fix: preserve connection audience and connector name

[Hui Miao (huimiu)]

Why

azd provision synthesized azure.ai.connection resources without audience and connectorName, so auth and connector settings were dropped. This affected Azure AI Projects and Agents in both greenfield and existing-project deployments. Connector-only OAuth2 connections also require an explicit empty properties.credentials object, which the provisioning templates did not emit.

What changed

• Preserve audience and connectorName through connection synthesis.
• Expand ${VAR} references during provisioning and preserve them during eject.
• Render the fields in Bicep, Terraform, and generated ARM templates for all project paths.
• Emit empty credentials for OAuth2 connections without client credentials while keeping supplied credentials secure.
• Keep the Agents synthesis assets aligned with the canonical Projects implementation.
• Keep AgenticIdentity as a configuration alias and normalize it to the ARM value AgenticIdentityToken.
• Document the fields in the connection schema and add regression coverage.

E2E validation

Command	Scenario	Result
azd ai agent init --infra=bicep --no-prompt	Generate Bicep infrastructure with both connection types	PASS
azd ai agent init --infra=terraform --no-prompt	Generate Terraform infrastructure with both connection types	PASS
azd provision --preview --no-prompt	Preview greenfield Foundry account, project, and connections	PASS
azd provision --no-prompt	Provision the greenfield Foundry project in Azure	PASS
az rest --method get .../connections?api-version=2025-04-01-preview	Verify deployed AgenticIdentityToken, agentic audience, OAuth connector name, and empty credentials	PASS
azd provision --preview --no-prompt	Preview existing-project updates limited to the two connections	PASS
azd provision --no-prompt	Update connections on the existing Foundry project	PASS
az rest --method get .../connections?api-version=2025-04-01-preview	Verify existing-project connection properties	PASS
azd up --no-prompt	Run the parent provision and deploy lifecycle	PASS
azd down --force --purge --no-prompt	Remove the disposable resource group	PASS
az group exists --name <disposable-resource-group>	Confirm the resource group was deleted	PASS

The live ARM checks confirmed that AgenticIdentity became AgenticIdentityToken, the agentic audience was preserved, and the OAuth2 connectorName and empty credentials object were present. Azure does not return audience for the OAuth2 connection because that field applies to identity-based authentication. The normal azd configuration fingerprint was unchanged during the run.

Fixes #9734

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
18 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Thank you for logging this issue; our team is reviewing it. If you need urgent prioritization, tag Rick Winter (@RickWinter) and Kristen Womack (@kristenwomack) to let us know.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
18 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Preserves connection audience and connector names throughout Foundry synthesis, provisioning, and infrastructure ejection.

Changes:

• Adds optional audience and connectorName fields across Go models and schemas.
• Propagates both fields through Bicep, Terraform, and compiled ARM templates.
• Adds regression coverage for expansion, preservation, omission, and generated templates.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
azure.ai.projects/.../terraform/variables.tf	Extends Terraform connection inputs.
azure.ai.projects/.../terraform/connections.tf	Emits optional authentication fields.
azure.ai.projects/.../terraform-existing-project/variables.tf	Extends existing-project inputs.
azure.ai.projects/.../terraform-existing-project/connections.tf	Emits fields for existing projects.
azure.ai.projects/.../modules/resources.bicep	Extends the shared connection type.
azure.ai.projects/.../modules/foundry-project.bicep	Emits fields during project creation.
azure.ai.projects/.../modules/connections.bicep	Documents and emits connection fields.
azure.ai.projects/.../main.bicep	Extends top-level connection parameters.
azure.ai.projects/.../main.arm.json	Updates compiled greenfield ARM output.
azure.ai.projects/.../existing-project.bicep	Extends existing-project parameters.
azure.ai.projects/.../existing-project.arm.json	Updates compiled existing-project ARM output.
azure.ai.projects/.../existing-project-eject.bicep.tmpl	Preserves fields during Bicep ejection.
azure.ai.projects/.../synthesizer.go	Parses and expands both fields.
azure.ai.projects/.../synthesizer_test.go	Adds synthesis and template regressions.
azure.ai.connections/schemas/azure.ai.connection.json	Documents both service properties.
azure.ai.agents/.../terraform/variables.tf	Mirrors Terraform connection inputs.
azure.ai.agents/.../terraform/connections.tf	Mirrors optional field emission.
azure.ai.agents/.../terraform-existing-project/variables.tf	Mirrors existing-project inputs.
azure.ai.agents/.../terraform-existing-project/connections.tf	Mirrors existing-project emission.
azure.ai.agents/.../modules/resources.bicep	Mirrors the shared connection type.
azure.ai.agents/.../modules/foundry-project.bicep	Mirrors project connection emission.
azure.ai.agents/.../modules/connections.bicep	Mirrors connection module changes.
azure.ai.agents/.../main.bicep	Mirrors top-level parameter changes.
azure.ai.agents/.../main.arm.json	Updates compiled greenfield ARM output.
azure.ai.agents/.../existing-project.bicep	Mirrors existing-project parameters.
azure.ai.agents/.../existing-project.arm.json	Updates compiled existing-project ARM output.
azure.ai.agents/.../existing-project-eject.bicep.tmpl	Preserves fields during ejection.
azure.ai.agents/.../synthesizer.go	Mirrors parsing and expansion logic.
azure.ai.agents/.../synthesizer_test.go	Adds mirrored regression coverage.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated no new comments.

Suppressed comments (1)

cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/connections.bicep:29

• The authType values use the ARM wire name AgenticIdentityToken, as the enum immediately above and normalizeAuthTypeToARM confirm. Calling it AgenticIdentity here can lead users to supply an unsupported manifest value; update this description and the synchronized Agents template/schema wording to AgenticIdentityToken.

  @description('Optional token audience for UserEntraToken, AgenticIdentity, or ProjectManagedIdentity connections.')

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

[azure-sdk-automation]

azure.ai.projects PR build

Note

This is an unsigned development build. Install it only if you trust this PR.

Install the extension:

azd ext install "https://azuresdkartifacts.z5.web.core.windows.net/azd/extensions/pr/9741/azure-ai-projects.zip"

• Version: 1.0.0-beta.8.pr.9741.6758977
• Merge commit: 585f321

[azure-sdk-automation]

azure.ai.connections PR build

Note

This is an unsigned development build. Install it only if you trust this PR.

Install the extension:

azd ext install "https://azuresdkartifacts.z5.web.core.windows.net/azd/extensions/pr/9741/azure-ai-connections.zip"

• Version: 1.0.0-beta.5.pr.9741.6758974
• Merge commit: 585f321