Add S2S app role assignment support to setup process#367
Merged
Conversation
Enables automatic S2S (service-to-service) app role assignments during agent blueprint setup, specifically for the Observability API OtelWrite scope. Adds AppRoleScopes to ResourcePermissionSpec, a new GrantAppRoleAssignmentAsync method in AgentBlueprintService, and orchestration logic in BatchPermissionsOrchestrator to grant S2S roles after delegated grants. Separates AppRoleAssignment.ReadWrite.All into a dedicated RequiredS2SGrantScopes constant to prevent the admin-only scope from being requested on non-admin paths (a365 deploy, setup permissions). Fixes the admin consent URL for the Observability API — replaces the non-existent Maven.ReadWrite.All scope with Agent365.Observability.OtelWrite, matching the actual delegated and application permissions on the resource. Updates setup summaries, consent URL builders, and error reporting for clarity. Includes unit tests for all S2S assignment scenarios.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
- Re-enable a365 create-instance with User.ReadWrite.All requirement - Grant Agent365.Observability.OtelWrite as delegated & app perm - Add S2S app role assignment support to setup commands - Expand default Graph scopes (ChannelMessage, Files) - Add server-driven notice system for advisories/upgrades - Add --dry-run to a365 cleanup azure - Add AppServiceAuthRequirementCheck before deploy - Require sponsor for A365CreateInstanceRunner - Fix TLS proxy issues by using direct MSAL.NET token acquisition - Allow blueprint deletion by Global Admins regardless of creator - Use correct Observability API admin consent scope - Restrict AppRoleAssignment.ReadWrite.All to admin-only paths - Improve consent and authentication fallback flows
ajmfehr
previously approved these changes
Apr 14, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds S2S (service-to-service) app role assignment support to the setup/admin setup flows so agent blueprints can be granted application permissions (not just delegated grants), and fixes the Observability API admin consent scope used in consent URLs.
Changes:
- Introduces
AppRoleScopesonResourcePermissionSpecand new orchestration to grant app role assignments after delegated OAuth2 grants. - Adds
AgentBlueprintService.GrantAppRoleAssignmentAsyncplus new unit tests covering S2S assignment scenarios. - Updates consent URL construction/tests to use
Agent365.Observability.OtelWrite(and removes the old non-existent Observability admin consent scope constant), and splitsAppRoleAssignment.ReadWrite.Allinto a dedicatedRequiredS2SGrantScopes.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/AgentBlueprintServiceTests.cs | Adds unit tests for app role assignment; also adjusts GraphApiService construction in tests. |
| src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Helpers/SetupHelpersConsentUrlTests.cs | Updates assertions to validate the corrected Observability consent scope in URLs. |
| src/Microsoft.Agents.A365.DevTools.Cli/Services/AgentBlueprintService.cs | Adds GrantAppRoleAssignmentAsync to create idempotent appRoleAssignments via Graph. |
| src/Microsoft.Agents.A365.DevTools.Cli/Constants/ConfigConstants.cs | Removes the obsolete Observability admin-consent scope constant (Maven.*) and relies on OtelWrite scope. |
| src/Microsoft.Agents.A365.DevTools.Cli/Constants/AuthenticationConstants.cs | Adds RequiredS2SGrantScopes to isolate admin-only scope usage. |
| src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/SetupResults.cs | Adds S2SAppRoleGranted to report S2S assignment status in setup summaries. |
| src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/SetupHelpers.cs | Adds S2S role info into fixed permission specs and updates setup/admin summaries + consent URL builders. |
| src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/ResourcePermissionSpec.cs | Extends permission spec to carry optional AppRoleScopes. |
| src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/BatchPermissionsOrchestrator.cs | Orchestrates S2S app role assignment after delegated grants; updates admin/non-admin result reporting. |
| src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/AdminSubcommand.cs | Plumbs AgentBlueprintService into admin permissions path for S2S grants. |
| src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupCommand.cs | Wires the blueprint service into the setup admin subcommand. |
- Leave S2SAppRoleGranted as null if blueprint SP is unresolved or service is unavailable, clarifying "not attempted" vs "not applicable" - Deduplicate and sanitize app role names before assignment to prevent redundant POSTs - Track assigned role IDs within a single operation to avoid duplicate assignments - Add test assertions and resource disposal for improved test reliability and clarity - Enhance consent URL test with explicit reasoning for scope encoding
sellakumaran
enabled auto-merge (squash)
April 14, 2026 01:12
ajmfehr
approved these changes
Apr 14, 2026
nikhilNava
approved these changes
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AppRoleScopestoResourcePermissionSpecand a newGrantAppRoleAssignmentAsyncmethod inAgentBlueprintServiceto grant S2S (service-to-service) app role assignments for the Observability API (Agent365.Observability.OtelWrite)RequiredS2SGrantScopes(AppRoleAssignment.ReadWrite.All) fromRequiredPermissionGrantScopesto prevent the admin-only scope from being requested on non-admin paths (a365 deploy,setup permissions)Maven.ReadWrite.Allscope withAgent365.Observability.OtelWriteas both delegated and application permissionPerformS2SGrantsAsyncshared helper inBatchPermissionsOrchestratorto eliminate duplicated S2S grant logic across admin and non-admin pathsTest plan
GrantAppRoleAssignmentAsyncscenarios (SP not found, role not found, already assigned, POST succeeds, POST fails, empty role list) — all passObservabilityApiOtelWriteScope— all passAgent365.Observability.OtelWriteaccepted by AAD (no AADSTS650053)Admin testing
Agent ID developer testing