilePath);
@@ -109,7 +103,7 @@ internal PluginManagerMock(
                 .Returns(expectations.ClientConnectionOptions);
 
             _connection.SetupGet(x => x.ProtocolVersion)
-                            .Returns(expectations.PluginVersion);
+                .Returns(expectations.PluginVersion);
 
             // Setup expectations
             _connection.Setup(x => x.SendRequestAndReceiveResponseAsync<GetOperationClaimsRequest, GetOperationClaimsResponse>(
@@ -131,25 +125,26 @@ internal PluginManagerMock(
             if (expectations.ProxyUsername != null && expectations.ProxyPassword != null)
             {
                 _connection.Setup(x => x.SendRequestAndReceiveResponseAsync<SetCredentialsRequest, SetCredentialsResponse>(
-                    It.Is<MessageMethod>(m => m == MessageMethod.SetCredentials),
-                    It.Is<SetCredentialsRequest>(e => e.PackageSourceRepository.Equals(expectations.Uri.AbsolutePath) && e.Password == null && e.Username == null && e.ProxyPassword.Equals(expectations.ProxyPassword) && e.ProxyUsername.Equals(expectations.ProxyUsername)),
-                    It.IsAny<CancellationToken>()))
-                .ReturnsAsync(new SetCredentialsResponse(MessageResponseCode.Success));
+                        It.Is<MessageMethod>(m => m == MessageMethod.SetCredentials),
+                        It.Is<SetCredentialsRequest>(e => e.PackageSourceRepository.Equals(expectations.Uri.AbsolutePath) && e.Password == null && e.Username == null && e.ProxyPassword.Equals(expectations.ProxyPassword) && e.ProxyUsername.Equals(expectations.ProxyUsername)),
+                        It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(new SetCredentialsResponse(MessageResponseCode.Success));
             }
 
             if (_expectations.Success)
             {
                 _connection.Setup(x => x.SendRequestAndReceiveResponseAsync<GetAuthenticationCredentialsRequest, GetAuthenticationCredentialsResponse>(
-                    It.Is<MessageMethod>(m => m == MessageMethod.GetAuthenticationCredentials),
-                    It.Is<GetAuthenticationCredentialsRequest>(e => e.Uri.Equals(expectations.Uri) && e.CanShowDialog.Equals(expectations.CanShowDialog)),
-                    It.IsAny<CancellationToken>()))
-                .ReturnsAsync(new GetAuthenticationCredentialsResponse(expectations.AuthenticationUsername, expectations.AuthenticationPassword, null, null, MessageResponseCode.Success));
+                        It.Is<MessageMethod>(m => m == MessageMethod.GetAuthenticationCredentials),
+                        It.Is<GetAuthenticationCredentialsRequest>(e => e.Uri.Equals(expectations.Uri) && e.CanShowDialog.Equals(expectations.CanShowDialog)),
+                        It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(new GetAuthenticationCredentialsResponse(expectations.AuthenticationUsername, expectations.AuthenticationPassword, message: null, authenticationTypes: null, responseCode: MessageResponseCode.Success));
             }
 
             PluginManager = new PluginManager(
-                                _reader.Object,
-                                new Lazy<IPluginDiscoverer>(() => _pluginDiscoverer.Object),
-                                (TimeSpan idleTimeout) => _factory.Object);
+                _reader.Object,
+                new Lazy<IPluginDiscoverer>(() => _pluginDiscoverer.Object),
+                (TimeSpan idleTimeout) => _factory.Object,
+                new Lazy<string>(() => _testDirectory.Path));
         }
 
         public void Dispose()
@@ -160,7 +155,6 @@ public void Dispose()
                     CachingUtility.RemoveInvalidFileNameChars(CachingUtility.ComputeHash(_pluginFilePath))),
                 new List<string>());
             PluginManager.Dispose();
-            GC.SuppressFinalize(this);
 
             _reader.Verify();
             _pluginDiscoverer.Verify();
@@ -175,18 +169,18 @@ public void Dispose()
                 if (_expectations.Success)
                 {
                     _connection.Verify(x => x.SendRequestAndReceiveResponseAsync<GetAuthenticationCredentialsRequest, GetAuthenticationCredentialsResponse>(
-                            It.Is<MessageMethod>(m => m == MessageMethod.GetAuthenticationCredentials),
-                            It.IsAny<GetAuthenticationCredentialsRequest>(),
-                            It.IsAny<CancellationToken>()), Times.Once());
+                        It.Is<MessageMethod>(m => m == MessageMethod.GetAuthenticationCredentials),
+                        It.IsAny<GetAuthenticationCredentialsRequest>(),
+                        It.IsAny<CancellationToken>()), Times.Once());
                 }
 
                 if (_expectations.ProxyUsername != null && _expectations.ProxyPassword != null)
                 {
                     _connection.Verify(x => x.SendRequestAndReceiveResponseAsync<SetCredentialsRequest, SetCredentialsResponse>(
-                        It.Is<MessageMethod>(m => m == MessageMethod.SetCredentials),
-                        It.Is<SetCredentialsRequest>(e => e.PackageSourceRepository.Equals(_expectations.Uri.AbsolutePath) && e.Password == null && e.Username == null && e.ProxyPassword.Equals(_expectations.ProxyPassword) && e.ProxyUsername.Equals(_expectations.ProxyUsername)),
-                        It.IsAny<CancellationToken>()),
-                    Times.Once());
+                            It.Is<MessageMethod>(m => m == MessageMethod.SetCredentials),
+                            It.Is<SetCredentialsRequest>(e => e.PackageSourceRepository.Equals(_expectations.Uri.AbsolutePath) && e.Password == null && e.Username == null && e.ProxyPassword.Equals(_expectations.ProxyPassword) && e.ProxyUsername.Equals(_expectations.ProxyUsername)),
+                            It.IsAny<CancellationToken>()),
+                        Times.Once());
                 }
             }
             _connection.Verify();
@@ -194,6 +188,7 @@ public void Dispose()
             _plugin.Verify();
             _factory.Verify();
 
+            _testDirectory.Dispose();
         }
 
         private void EnsureAllEnvironmentVariablesAreCalled(string pluginFilePath)
@@ -203,13 +198,13 @@ private void EnsureAllEnvironmentVariablesAreCalled(string pluginFilePath)
                 .Returns(pluginFilePath);
             _reader.Setup(x => x.GetEnvironmentVariable(
                     It.Is<string>(value => value == CredentialTestConstants.PluginRequestTimeoutEnvironmentVariable)))
-                        .Returns("RequestTimeout");
+                .Returns("RequestTimeout");
             _reader.Setup(x => x.GetEnvironmentVariable(
                     It.Is<string>(value => value == CredentialTestConstants.PluginIdleTimeoutEnvironmentVariable)))
-                        .Returns("IdleTimeout");
+                .Returns("IdleTimeout");
             _reader.Setup(x => x.GetEnvironmentVariable(
                     It.Is<string>(value => value == CredentialTestConstants.PluginHandshakeTimeoutEnvironmentVariable)))
-                        .Returns("HandshakeTimeout");
+                .Returns("HandshakeTimeout");
         }
 
         private void EnsureDiscovererIsCalled(string pluginFilePath, PluginFileState pluginFileState)
@@ -218,7 +213,7 @@ private void EnsureDiscovererIsCalled(string pluginFilePath, PluginFileState plu
             _pluginDiscoverer.Setup(x => x.DiscoverAsync(It.IsAny<CancellationToken>()))
                 .ReturnsAsync(new[]
                     {
-                            new PluginDiscoveryResult(new PluginFile(pluginFilePath, new Lazy<PluginFileState>(() => pluginFileState)))
+                        new PluginDiscoveryResult(new PluginFile(pluginFilePath, new Lazy<PluginFileState>(() => pluginFileState)))
                     });
         }
 
@@ -239,10 +234,9 @@ private void EnsureBasicPluginSetupCalls()
                 .ReturnsAsync(new InitializeResponse(MessageResponseCode.Success));
 
             _connection.Setup(x => x.MessageDispatcher.RequestHandlers.AddOrUpdate(
-                    It.Is<MessageMethod>(m => m == MessageMethod.Log),
-                    It.IsAny<Func<IRequestHandler>>(),
-                    It.IsAny<Func<IRequestHandler, IRequestHandler>>()));
-
+                It.Is<MessageMethod>(m => m == MessageMethod.Log),
+                It.IsAny<Func<IRequestHandler>>(),
+                It.IsAny<Func<IRequestHandler, IRequestHandler>>()));
         }
 
         private void EnsurePluginSetupCalls()
@@ -251,7 +245,7 @@ private void EnsurePluginSetupCalls()
             _plugin.SetupGet(x => x.Connection)
                 .Returns(_connection.Object);
             _plugin.SetupGet(x => x.Id)
-                                .Returns("id");
+                .Returns("id");
         }
 
         private void EnsureFactorySetupCalls(string pluginFilePath)
diff --git a/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderBuilderTests.cs b/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderBuilderTests.cs
index 4d78dbe52ca..5ec70dc646e 100644
--- a/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderBuilderTests.cs
+++ b/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderBuilderTests.cs
@@ -9,61 +9,78 @@
 using System.Threading.Tasks;
 using Moq;
 using NuGet.Common;
-using NuGet.Protocol.Core.Types;
 using NuGet.Protocol.Plugins;
+using NuGet.Test.Utility;
 using Xunit;
 
 namespace NuGet.Credentials.Test
 {
     public class SecurePluginCredentialProviderBuilderTests
     {
+        private readonly TestDirectory _testDirectory;
+
+        public SecurePluginCredentialProviderBuilderTests()
+        {
+            _testDirectory = TestDirectory.Create();
+        }
+
+        public void Dispose()
+        {
+            _testDirectory.Dispose();
+        }
+
         [Fact]
-        public void CredentialProviderBuilder_ThrowsExceptionForNullLogger()
+        public void Constructor_WhenLoggerIsNull_Throws()
         {
             var exception = Assert.Throws<ArgumentNullException>(
-                () => new SecurePluginCredentialProviderBuilder(CreateDefaultPluginManager(), true, null));
+                () => new SecurePluginCredentialProviderBuilder(CreateDefaultPluginManager(), canShowDialog: true, logger: null));
             Assert.Equal("logger", exception.ParamName);
         }
 
         [Fact]
-        public void CredentialProviderBuilder_ThrowsExceptionForNullPluginManager()
+        public void Constructor_WhenPluginManagerIsNull_Throws()
         {
             var exception = Assert.Throws<ArgumentNullException>(
-                () => new SecurePluginCredentialProviderBuilder(null, true, NullLogger.Instance));
+                () => new SecurePluginCredentialProviderBuilder(pluginManager: null, canShowDialog: true, logger: NullLogger.Instance));
             Assert.Equal("pluginManager", exception.ParamName);
         }
 
         [Fact]
-        public async Task BuildAll_BuildsZero()
+        public async Task BuildAllAsync_BuildsZero()
         {
             var plugins = new List<KeyValuePair<string, PluginFileState>>();
-            var pluginManager = new PluginManagerBuilderMock(plugins);
-            var builder = new SecurePluginCredentialProviderBuilder(pluginManager.PluginManager, true, NullLogger.Instance);
 
-            var credentialProviders = await builder.BuildAllAsync();
-            Assert.Equal(0, credentialProviders.Count());
+            using (var pluginManagerBuilder = new PluginManagerBuilderMock(plugins))
+            {
+                var providerBuilder = new SecurePluginCredentialProviderBuilder(pluginManagerBuilder.PluginManager, canShowDialog: true, logger: NullLogger.Instance);
+
+                var credentialProviders = await providerBuilder.BuildAllAsync();
+                Assert.Equal(0, credentialProviders.Count());
+            }
         }
 
         [Fact]
-        public async Task BuildAll_BuildsPluginsInCorrectOrder()
+        public async Task BuildAllAsync_BuildsPluginsInCorrectOrder()
         {
             var plugins = new List<KeyValuePair<string, PluginFileState>>();
             plugins.Add(new KeyValuePair<string, PluginFileState>("a", PluginFileState.Valid));
             plugins.Add(new KeyValuePair<string, PluginFileState>("b", PluginFileState.Valid));
             plugins.Add(new KeyValuePair<string, PluginFileState>("c", PluginFileState.Valid));
 
-            var pluginManager = new PluginManagerBuilderMock(plugins);
-            var builder = new SecurePluginCredentialProviderBuilder(pluginManager.PluginManager, true, NullLogger.Instance);
+            using (var pluginManagerBuilder = new PluginManagerBuilderMock(plugins))
+            {
+                var providerBuilder = new SecurePluginCredentialProviderBuilder(pluginManagerBuilder.PluginManager, canShowDialog: true, logger: NullLogger.Instance);
 
-            var credentialProviders = (await builder.BuildAllAsync()).ToArray();
-            Assert.Equal(3, credentialProviders.Count());
-            Assert.StartsWith(nameof(SecurePluginCredentialProvider) + "_a", credentialProviders[0].Id);
-            Assert.StartsWith(nameof(SecurePluginCredentialProvider) + "_b", credentialProviders[1].Id);
-            Assert.StartsWith(nameof(SecurePluginCredentialProvider) + "_c", credentialProviders[2].Id);
+                var credentialProviders = (await providerBuilder.BuildAllAsync()).ToArray();
+                Assert.Equal(3, credentialProviders.Count());
+                Assert.StartsWith(nameof(SecurePluginCredentialProvider) + "_a", credentialProviders[0].Id);
+                Assert.StartsWith(nameof(SecurePluginCredentialProvider) + "_b", credentialProviders[1].Id);
+                Assert.StartsWith(nameof(SecurePluginCredentialProvider) + "_c", credentialProviders[2].Id);
+            }
         }
 
         [Fact]
-        public async Task BuildAll_BuildsAllPlugins()
+        public async Task BuildAllAsync_BuildsAllPlugins()
         {
             var plugins = new List<KeyValuePair<string, PluginFileState>>();
             plugins.Add(new KeyValuePair<string, PluginFileState>("a", PluginFileState.Valid));
@@ -71,36 +88,44 @@ public async Task BuildAll_BuildsAllPlugins()
             plugins.Add(new KeyValuePair<string, PluginFileState>("c", PluginFileState.InvalidFilePath));
             plugins.Add(new KeyValuePair<string, PluginFileState>("d", PluginFileState.NotFound));
 
+            using (var pluginManagerBuilder = new PluginManagerBuilderMock(plugins))
+            {
+                var providerBuilder = new SecurePluginCredentialProviderBuilder(pluginManagerBuilder.PluginManager, canShowDialog: true, logger: NullLogger.Instance);
 
-            var pluginManager = new PluginManagerBuilderMock(plugins);
-            var builder = new SecurePluginCredentialProviderBuilder(pluginManager.PluginManager, true, NullLogger.Instance);
-
-            var credentialProviders = (await builder.BuildAllAsync()).ToArray();
-            Assert.Equal(4, credentialProviders.Count());
+                var credentialProviders = (await providerBuilder.BuildAllAsync()).ToArray();
+                Assert.Equal(4, credentialProviders.Count());
+            }
         }
 
         [Theory]
         [InlineData(true)]
         [InlineData(false)]
-        public async Task BuildAll_PassesCorrectCanShowDialogValue(bool canShowDialog)
+        public async Task BuildAllAsync_PassesCorrectCanShowDialogValue(bool canShowDialog)
         {
             var plugins = new List<KeyValuePair<string, PluginFileState>>();
             plugins.Add(new KeyValuePair<string, PluginFileState>("a", PluginFileState.Valid));
 
-            var pluginManager = new PluginManagerBuilderMock(plugins);
-            var builder = new SecurePluginCredentialProviderBuilder(pluginManager.PluginManager, canShowDialog, NullLogger.Instance);
+            using (var pluginManagerBuilder = new PluginManagerBuilderMock(plugins))
+            {
+                var providerBuilder = new SecurePluginCredentialProviderBuilder(pluginManagerBuilder.PluginManager, canShowDialog, logger: NullLogger.Instance);
 
-            var credentialProviders = (await builder.BuildAllAsync()).ToArray();
-            Assert.Equal(1, credentialProviders.Count());
-            var bla = typeof(SecurePluginCredentialProvider).GetTypeInfo().GetField("_canShowDialog", BindingFlags.NonPublic | BindingFlags.GetField | BindingFlags.Instance);
-            Assert.Equal(canShowDialog, bla.GetValue(credentialProviders.Single()));
+                var credentialProviders = (await providerBuilder.BuildAllAsync()).ToArray();
+                Assert.Equal(1, credentialProviders.Count());
+                var bla = typeof(SecurePluginCredentialProvider).GetTypeInfo().GetField("_canShowDialog", BindingFlags.NonPublic | BindingFlags.GetField | BindingFlags.Instance);
+                Assert.Equal(canShowDialog, bla.GetValue(credentialProviders.Single()));
+            }
         }
 
-        private sealed class PluginManagerBuilderMock
+        private sealed class PluginManagerBuilderMock : IDisposable
         {
+            private readonly TestDirectory _testDirectory;
+
             internal PluginManager PluginManager { get; }
+
             internal PluginManagerBuilderMock(List<KeyValuePair<string, PluginFileState>> plugins)
             {
+                _testDirectory = TestDirectory.Create();
+
                 var reader = new Mock<IEnvironmentVariableReader>(MockBehavior.Strict);
 
                 reader.Setup(x => x.GetEnvironmentVariable(
@@ -126,7 +151,13 @@ internal PluginManagerBuilderMock(List<KeyValuePair<string, PluginFileState>> pl
                 PluginManager = new PluginManager(
                     reader.Object,
                     new Lazy<IPluginDiscoverer>(() => pluginDiscoverer.Object),
-                    (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>());
+                    (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>(),
+                    new Lazy<string>(() => _testDirectory.Path));
+            }
+
+            public void Dispose()
+            {
+                _testDirectory.Dispose();
             }
 
             private static IEnumerable<PluginDiscoveryResult> GetPluginDiscoveryResults(List<KeyValuePair<string, PluginFileState>> plugins)
@@ -142,12 +173,13 @@ private static IEnumerable<PluginDiscoveryResult> GetPluginDiscoveryResults(List
             }
         }
 
-        private static PluginManager CreateDefaultPluginManager()
+        private PluginManager CreateDefaultPluginManager()
         {
             return new PluginManager(
-                reader: Mock.Of<IEnvironmentVariableReader>(),
-                pluginDiscoverer: new Lazy<IPluginDiscoverer>(),
-                pluginFactoryCreator: (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>());
+                Mock.Of<IEnvironmentVariableReader>(),
+                new Lazy<IPluginDiscoverer>(),
+                (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>(),
+                new Lazy<string>(() => _testDirectory.Path));
         }
     }
-}
+}
\ No newline at end of file
diff --git a/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderTests.cs b/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderTests.cs
index 2ff6f29d3ce..79fa578f5cd 100644
--- a/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderTests.cs
+++ b/test/NuGet.Core.Tests/NuGet.Credentials.Test/SecurePluginCredentialProviderTests.cs
@@ -2,42 +2,62 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.IO;
 using System.Net;
 using System.Threading;
+using System.Threading.Tasks;
 using Moq;
 using NuGet.Common;
 using NuGet.Configuration;
-using NuGet.Protocol.Core.Types;
 using NuGet.Protocol.Plugins;
 using NuGet.Test.Utility;
 using Xunit;
 
 namespace NuGet.Credentials.Test
 {
-    public class SecurePluginCredentialProviderTests
+    public sealed class SecurePluginCredentialProviderTests : IDisposable
     {
+        private static readonly Uri _uri = new Uri("https://unit.test");
+        private const string _username = "username";
+        private const string _password = "password";
+
+        private readonly TestDirectory _testDirectory;
+
+        public SecurePluginCredentialProviderTests()
+        {
+            _testDirectory = TestDirectory.Create();
+        }
+
+        public void Dispose()
+        {
+            _testDirectory.Dispose();
+        }
+
         [Fact]
-        public void Create_ThrowsForNullPlugin()
+        public void Constructor_WhenPluginManagerIsNull_Throws()
         {
+            IPluginManager pluginManager = null;
+
             var exception = Assert.Throws<ArgumentNullException>(
-                () => new SecurePluginCredentialProvider(CreateDefaultPluginManager(), null, true, NullLogger.Instance));
+                () => new SecurePluginCredentialProvider(pluginManager, CreatePluginDiscoveryResult(), canShowDialog: true, logger: NullLogger.Instance));
 
-            Assert.Equal("pluginDiscoveryResult", exception.ParamName);
+            Assert.Equal("pluginManager", exception.ParamName);
         }
 
-        public void Create_ThrowsForNullPluginManager()
+        [Fact]
+        public void Constructor_WhenPluginDiscoveryResultIsNull_Throws()
         {
             var exception = Assert.Throws<ArgumentNullException>(
-                () => new SecurePluginCredentialProvider(null, CreatePluginDiscoveryResult(), true, NullLogger.Instance));
+                () => new SecurePluginCredentialProvider(CreateDefaultPluginManager(), pluginDiscoveryResult: null, canShowDialog: true, logger: NullLogger.Instance));
 
-            Assert.Equal("pluginManager", exception.ParamName);
+            Assert.Equal("pluginDiscoveryResult", exception.ParamName);
         }
 
         [Fact]
-        public void Create_ThrowsForNullLogger()
+        public void Constructor_WhenLoggerIsNull_Throws()
         {
             var exception = Assert.Throws<ArgumentNullException>(
-                () => new SecurePluginCredentialProvider(CreateDefaultPluginManager(), CreatePluginDiscoveryResult(), true, null));
+                () => new SecurePluginCredentialProvider(CreateDefaultPluginManager(), CreatePluginDiscoveryResult(), canShowDialog: true, logger: null));
 
             Assert.Equal("logger", exception.ParamName);
         }
@@ -45,35 +65,29 @@ public void Create_ThrowsForNullLogger()
         [Fact]
         public void Type_IsICredentialProvider()
         {
-            var provider = new SecurePluginCredentialProvider(CreateDefaultPluginManager(), CreatePluginDiscoveryResult(), true, NullLogger.Instance);
+            var provider = new SecurePluginCredentialProvider(CreateDefaultPluginManager(), CreatePluginDiscoveryResult(), canShowDialog: true, logger: NullLogger.Instance);
             Assert.True(provider is ICredentialProvider);
         }
 
         [Fact]
-        public void Provider_IdContainsPath()
+        public void Id_WithValidArguments_ContainsPluginFilePath()
         {
             var pluginResult = CreatePluginDiscoveryResult();
-            var provider = new SecurePluginCredentialProvider(CreateDefaultPluginManager(), pluginResult, true, NullLogger.Instance);
+            var provider = new SecurePluginCredentialProvider(CreateDefaultPluginManager(), pluginResult, canShowDialog: true, logger: NullLogger.Instance);
             Assert.Contains(pluginResult.PluginFile.Path, provider.Id);
         }
 
         [PlatformFact(Platform.Windows)]
-        public void GetCredentialsAsync_ReturnsValidCredentials()
+        public async Task GetAsync_WithValidArguments_ReturnsValidCredentials()
         {
-            var uri = new Uri("https://api.nuget.org/v3/index.json");
-            var authUsername = "username";
-            var authPassword = "password";
             var expectation = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.Authentication },
                 connectionOptions: ConnectionOptions.CreateDefault(),
-                pluginVersion: Protocol.Plugins.ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
-                success: true
-                );
+                pluginVersion: ProtocolConstants.CurrentVersion,
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
+                success: true);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -81,41 +95,34 @@ public void GetCredentialsAsync_ReturnsValidCredentials()
                 expectations: expectation))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, true, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog: true, logger: NullLogger.Instance);
 
-                System.Net.IWebProxy proxy = null;
+                IWebProxy proxy = null;
                 var credType = CredentialRequestType.Unauthorized;
                 var message = "nothing";
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.Success);
                 Assert.NotNull(credentialResponse.Credentials);
-                Assert.Equal(authUsername, credentialResponse.Credentials.GetCredential(uri, null).UserName);
-                Assert.Equal(authPassword, credentialResponse.Credentials.GetCredential(uri, null).Password);
+                Assert.Equal(_username, credentialResponse.Credentials.GetCredential(_uri, authType: null).UserName);
+                Assert.Equal(_password, credentialResponse.Credentials.GetCredential(_uri, authType: null).Password);
             }
         }
 
         [PlatformFact(Platform.Windows)]
-        public void TryCreate_DoesNotCreateNonCredentialsPluginTwice()
+        public async Task GetAsync_WhenCalledMultipleTimes_DoesNotCreateMultipleInstancesOfANonCredentialsPlugin()
         {
-            var uri = new Uri("https://api.nuget.org/v3/index.json");
-            var authUsername = "username";
-            var authPassword = "password";
-
             var expectation = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.DownloadPackage },
                 connectionOptions: ConnectionOptions.CreateDefault(),
                 pluginVersion: ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
-                success: false
-                );
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
+                success: false);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -123,42 +130,36 @@ public void TryCreate_DoesNotCreateNonCredentialsPluginTwice()
                 expectations: expectation))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, true, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog: true, logger: NullLogger.Instance);
 
-                System.Net.IWebProxy proxy = null;
+                IWebProxy proxy = null;
                 var credType = CredentialRequestType.Unauthorized;
                 var message = "nothing";
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.ProviderNotApplicable);
                 Assert.Null(credentialResponse.Credentials);
 
-                var credentialResponse2 = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse2 = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
                 Assert.True(credentialResponse2.Status == CredentialStatus.ProviderNotApplicable);
                 Assert.Null(credentialResponse2.Credentials);
             }
         }
 
         [PlatformFact(Platform.Windows)]
-        public void GetCredentialsAsync_ReturnsValidCredentialsFromMultiOperationClaim()
+        public async Task GetAsync_WhenPluginClaimsMultipleOperations_ReturnsValidCredentials()
         {
-            var uri = new Uri("https://api.nuget.org/v3/index.json");
-            var authUsername = "username";
-            var authPassword = "password";
             var expectation = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.Authentication, OperationClaim.DownloadPackage },
                 connectionOptions: ConnectionOptions.CreateDefault(),
                 pluginVersion: ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
-                success: true
-                );
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
+                success: true);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -166,45 +167,39 @@ public void GetCredentialsAsync_ReturnsValidCredentialsFromMultiOperationClaim()
                 expectations: expectation))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, true, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog: true, logger: NullLogger.Instance);
 
-                System.Net.IWebProxy proxy = null;
+                IWebProxy proxy = null;
                 var credType = CredentialRequestType.Unauthorized;
                 var message = "nothing";
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.Success);
                 Assert.NotNull(credentialResponse.Credentials);
-                Assert.Equal(authUsername, credentialResponse.Credentials.GetCredential(uri, null).UserName);
-                Assert.Equal(authPassword, credentialResponse.Credentials.GetCredential(uri, null).Password);
+                Assert.Equal(_username, credentialResponse.Credentials.GetCredential(_uri, authType: null).UserName);
+                Assert.Equal(_password, credentialResponse.Credentials.GetCredential(_uri, authType: null).Password);
             }
         }
 
         [PlatformFact(Platform.Windows)]
-        public void TryCreate_SetsProxyCredentials()
+        public async Task GetAsync_WhenProxyIsUsed_SetsProxyCredentials()
         {
-            var uri = new Uri("https://api.nuget.org/v3/index.json");
-            var authUsername = "username";
-            var authPassword = "password";
             var proxyUsername = "proxyUsername";
             var proxyPassword = "proxyPassword";
 
             var expectation = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.Authentication },
                 connectionOptions: ConnectionOptions.CreateDefault(),
                 pluginVersion: ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
                 success: true,
                 proxyUsername: proxyUsername,
-                proxyPassword: proxyPassword
-                );
+                proxyPassword: proxyPassword);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -212,7 +207,7 @@ public void TryCreate_SetsProxyCredentials()
                 expectations: expectation))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, true, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog: true, logger: NullLogger.Instance);
                 var proxy = new System.Net.WebProxy()
                 {
                     Credentials = new NetworkCredential(proxyUsername, proxyPassword)
@@ -222,33 +217,26 @@ public void TryCreate_SetsProxyCredentials()
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.Success);
                 Assert.NotNull(credentialResponse.Credentials);
-                Assert.Equal(authUsername, credentialResponse.Credentials.GetCredential(uri, null).UserName);
-                Assert.Equal(authPassword, credentialResponse.Credentials.GetCredential(uri, null).Password);
+                Assert.Equal(_username, credentialResponse.Credentials.GetCredential(_uri, authType: null).UserName);
+                Assert.Equal(_password, credentialResponse.Credentials.GetCredential(_uri, authType: null).Password);
             }
         }
 
         [PlatformFact(Platform.Windows)]
-        public void TryCreate_DoesNotCreateNonCredentialsPluginTwice_CachesCapabilities()
+        public async Task GetAsync_WhenCalledMultipleTimes_CachesCapabilities()
         {
-            var uri = new Uri("https://api.nuget.org/v3/index.json");
-            var authUsername = "username";
-            var authPassword = "password";
-
             var expectation = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.DownloadPackage },
                 connectionOptions: ConnectionOptions.CreateDefault(),
                 pluginVersion: ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
-                success: false
-                );
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
+                success: false);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -256,7 +244,7 @@ public void TryCreate_DoesNotCreateNonCredentialsPluginTwice_CachesCapabilities(
                 expectations: expectation))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, true, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog: true, logger: NullLogger.Instance);
 
                 IWebProxy proxy = null;
                 var credType = CredentialRequestType.Unauthorized;
@@ -264,24 +252,21 @@ public void TryCreate_DoesNotCreateNonCredentialsPluginTwice_CachesCapabilities(
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.ProviderNotApplicable);
                 Assert.Null(credentialResponse.Credentials);
             }
 
             var expectations2 = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.DownloadPackage },
                 connectionOptions: ConnectionOptions.CreateDefault(),
                 pluginVersion: ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
                 success: false,
-                pluginLaunched: false
-                );
+                pluginLaunched: false);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -289,7 +274,7 @@ public void TryCreate_DoesNotCreateNonCredentialsPluginTwice_CachesCapabilities(
                 expectations: expectations2))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, true, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog: true, logger: NullLogger.Instance);
 
                 IWebProxy proxy = null;
                 var credType = CredentialRequestType.Unauthorized;
@@ -297,7 +282,7 @@ public void TryCreate_DoesNotCreateNonCredentialsPluginTwice_CachesCapabilities(
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.ProviderNotApplicable);
                 Assert.Null(credentialResponse.Credentials);
@@ -305,27 +290,21 @@ public void TryCreate_DoesNotCreateNonCredentialsPluginTwice_CachesCapabilities(
         }
 
         [PlatformFact(Platform.Windows)]
-        public void GetCredentialsAsync_SendsCorrectCanShowDialogValue()
+        public async Task GetAsync_SendsCorrectCanShowDialogValue()
         {
-            var uri = new Uri("https://api.nuget.org/v3/index.json");
-            var authUsername = "username";
-            var authPassword = "password";
             var canShowDialog = false;
             var expectation = new TestExpectation(
-                serviceIndexJson: null,
-                sourceUri: null,
                 operationClaims: new[] { OperationClaim.Authentication },
                 connectionOptions: ConnectionOptions.CreateDefault(),
                 pluginVersion: ProtocolConstants.CurrentVersion,
-                uri: uri,
-                authenticationUsername: authUsername,
-                authenticationPassword: authPassword,
+                uri: _uri,
+                authenticationUsername: _username,
+                authenticationPassword: _password,
                 success: true,
                 proxyUsername: null,
                 proxyPassword: null,
                 pluginLaunched: true,
-                canShowDialog: canShowDialog
-                );
+                canShowDialog: canShowDialog);
 
             using (var test = new PluginManagerMock(
                 pluginFilePath: "a",
@@ -333,7 +312,7 @@ public void GetCredentialsAsync_SendsCorrectCanShowDialogValue()
                 expectations: expectation))
             {
                 var discoveryResult = new PluginDiscoveryResult(new PluginFile("a", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
-                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog, NullLogger.Instance);
+                var provider = new SecurePluginCredentialProvider(test.PluginManager, discoveryResult, canShowDialog, logger: NullLogger.Instance);
 
                 IWebProxy proxy = null;
                 var credType = CredentialRequestType.Unauthorized;
@@ -341,26 +320,73 @@ public void GetCredentialsAsync_SendsCorrectCanShowDialogValue()
                 var isRetry = false;
                 var isInteractive = false;
                 var token = CancellationToken.None;
-                var credentialResponse = provider.GetAsync(uri, proxy, credType, message, isRetry, isInteractive, token).Result;
+                var credentialResponse = await provider.GetAsync(_uri, proxy, credType, message, isRetry, isInteractive, token);
 
                 Assert.True(credentialResponse.Status == CredentialStatus.Success);
                 Assert.NotNull(credentialResponse.Credentials);
-                Assert.Equal(authUsername, credentialResponse.Credentials.GetCredential(uri, null).UserName);
-                Assert.Equal(authPassword, credentialResponse.Credentials.GetCredential(uri, null).Password);
+                Assert.Equal(_username, credentialResponse.Credentials.GetCredential(_uri, authType: null).UserName);
+                Assert.Equal(_password, credentialResponse.Credentials.GetCredential(_uri, authType: null).Password);
             }
         }
 
-        private static PluginDiscoveryResult CreatePluginDiscoveryResult(PluginFileState pluginState = PluginFileState.Valid)
+        [PlatformFact(Platform.Windows)]
+        public async Task GetAsync_WhenPluginManagerReturnsException_ExceptionIsPropagated()
         {
-            return new PluginDiscoveryResult(new PluginFile(@"C:\random\path\plugin.exe", new Lazy<PluginFileState>(() => pluginState)));
+            var expectedMessage = "a";
+            var expectedException = CreateExceptionWithCallstack("b");
+            var pluginCreationResult = new PluginCreationResult(expectedMessage, expectedException);
+            var result = new Tuple<bool, PluginCreationResult>(true, pluginCreationResult);
+            var pluginManager = new Mock<IPluginManager>(MockBehavior.Strict);
+
+            pluginManager.Setup(x => x.TryGetSourceAgnosticPluginAsync(
+                    It.IsNotNull<PluginDiscoveryResult>(),
+                    It.Is<OperationClaim>(claim => claim == OperationClaim.Authentication),
+                    It.IsAny<CancellationToken>()))
+                .ReturnsAsync(result);
+
+            var pluginDiscoveryResult = new PluginDiscoveryResult(new PluginFile("c", new Lazy<PluginFileState>(() => PluginFileState.Valid)));
+            var logger = new Mock<ILogger>(MockBehavior.Strict);
+
+            logger.Setup(x => x.LogError(It.Is<string>(data => data == expectedMessage)));
+            logger.Setup(x => x.LogDebug(It.Is<string>(data => data == expectedException.ToString())));
+
+            var provider = new SecurePluginCredentialProvider(pluginManager.Object, pluginDiscoveryResult, canShowDialog: false, logger: logger.Object);
+
+            var exception = await Assert.ThrowsAsync<PluginException>(
+                () => provider.GetAsync(_uri, proxy: null, type: CredentialRequestType.Forbidden, message: null, isRetry: false, nonInteractive: true, cancellationToken: CancellationToken.None));
+
+            Assert.Same(expectedException, exception.InnerException);
+
+            pluginManager.Verify();
+            logger.Verify();
         }
 
-        private static PluginManager CreateDefaultPluginManager()
+        private PluginDiscoveryResult CreatePluginDiscoveryResult(PluginFileState pluginState = PluginFileState.Valid)
+        {
+            return new PluginDiscoveryResult(new PluginFile(Path.Combine(_testDirectory.Path, "plugin.exe"), new Lazy<PluginFileState>(() => pluginState)));
+        }
+
+        private PluginManager CreateDefaultPluginManager()
         {
             return new PluginManager(
-                reader: Mock.Of<IEnvironmentVariableReader>(),
-                pluginDiscoverer: new Lazy<IPluginDiscoverer>(),
-                pluginFactoryCreator: (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>());
+                Mock.Of<IEnvironmentVariableReader>(),
+                new Lazy<IPluginDiscoverer>(),
+                (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>(),
+                new Lazy<string>(() => _testDirectory.Path));
+        }
+
+        private static Exception CreateExceptionWithCallstack(string message)
+        {
+            try
+            {
+                throw new Exception(message);
+            }
+            catch (Exception ex)
+            {
+                return ex;
+            }
+
+            throw new InvalidOperationException("This should never be hit.");
         }
     }
 }
\ No newline at end of file
diff --git a/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginCreationResultTests.cs b/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginCreationResultTests.cs
index 8da8330cc1f..4e74d04fb08 100644
--- a/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginCreationResultTests.cs
+++ b/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginCreationResultTests.cs
@@ -1,4 +1,4 @@
-// Copyright (c) .NET Foundation. All rights reserved.
+// Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
@@ -57,6 +57,26 @@ public void Constructor_Message_ThrowsForNullOrEmptyMessage(string message)
             Assert.Equal("message", exception.ParamName);
         }
 
+        [Theory]
+        [InlineData(null)]
+        [InlineData("")]
+        public void Constructor_Message_Exception_ThrowsForNullOrEmptyMessage(string message)
+        {
+            var exception = Assert.Throws<ArgumentException>(
+                () => new PluginCreationResult(message, exception: new Exception()));
+
+            Assert.Equal("message", exception.ParamName);
+        }
+
+        [Fact]
+        public void Constructor_Message_Exception_ThrowsForNullException()
+        {
+            var exception = Assert.Throws<ArgumentNullException>(
+                () => new PluginCreationResult("a", exception: null));
+
+            Assert.Equal("exception", exception.ParamName);
+        }
+
         [Fact]
         public void Constructor_PluginClaims_InitializesProperties()
         {
@@ -81,6 +101,20 @@ public void Constructor_Message_InitializesProperties()
             Assert.Null(result.PluginMulticlientUtilities);
             Assert.Null(result.Claims);
             Assert.Equal("a", result.Message);
+            Assert.Null(result.Exception);
+        }
+
+        [Fact]
+        public void Constructor_Message_Exception_InitializesProperties()
+        {
+            var exception = new Exception();
+            var result = new PluginCreationResult(message: "a", exception: exception);
+
+            Assert.Null(result.Plugin);
+            Assert.Null(result.PluginMulticlientUtilities);
+            Assert.Null(result.Claims);
+            Assert.Equal("a", result.Message);
+            Assert.Same(exception, result.Exception);
         }
     }
 }
\ No newline at end of file
diff --git a/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginManagerTests.cs b/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginManagerTests.cs
new file mode 100644
index 00000000000..4a38c3eabd6
--- /dev/null
+++ b/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginManagerTests.cs
@@ -0,0 +1,66 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Moq;
+using NuGet.Common;
+using NuGet.Test.Utility;
+using Xunit;
+
+namespace NuGet.Protocol.Plugins.Tests
+{
+    public class PluginManagerTests
+    {
+        [Fact]
+        public async Task TryGetSourceAgnosticPluginAsync_WhenExceptionIsThrownDuringPluginCreation_PropagatesException()
+        {
+            const string pluginFilePath = "a";
+            const string message = "b";
+
+            var reader = Mock.Of<IEnvironmentVariableReader>();
+            var pluginFactory = new Mock<IPluginFactory>(MockBehavior.Strict);
+            var exception = new Exception(message);
+
+            pluginFactory.Setup(x => x.GetOrCreateAsync(
+                    It.Is<string>(filePath => string.Equals(filePath, pluginFilePath, StringComparison.Ordinal)),
+                    It.Is<IEnumerable<string>>(arguments => arguments != null && arguments.Any()),
+                    It.IsNotNull<IRequestHandlers>(),
+                    It.IsNotNull<ConnectionOptions>(),
+                    It.IsAny<CancellationToken>()))
+                .ThrowsAsync(exception);
+            pluginFactory.Setup(x => x.Dispose());
+
+            using (var directory = TestDirectory.Create())
+            using (var pluginManager = new PluginManager(
+                reader,
+                new Lazy<IPluginDiscoverer>(() => Mock.Of<IPluginDiscoverer>()),
+                (TimeSpan idleTimeout) => pluginFactory.Object,
+                new Lazy<string>(() => directory.Path)))
+            {
+                var discoveryResult = new PluginDiscoveryResult(
+                    new PluginFile(
+                        pluginFilePath,
+                        new Lazy<PluginFileState>(() => PluginFileState.Valid)));
+
+                Tuple<bool, PluginCreationResult> result = await pluginManager.TryGetSourceAgnosticPluginAsync(
+                    discoveryResult,
+                    OperationClaim.Authentication,
+                    CancellationToken.None);
+                bool wasSomethingCreated = result.Item1;
+                PluginCreationResult creationResult = result.Item2;
+
+                Assert.True(wasSomethingCreated);
+                Assert.NotNull(creationResult);
+
+                Assert.Equal($"Problem starting the plugin '{pluginFilePath}'. {message}", creationResult.Message);
+                Assert.Same(exception, creationResult.Exception);
+            }
+
+            pluginFactory.Verify();
+        }
+    }
+}
\ No newline at end of file
diff --git a/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginResourceProviderTests.cs b/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginResourceProviderTests.cs
index b3d4f7a246c..43e8f223980 100644
--- a/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginResourceProviderTests.cs
+++ b/test/NuGet.Core.Tests/NuGet.Protocol.Tests/Plugins/PluginResourceProviderTests.cs
@@ -83,28 +83,30 @@ await Assert.ThrowsAsync<OperationCanceledException>(
         [InlineData("")]
         public async Task TryCreate_ReturnsFalseForNullOrEmptyEnvironmentVariable(string pluginsPath)
         {
-            var test = new PluginResourceProviderNegativeTest(
+            using (var test = new PluginResourceProviderNegativeTest(
                 serviceIndexJson: "{}",
                 sourceUri: _sourceUri,
-                pluginsPath: pluginsPath);
-
-            var result = await test.Provider.TryCreate(test.SourceRepository, CancellationToken.None);
+                pluginsPath: pluginsPath))
+            {
+                var result = await test.Provider.TryCreate(test.SourceRepository, CancellationToken.None);
 
-            Assert.False(result.Item1);
-            Assert.Null(result.Item2);
+                Assert.False(result.Item1);
+                Assert.Null(result.Item2);
+            }
         }
 
         [Fact]
         public async Task TryCreate_ReturnsFalseIfNoServiceIndexResourceV3()
         {
-            var test = new PluginResourceProviderNegativeTest(
+            using (var test = new PluginResourceProviderNegativeTest(
                 serviceIndexJson: null,
-                sourceUri: _sourceUri);
-
-            var result = await test.Provider.TryCreate(test.SourceRepository, CancellationToken.None);
+                sourceUri: _sourceUri))
+            {
+                var result = await test.Provider.TryCreate(test.SourceRepository, CancellationToken.None);
 
-            Assert.False(result.Item1);
-            Assert.Null(result.Item2);
+                Assert.False(result.Item1);
+                Assert.Null(result.Item2);
+            }
         }
 
         [Theory]
@@ -112,14 +114,15 @@ public async Task TryCreate_ReturnsFalseIfNoServiceIndexResourceV3()
         [InlineData("file:///C:/unit/test")]
         public async Task TryCreate_ReturnsFalseIfPackageSourceIsNotHttpOrHttps(string sourceUri)
         {
-            var test = new PluginResourceProviderNegativeTest(
+            using (var test = new PluginResourceProviderNegativeTest(
                 serviceIndexJson: "{}",
-                sourceUri: sourceUri);
-
-            var result = await test.Provider.TryCreate(test.SourceRepository, CancellationToken.None);
+                sourceUri: sourceUri))
+            {
+                var result = await test.Provider.TryCreate(test.SourceRepository, CancellationToken.None);
 
-            Assert.False(result.Item1);
-            Assert.Null(result.Item2);
+                Assert.False(result.Item1);
+                Assert.Null(result.Item2);
+            }
         }
 
         [PlatformFact(Platform.Windows)]
@@ -203,58 +206,6 @@ public async Task TryCreate_QueriesPluginForEachPackageSourceRepository()
             }
         }
 
-        [Fact]
-        public void Reinitialize_ThrowsForNullReader()
-        {
-            var provider = new PluginResourceProvider();
-            var exception = Assert.Throws<ArgumentNullException>(
-                () => new PluginManager(
-                    reader: null,
-                    pluginDiscoverer: new Lazy<IPluginDiscoverer>(),
-                    pluginFactoryCreator: (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>()));
-
-            Assert.Equal("reader", exception.ParamName);
-        }
-
-        [Fact]
-        public void Reinitialize_ThrowsForNullPluginDiscoverer()
-        {
-            var provider = new PluginResourceProvider();
-            var exception = Assert.Throws<ArgumentNullException>(
-                () => new PluginManager(
-                    Mock.Of<IEnvironmentVariableReader>(),
-                    pluginDiscoverer: null,
-                    pluginFactoryCreator: (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>()));
-
-            Assert.Equal("pluginDiscoverer", exception.ParamName);
-        }
-
-        [Fact]
-        public void Reinitialize_ThrowsForNullPluginFactoryCreator()
-        {
-            var provider = new PluginResourceProvider();
-            var exception = Assert.Throws<ArgumentNullException>(
-                () => new PluginManager(
-                    Mock.Of<IEnvironmentVariableReader>(),
-                    new Lazy<IPluginDiscoverer>(() => Mock.Of<IPluginDiscoverer>()),
-                    pluginFactoryCreator: null));
-
-            Assert.Equal("pluginFactoryCreator", exception.ParamName);
-        }
-
-        [Fact]
-        public void Reinitialize_SetsNewReader()
-        {
-            var reader = Mock.Of<IEnvironmentVariableReader>();
-
-            var pluginManager = new PluginManager(
-                reader,
-                new Lazy<IPluginDiscoverer>(() => Mock.Of<IPluginDiscoverer>()),
-                (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>());
-
-            Assert.Same(reader, pluginManager.EnvironmentVariableReader);
-        }
-
         private static SourceRepository CreateSourceRepository(
             ServiceIndexResourceV3 serviceIndexResource,
             string sourceUri)
@@ -275,8 +226,12 @@ private static SourceRepository CreateSourceRepository(
             return new SourceRepository(packageSource, new[] { provider.Object });
         }
 
-        private sealed class PluginResourceProviderNegativeTest
+        private sealed class PluginResourceProviderNegativeTest : IDisposable
         {
+            private readonly Mock<IPluginDiscoverer> _pluginDiscoverer;
+            private readonly PluginManager _pluginManager;
+            private readonly Mock<IEnvironmentVariableReader> _environmentVariableReader;
+
             internal PluginResourceProvider Provider { get; }
             internal SourceRepository SourceRepository { get; }
 
@@ -287,34 +242,41 @@ internal PluginResourceProviderNegativeTest(string serviceIndexJson, string sour
 
                 SourceRepository = CreateSourceRepository(serviceIndex, sourceUri);
 
-                var reader = new Mock<IEnvironmentVariableReader>(MockBehavior.Strict);
+                _environmentVariableReader = new Mock<IEnvironmentVariableReader>(MockBehavior.Strict);
 
-                reader.Setup(x => x.GetEnvironmentVariable(
+                _environmentVariableReader.Setup(x => x.GetEnvironmentVariable(
                         It.Is<string>(value => value == _pluginPathsEnvironmentVariable)))
                     .Returns(pluginsPath);
-                reader.Setup(x => x.GetEnvironmentVariable(
+                _environmentVariableReader.Setup(x => x.GetEnvironmentVariable(
                         It.Is<string>(value => value == _pluginRequestTimeoutEnvironmentVariable)))
                     .Returns("b");
-                reader.Setup(x => x.GetEnvironmentVariable(
+                _environmentVariableReader.Setup(x => x.GetEnvironmentVariable(
                         It.Is<string>(value => value == _pluginIdleTimeoutEnvironmentVariable)))
                     .Returns("c");
-                reader.Setup(x => x.GetEnvironmentVariable(
+                _environmentVariableReader.Setup(x => x.GetEnvironmentVariable(
                         It.Is<string>(value => value == _pluginHandshakeTimeoutEnvironmentVariable)))
                     .Returns("d");
 
-                var pluginDiscoverer = new Mock<IPluginDiscoverer>(MockBehavior.Strict);
+                _pluginDiscoverer = new Mock<IPluginDiscoverer>(MockBehavior.Strict);
                 var pluginDiscoveryResults = GetPluginDiscoveryResults(pluginsPath);
 
-                pluginDiscoverer.Setup(x => x.DiscoverAsync(It.IsAny<CancellationToken>()))
+                _pluginDiscoverer.Setup(x => x.DiscoverAsync(It.IsAny<CancellationToken>()))
                     .ReturnsAsync(pluginDiscoveryResults);
 
+                _pluginManager = new PluginManager(
+                    _environmentVariableReader.Object,
+                    new Lazy<IPluginDiscoverer>(() => _pluginDiscoverer.Object),
+                    (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>(),
+                    new Lazy<string>(() => "a"));
+                Provider = new PluginResourceProvider(_pluginManager);
+            }
 
-                var pluginManager = new PluginManager(
-                    reader.Object,
-                    new Lazy<IPluginDiscoverer>(() => pluginDiscoverer.Object),
-                    (TimeSpan idleTimeout) => Mock.Of<IPluginFactory>());
-                Provider = new PluginResourceProvider(pluginManager);
+            public void Dispose()
+            {
+                _pluginManager.Dispose();
 
+                _environmentVariableReader.Verify();
+                _pluginDiscoverer.Verify();
             }
 
             private static IEnumerable<PluginDiscoveryResult> GetPluginDiscoveryResults(string pluginPaths)
@@ -444,10 +406,9 @@ internal PluginResourceProviderPositiveTest(
                 PluginManager = new PluginManager(
                     _reader.Object,
                     new Lazy<IPluginDiscoverer>(() => _pluginDiscoverer.Object),
-                    (TimeSpan idleTimeout) => _factory.Object);
+                    (TimeSpan idleTimeout) => _factory.Object,
+                    new Lazy<string>(() => "a"));
                 Provider = new PluginResourceProvider(PluginManager);
-
-                
             }
 
             public void Dispose()
@@ -458,7 +419,6 @@ public void Dispose()
                         CachingUtility.RemoveInvalidFileNameChars(CachingUtility.ComputeHash(_pluginFilePath))),
                     new List<string>());
                 PluginManager.Dispose();
-                GC.SuppressFinalize(this);
 
                 _reader.Verify();
                 _pluginDiscoverer.Verify();