diff --git a/src/OpenIddict.EntityFramework/Stores/OpenIddictApplicationStore.cs b/src/OpenIddict.EntityFramework/Stores/OpenIddictApplicationStore.cs
index 89629b5c..5330656f 100644
--- a/src/OpenIddict.EntityFramework/Stores/OpenIddictApplicationStore.cs
+++ b/src/OpenIddict.EntityFramework/Stores/OpenIddictApplicationStore.cs
@@ -156,6 +156,20 @@ namespace OpenIddict.EntityFramework
             catch (DbUpdateConcurrencyException) { }
         }
 
+        /// <summary>
+        /// Retrieves an application using its unique identifier.
+        /// </summary>
+        /// <param name="identifier">The unique identifier associated with the application.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the client application corresponding to the identifier.
+        /// </returns>
+        public override Task<TApplication> FindByIdAsync(string identifier, CancellationToken cancellationToken)
+        {
+            return Applications.FindAsync(cancellationToken, ConvertIdentifierFromString(identifier));
+        }
+
         /// <summary>
         /// Executes the specified query.
         /// </summary>
diff --git a/src/OpenIddict.EntityFramework/Stores/OpenIddictAuthorizationStore.cs b/src/OpenIddict.EntityFramework/Stores/OpenIddictAuthorizationStore.cs
index cfdadabf..deb68fbe 100644
--- a/src/OpenIddict.EntityFramework/Stores/OpenIddictAuthorizationStore.cs
+++ b/src/OpenIddict.EntityFramework/Stores/OpenIddictAuthorizationStore.cs
@@ -133,9 +133,7 @@ namespace OpenIddict.EntityFramework
             // Bind the authorization to the specified application, if applicable.
             if (!string.IsNullOrEmpty(descriptor.ApplicationId))
             {
-                var key = ConvertIdentifierFromString(descriptor.ApplicationId);
-
-                var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                var application = await Applications.FindAsync(cancellationToken, ConvertIdentifierFromString(descriptor.ApplicationId));
                 if (application == null)
                 {
                     throw new InvalidOperationException("The application associated with the authorization cannot be found.");
@@ -147,6 +145,20 @@ namespace OpenIddict.EntityFramework
             return await CreateAsync(authorization, cancellationToken);
         }
 
+        /// <summary>
+        /// Retrieves an authorization using its unique identifier.
+        /// </summary>
+        /// <param name="identifier">The unique identifier associated with the authorization.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the authorization corresponding to the identifier.
+        /// </returns>
+        public override Task<TAuthorization> FindByIdAsync(string identifier, CancellationToken cancellationToken)
+        {
+            return Authorizations.FindAsync(cancellationToken, ConvertIdentifierFromString(identifier));
+        }
+
         /// <summary>
         /// Executes the specified query.
         /// </summary>
diff --git a/src/OpenIddict.EntityFramework/Stores/OpenIddictTokenStore.cs b/src/OpenIddict.EntityFramework/Stores/OpenIddictTokenStore.cs
index 3443c103..e3817327 100644
--- a/src/OpenIddict.EntityFramework/Stores/OpenIddictTokenStore.cs
+++ b/src/OpenIddict.EntityFramework/Stores/OpenIddictTokenStore.cs
@@ -142,9 +142,7 @@ namespace OpenIddict.EntityFramework
             // Bind the token to the specified client application, if applicable.
             if (!string.IsNullOrEmpty(descriptor.ApplicationId))
             {
-                var key = ConvertIdentifierFromString(descriptor.ApplicationId);
-
-                var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                var application = await Applications.FindAsync(cancellationToken, ConvertIdentifierFromString(descriptor.ApplicationId));
                 if (application == null)
                 {
                     throw new InvalidOperationException("The application associated with the token cannot be found.");
@@ -156,9 +154,7 @@ namespace OpenIddict.EntityFramework
             // Bind the token to the specified authorization, if applicable.
             if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
             {
-                var key = ConvertIdentifierFromString(descriptor.AuthorizationId);
-
-                var authorization = await Authorizations.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                var authorization = await Authorizations.FindAsync(cancellationToken, ConvertIdentifierFromString(descriptor.AuthorizationId));
                 if (authorization == null)
                 {
                     throw new InvalidOperationException("The authorization associated with the token cannot be found.");
@@ -193,6 +189,20 @@ namespace OpenIddict.EntityFramework
             catch (DbUpdateConcurrencyException) { }
         }
 
+        /// <summary>
+        /// Retrieves an token using its unique identifier.
+        /// </summary>
+        /// <param name="identifier">The unique identifier associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the token corresponding to the unique identifier.
+        /// </returns>
+        public override Task<TToken> FindByIdAsync(string identifier, CancellationToken cancellationToken)
+        {
+            return Tokens.FindAsync(cancellationToken, ConvertIdentifierFromString(identifier));
+        }
+
         /// <summary>
         /// Executes the specified query.
         /// </summary>
@@ -251,15 +261,13 @@ namespace OpenIddict.EntityFramework
 
             if (!string.IsNullOrEmpty(identifier))
             {
-                var key = ConvertIdentifierFromString(identifier);
-
-                var authorization = await Authorizations.SingleOrDefaultAsync(element => element.Id.Equals(key));
+                var authorization = await Authorizations.FindAsync(cancellationToken, ConvertIdentifierFromString(identifier));
                 if (authorization == null)
                 {
                     throw new InvalidOperationException("The authorization associated with the token cannot be found.");
                 }
 
-                authorization.Tokens.Add(token);
+                token.Authorization = authorization;
             }
 
             else
@@ -268,7 +276,7 @@ namespace OpenIddict.EntityFramework
 
                 // Try to retrieve the authorization associated with the token.
                 // If none can be found, assume that no authorization is attached.
-                var authorization = await Authorizations.SingleOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
+                var authorization = await Authorizations.FirstOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
                 if (authorization != null)
                 {
                     authorization.Tokens.Remove(token);
@@ -294,15 +302,13 @@ namespace OpenIddict.EntityFramework
 
             if (!string.IsNullOrEmpty(identifier))
             {
-                var key = ConvertIdentifierFromString(identifier);
-
-                var application = await Applications.SingleOrDefaultAsync(element => element.Id.Equals(key));
+                var application = await Applications.FindAsync(cancellationToken, ConvertIdentifierFromString(identifier));
                 if (application == null)
                 {
                     throw new InvalidOperationException("The application associated with the token cannot be found.");
                 }
 
-                application.Tokens.Add(token);
+                token.Application = application;
             }
 
             else
@@ -311,7 +317,7 @@ namespace OpenIddict.EntityFramework
 
                 // Try to retrieve the application associated with the token.
                 // If none can be found, assume that no application is attached.
-                var application = await Applications.SingleOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
+                var application = await Applications.FirstOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
                 if (application != null)
                 {
                     application.Tokens.Remove(token);
diff --git a/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictApplicationStore.cs b/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictApplicationStore.cs
index 0ba5a373..c33728a2 100644
--- a/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictApplicationStore.cs
+++ b/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictApplicationStore.cs
@@ -155,6 +155,20 @@ namespace OpenIddict.EntityFrameworkCore
             catch (DbUpdateConcurrencyException) { }
         }
 
+        /// <summary>
+        /// Retrieves an application using its unique identifier.
+        /// </summary>
+        /// <param name="identifier">The unique identifier associated with the application.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the client application corresponding to the identifier.
+        /// </returns>
+        public override Task<TApplication> FindByIdAsync(string identifier, CancellationToken cancellationToken)
+        {
+            return Applications.FindAsync(new object[] { ConvertIdentifierFromString(identifier) }, cancellationToken);
+        }
+
         /// <summary>
         /// Executes the specified query.
         /// </summary>
diff --git a/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs b/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs
index bf938412..6acea907 100644
--- a/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs
+++ b/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictAuthorizationStore.cs
@@ -132,9 +132,7 @@ namespace OpenIddict.EntityFrameworkCore
             // Bind the authorization to the specified application, if applicable.
             if (!string.IsNullOrEmpty(descriptor.ApplicationId))
             {
-                var key = ConvertIdentifierFromString(descriptor.ApplicationId);
-
-                var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
                 if (application == null)
                 {
                     throw new InvalidOperationException("The application associated with the authorization cannot be found.");
@@ -146,6 +144,20 @@ namespace OpenIddict.EntityFrameworkCore
             return await CreateAsync(authorization, cancellationToken);
         }
 
+        /// <summary>
+        /// Retrieves an authorization using its unique identifier.
+        /// </summary>
+        /// <param name="identifier">The unique identifier associated with the authorization.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the authorization corresponding to the identifier.
+        /// </returns>
+        public override Task<TAuthorization> FindByIdAsync(string identifier, CancellationToken cancellationToken)
+        {
+            return Authorizations.FindAsync(new object[] { ConvertIdentifierFromString(identifier) }, cancellationToken);
+        }
+
         /// <summary>
         /// Executes the specified query.
         /// </summary>
diff --git a/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs b/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs
index 516d784f..34c593f4 100644
--- a/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs
+++ b/src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictTokenStore.cs
@@ -141,9 +141,7 @@ namespace OpenIddict.EntityFrameworkCore
             // Bind the token to the specified client application, if applicable.
             if (!string.IsNullOrEmpty(descriptor.ApplicationId))
             {
-                var key = ConvertIdentifierFromString(descriptor.ApplicationId);
-
-                var application = await Applications.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.ApplicationId) }, cancellationToken);
                 if (application == null)
                 {
                     throw new InvalidOperationException("The application associated with the token cannot be found.");
@@ -155,9 +153,7 @@ namespace OpenIddict.EntityFrameworkCore
             // Bind the token to the specified authorization, if applicable.
             if (!string.IsNullOrEmpty(descriptor.AuthorizationId))
             {
-                var key = ConvertIdentifierFromString(descriptor.AuthorizationId);
-
-                var authorization = await Authorizations.SingleOrDefaultAsync(entity => entity.Id.Equals(key));
+                var authorization = await Authorizations.FindAsync(new object[] { ConvertIdentifierFromString(descriptor.AuthorizationId) }, cancellationToken);
                 if (authorization == null)
                 {
                     throw new InvalidOperationException("The authorization associated with the token cannot be found.");
@@ -192,6 +188,20 @@ namespace OpenIddict.EntityFrameworkCore
             catch (DbUpdateConcurrencyException) { }
         }
 
+        /// <summary>
+        /// Retrieves an token using its unique identifier.
+        /// </summary>
+        /// <param name="identifier">The unique identifier associated with the token.</param>
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+        /// <returns>
+        /// A <see cref="Task"/> that can be used to monitor the asynchronous operation,
+        /// whose result returns the token corresponding to the unique identifier.
+        /// </returns>
+        public override Task<TToken> FindByIdAsync(string identifier, CancellationToken cancellationToken)
+        {
+            return Tokens.FindAsync(new object[] { ConvertIdentifierFromString(identifier) }, cancellationToken);
+        }
+
         /// <summary>
         /// Executes the specified query.
         /// </summary>
@@ -250,15 +260,13 @@ namespace OpenIddict.EntityFrameworkCore
 
             if (!string.IsNullOrEmpty(identifier))
             {
-                var key = ConvertIdentifierFromString(identifier);
-
-                var authorization = await Authorizations.SingleOrDefaultAsync(element => element.Id.Equals(key));
+                var authorization = await Authorizations.FindAsync(new object[] { ConvertIdentifierFromString(identifier) }, cancellationToken);
                 if (authorization == null)
                 {
                     throw new InvalidOperationException("The authorization associated with the token cannot be found.");
                 }
 
-                authorization.Tokens.Add(token);
+                token.Authorization = authorization;
             }
 
             else
@@ -267,7 +275,7 @@ namespace OpenIddict.EntityFrameworkCore
 
                 // Try to retrieve the authorization associated with the token.
                 // If none can be found, assume that no authorization is attached.
-                var authorization = await Authorizations.SingleOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
+                var authorization = await Authorizations.FirstOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
                 if (authorization != null)
                 {
                     authorization.Tokens.Remove(token);
@@ -295,13 +303,13 @@ namespace OpenIddict.EntityFrameworkCore
             {
                 var key = ConvertIdentifierFromString(identifier);
 
-                var application = await Applications.SingleOrDefaultAsync(element => element.Id.Equals(key));
+                var application = await Applications.FindAsync(new object[] { ConvertIdentifierFromString(identifier) }, cancellationToken);
                 if (application == null)
                 {
                     throw new InvalidOperationException("The application associated with the token cannot be found.");
                 }
 
-                application.Tokens.Add(token);
+                token.Application = application;
             }
 
             else
@@ -310,7 +318,7 @@ namespace OpenIddict.EntityFrameworkCore
 
                 // Try to retrieve the application associated with the token.
                 // If none can be found, assume that no application is attached.
-                var application = await Applications.SingleOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
+                var application = await Applications.FirstOrDefaultAsync(element => element.Tokens.Any(t => t.Id.Equals(key)));
                 if (application != null)
                 {
                     application.Tokens.Remove(token);