Reduce custom app permissions and improve setup reliability

[sellakumaran]

Removes DelegatedPermissionGrant.ReadWrite.All and AgentIdentity.Create.All from the required CLI app permission set. Agent identity creation now uses Blueprint app-only credentials (AgentIdentity.CreateAsManager auto-granted to Blueprint apps). Principal-scoped oauth2 grants use AgentIdentityBlueprint.UpdateAuthProperties.All. EnsureServicePrincipalForAppIdAsync eliminated for agent identity SPs (id == appId for ServiceIdentity type), removing the Application.ReadWrite.All dependency.

Adds exponential back-off retry loops for AADSTS700016 and Authorization_IdentityNotFound propagation errors on fresh blueprint setups. All propagation-lag retry logs downgraded to Debug (not user-actionable).

Additional fixes:

• --authmode obo with --aiteammate warns instead of hard-erroring
• Messaging endpoint summary shows not-configured vs failed correctly
• Explicit null guard on AgentBlueprintClientSecret before UnprotectSecret
• Stale error message referencing removed permissions corrected
• Retry loop convention aligned (maxAttempts / < throughout)
• ConfigService omits null values from ExtractDynamicProperties to prevent null-overwrite cycle on re-run (issue 408 fix)

Validated end-to-end across base, --aiteammate, --m365, and --authmode both paths as Agent ID Developer role with no Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, AgentIdentity.ReadWrite.All, or AgentIdentity.Create.All on the custom app.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Updates a365 setup flows to reduce required permissions on the custom CLI app and improve reliability on fresh blueprint setups (replication-lag retries, clearer messaging), while aligning generated config behavior to avoid null-overwrite cycles.

Changes:

• Switch agent identity creation to use Blueprint app-only credentials and remove DelegatedPermissionGrant.ReadWrite.All from required permission lists.
• Add exponential backoff retries for transient Entra propagation errors and downgrade propagation-lag logs to Debug.
• Improve setup validation/UX: --authmode obo --aiteammate warns (continues), messaging endpoint summary distinguishes “not configured”, and generated config omits null dynamic properties.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/Agent365ConfigServiceTests.cs	Adds regression tests ensuring null dynamic properties are omitted and non-null secrets persist.
src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Commands/SetupCommandTests.cs	Updates tests for --authmode + --aiteammate behavior (warning vs error) and validates incompatible modes still fail.
src/Microsoft.Agents.A365.DevTools.Cli/Services/GraphApiService.cs	Adds retry/backoff for blueprint token acquisition and agent identity creation; adjusts propagation-lag logging levels.
src/Microsoft.Agents.A365.DevTools.Cli/Services/ConfigService.cs	Filters out null values when extracting dynamic properties to avoid null-overwrite on reruns.
src/Microsoft.Agents.A365.DevTools.Cli/Constants/AuthenticationConstants.cs	Removes DelegatedPermissionGrant.ReadWrite.All from required permissions/scopes.
src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/SetupHelpers.cs	Improves summary output/action-required messaging for “messaging endpoint not configured”.
src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/NonDwBlueprintSetupOrchestrator.cs	Uses blueprint client secret for agent identity creation; removes agent identity SP “ensure” step.
src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/AllSubcommand.cs	Changes --authmode obo --aiteammate from hard error to warning; keeps other modes incompatible.
CHANGELOG.md	Documents permission reductions, retry behavior, and setup UX fixes.
.gitignore	Ignores docs/min-permissions/.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 19 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/Microsoft.Agents.A365.DevTools.Cli/Services/GraphApiService.cs:1526

• GetBlueprintAccessTokenAsync increased maxRetries to 12 with exponential backoff capped at 60s. With baseDelaySeconds=5 this can sleep for ~8+ minutes total (5+10+20+40+60*7), which is a large behavioral/operational change and doesn’t match the PR description’s “~60s total”. Consider reducing attempts (or lowering baseDelaySeconds) and rename maxRetries to maxAttempts for clarity since the loop condition is attempt < maxRetries (total attempts).

            const int maxRetries = 12;
            const int baseDelaySeconds = 5;

            for (int attempt = 0; attempt < maxRetries; attempt++)
            {

[Copilot]

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 27 changed files in this pull request and generated 2 comments.