diff --git a/src/commands/app/deploy.js b/src/commands/app/deploy.js
index 7e4e24cc..84b400f9 100644
--- a/src/commands/app/deploy.js
+++ b/src/commands/app/deploy.js
@@ -58,7 +58,7 @@ class Deploy extends BuildCommand {
 
     try {
       const { aio: aioConfig, packagejson: packageJson } = await this.getFullConfig()
-      const cliDetails = await getAccessToken({ useCachedToken: flags.publish })
+      const cliDetails = await getAccessToken({ useCachedToken: !flags.publish })
       const appInfo = {
         name: packageJson.name,
         version: packageJson.version,
diff --git a/src/commands/app/undeploy.js b/src/commands/app/undeploy.js
index 5d93f8b2..d1609b78 100644
--- a/src/commands/app/undeploy.js
+++ b/src/commands/app/undeploy.js
@@ -52,7 +52,7 @@ class Undeploy extends BaseCommand {
     const spinner = ora()
     try {
       const { aio: aioConfig, packagejson: packageJson } = await this.getFullConfig()
-      const cliDetails = await getAccessToken({ useCachedToken: flags.unpublish })
+      const cliDetails = await getAccessToken({ useCachedToken: !flags.unpublish })
       const appInfo = {
         name: packageJson.name,
         version: packageJson.version,
diff --git a/src/lib/auth-helper.js b/src/lib/auth-helper.js
index 3dc4a5f6..23357fe2 100644
--- a/src/lib/auth-helper.js
+++ b/src/lib/auth-helper.js
@@ -47,8 +47,8 @@ async function getAccessToken ({ useCachedToken = false } = {}) {
 
   let accessToken = null
   if (useCachedToken) {
-    const contextConfig = await context.get(contextName)
-    accessToken = contextConfig?.access_token?.token
+    const { data } = await context.get(contextName)
+    accessToken = data?.access_token?.token
   } else {
     accessToken = await getToken(contextName)
   }
diff --git a/test/commands/app/deploy.test.js b/test/commands/app/deploy.test.js
index 223ad57f..c6b7ada3 100644
--- a/test/commands/app/deploy.test.js
+++ b/test/commands/app/deploy.test.js
@@ -15,6 +15,8 @@ const BaseCommand = require('../../../src/BaseCommand')
 const cloneDeep = require('lodash.clonedeep')
 const dataMocks = require('../../data-mocks/config-loader')
 const helpersActual = jest.requireActual('../../../src/lib/app-helper.js')
+const authHelpersActual = jest.requireActual('../../../src/lib/auth-helper')
+
 const open = require('open')
 const mockBundleFunc = jest.fn()
 
@@ -394,6 +396,8 @@ describe('run', () => {
   })
 
   test('deploy does not require logged in user with --no-publish (workspace: Production)', async () => {
+    authHelper.getAccessToken.mockImplementation(authHelpersActual.getAccessToken)
+
     command.getAppExtConfigs.mockResolvedValueOnce(createAppConfig(command.appConfig, 'exc'))
     mockGetExtensionPointsRetractedApp() // not published
     command.getFullConfig.mockResolvedValue({
@@ -420,6 +424,9 @@ describe('run', () => {
     expect(mockWebLib.deployWeb).toHaveBeenCalledTimes(1)
     expect(command.buildOneExt).toHaveBeenCalledTimes(1)
     expect(mockLibConsoleCLI.getApplicationExtensions).not.toHaveBeenCalled()
+
+    expect(auditLogger.sendAppDeployAuditLog).toHaveBeenCalledTimes(0)
+    expect(auditLogger.sendAppAssetsDeployedAuditLog).toHaveBeenCalledTimes(0)
   })
 
   test('build & deploy only some actions using --action', async () => {
diff --git a/test/commands/app/undeploy.test.js b/test/commands/app/undeploy.test.js
index 7de9dc57..7bdebeca 100644
--- a/test/commands/app/undeploy.test.js
+++ b/test/commands/app/undeploy.test.js
@@ -14,6 +14,7 @@ const TheCommand = require('../../../src/commands/app/undeploy')
 const BaseCommand = require('../../../src/BaseCommand')
 const dataMocks = require('../../data-mocks/config-loader')
 const cloneDeep = require('lodash.clonedeep')
+const authHelperActual = jest.requireActual('../../../src/lib/auth-helper.js')
 
 jest.mock('../../../src/lib/app-helper.js')
 const helpers = require('../../../src/lib/app-helper.js')
@@ -474,6 +475,18 @@ describe('run', () => {
     expect(command.error).toHaveBeenCalledWith(expect.stringMatching(/Nothing to be done/))
   })
 
+  test('undeploy does not require logged in user with --no-unpublish', async () => {
+    authHelper.getAccessToken.mockImplementation(authHelperActual.getAccessToken)
+    command.getAppExtConfigs.mockResolvedValueOnce(createAppConfig())
+
+    command.argv = ['--no-unpublish']
+    await command.run()
+    expect(command.error).toHaveBeenCalledTimes(0)
+
+    expect(auditLogger.sendAppAssetsUndeployedAuditLog).toHaveBeenCalledTimes(0)
+    expect(auditLogger.sendAppUndeployAuditLog).toHaveBeenCalledTimes(0)
+  })
+
   test('does NOT fire `event` hooks when feature flag is NOT enabled', async () => {
     command.getAppExtConfigs.mockResolvedValueOnce(createAppConfig(command.appConfig))
     command.argv = []
diff --git a/test/commands/lib/auth-helper.test.js b/test/commands/lib/auth-helper.test.js
index 0c013b4c..4580fc5a 100644
--- a/test/commands/lib/auth-helper.test.js
+++ b/test/commands/lib/auth-helper.test.js
@@ -44,7 +44,7 @@ describe('getAccessToken', () => {
   test('should use cached token when requested', async () => {
     const mockToken = 'cached-token'
     const mockEnv = 'prod'
-    const mockContext = { access_token: { token: mockToken } }
+    const mockContext = { data: { access_token: { token: mockToken } } }
     getCliEnv.mockReturnValue(mockEnv)
     context.getCurrent.mockResolvedValue(CLI)
     context.get.mockResolvedValue(mockContext)