feat: add web consent redirect URIs to BYO Entra apps by ragurubhaarath · Pull Request #450 · microsoft/Agent365-devTools

ragurubhaarath · 2026-06-06T17:09:36Z

Summary

Adds environment-aware consent redirect URIs as web platform redirect URIs on the -PublicClients Entra app created during develop-mcp publish and develop-mcp register-external-mcp-server flows
Test/PreProd/PPE: https://sdf.admin.cloud.microsoft/?ref=tools/consent and https://ignite.admin.cloud.microsoft/?ref=tools/consent
Prod (default): https://admin.cloud.microsoft/?ref=tools/consent
Environment resolved from explicit parameter, A365_ENVIRONMENT env var, or defaults to prod

Test plan

Unit tests pass (14 tests in EntraAppProvisionerTests)
Tested live register-external-mcp-server against PreProd — confirmed publicClient URIs (4) and web URIs (2) are set separately via two PATCH calls
Verify web redirect URIs appear under "Web" platform in Entra portal for the created app

🤖 Generated with Claude Code

Add environment-aware consent redirect URIs (web platform) to the PublicClients app created during publish and register flows. Test/PreProd gets sdf.admin and ignite.admin URIs; Prod gets admin.cloud.microsoft. Environment is resolved from the explicit parameter, A365_ENVIRONMENT env var, or defaults to prod. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-06-06T17:10:09Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

This PR extends the Entra Public Clients app provisioning logic to also set environment-specific consent redirect URIs on the Web platform, in addition to the existing publicClient canonical redirect URIs, and updates unit tests accordingly.

Changes:

Add env-to-consent-redirect-URI mapping and patch Web platform redirect URIs during Public Clients app creation.
Expand unit tests to validate both publicClient and web redirect URI updates across prod vs test/preprod/ppe.
Adjust publish flow call site to account for the new optional environment parameter insertion (via named ct:).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs	Adds environment-aware consent redirect URI selection and applies it via a second Graph PATCH to the app’s web redirect URIs.
src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/EntraAppProvisionerTests.cs	Updates tests to assert separate PATCH calls for publicClient vs web redirect URIs across environments and failure modes.
src/Microsoft.Agents.A365.DevTools.Cli/Commands/PublishCommandExecutor.cs	Updates the provisioning call site to use named `ct:` after inserting the new optional method parameter.

…Clients Extract SetWebConsentRedirectUrisAsync helper and call it from both CreateProxyAppAsync (A365Proxy, RemoteProxy) and CreatePublicClientsAppAsync. All apps created in the addmcpserver flow now get the environment-aware consent redirect URIs on the web platform. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…irect URI overwrite The register flow's UpdateA365RedirectUrisAsync and UpdateRemoteProxyRedirectUrisAsync overwrite web.redirectUris with the platform-returned redirect URI, erasing consent URIs set earlier by the provisioner. Move consent URI injection to these final PATCH calls so the consent URIs and platform redirect URIs coexist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

…thout platform redirect URI When the platform does not return a redirect URI (e.g. NoAuth flow for A365Proxy, or missing remoteMCPServerProxyRedirectUri for RemoteProxy), the consent redirect URIs were skipped entirely. Add a fallback that sets consent-only web redirect URIs on all proxy apps regardless. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…rage - GetConsentRedirectUris returns defensive copies to prevent mutation of shared static arrays - SetWebConsentRedirectUrisAsync now uses RetryHelper for transient Graph failures, consistent with publicClient redirect URI handling - Add because: clauses to web consent URI test assertions documenting the admin consent portal contract - Add test for web redirect URI update throw path Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

…aking internal URLs Replace hardcoded test/preprod consent redirect URIs with A365_CONSENT_REDIRECT_URIS_{ENV} env var (comma-separated). Prod URI remains hardcoded as it is public. When no env var is set, all environments fall back to the prod URI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Trim leading/trailing whitespace from the environment string before building the env var key, preventing mismatches when A365_ENVIRONMENT contains spaces. Add test pinning the trim behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

…ecution - Add Distinct(StringComparer.Ordinal) when appending consent URIs to prevent Graph rejecting duplicate entries - Add CollectionDefinition with DisableParallelization on EntraAppProvisionerTests since env-var tests mutate process state Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…entRedirectUris Move A365_ENVIRONMENT env var fallback into GetConsentRedirectUris so callers don't need to resolve it themselves. Eliminates 4 duplicate Environment.GetEnvironmentVariable calls across EntraAppProvisioner and RegisterCommandExecutor. Non-prod environments without A365_CONSENT_REDIRECT_URIS_{ENV} fall back to the prod consent URI by design -- the env var override is required for non-prod. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Empty or whitespace-only environment parameter now falls through to A365_ENVIRONMENT (also trimmed) instead of producing an empty env var key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…#455) This reverts commit 091d51d. Co-authored-by: Bhaarath Raguru <bhraguru@microsoft.com>

ragurubhaarath requested a review from a team as a code owner June 6, 2026 17:09

Copilot AI review requested due to automatic review settings June 6, 2026 17:09

ragurubhaarath requested a review from a team as a code owner June 6, 2026 17:09

Copilot started reviewing on behalf of ragurubhaarath June 6, 2026 17:09 View session

github-actions Bot added the feature label Jun 6, 2026

Copilot AI reviewed Jun 6, 2026

View reviewed changes

bhaarathms and others added 2 commits June 6, 2026 10:18

Copilot AI review requested due to automatic review settings June 6, 2026 18:12

Copilot started reviewing on behalf of ragurubhaarath June 6, 2026 18:12 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

ragurubhaarath changed the title ~~feat: add web consent redirect URIs to PublicClients Entra apps~~ feat: add web consent redirect URIs to BYO Entra apps Jun 6, 2026

pronak657 previously approved these changes Jun 6, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 6, 2026 18:32

ragurubhaarath dismissed pronak657’s stale review via 637004b June 6, 2026 18:32

Copilot started reviewing on behalf of ragurubhaarath June 6, 2026 18:32 View session

Copilot AI reviewed Jun 6, 2026

View reviewed changes

bhaarathms and others added 2 commits June 8, 2026 08:24

Copilot AI review requested due to automatic review settings June 8, 2026 18:52

Copilot started reviewing on behalf of ragurubhaarath June 8, 2026 18:52 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

sellakumaran reviewed Jun 8, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs Outdated

sellakumaran reviewed Jun 8, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Commands/RegisterCommandExecutor.cs Outdated

Copilot AI review requested due to automatic review settings June 8, 2026 23:42

Copilot started reviewing on behalf of ragurubhaarath June 8, 2026 23:43 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs Outdated

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Commands/RegisterCommandExecutor.cs

fix: handle whitespace-only environment and trim A365_ENVIRONMENT

813bc2c

Empty or whitespace-only environment parameter now falls through to A365_ENVIRONMENT (also trimmed) instead of producing an empty env var key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sellakumaran approved these changes Jun 8, 2026

View reviewed changes

ragurubhaarath enabled auto-merge (squash) June 8, 2026 23:55

ajmfehr approved these changes Jun 9, 2026

View reviewed changes

ragurubhaarath merged commit 091d51d into main Jun 9, 2026
9 checks passed

ragurubhaarath deleted the u/bhraguru/public-clients-redirect-uris branch June 9, 2026 00:00

ragurubhaarath mentioned this pull request Jun 11, 2026

Revert: add web consent redirect URIs to BYO Entra apps #455

Merged

2 tasks

gwharris7 pushed a commit that referenced this pull request Jun 12, 2026

Revert "feat: add web consent redirect URIs to BYO Entra apps (#450)" (…

a398cfc

…#455) This reverts commit 091d51d. Co-authored-by: Bhaarath Raguru <bhraguru@microsoft.com>

Uh oh!

Conversation

ragurubhaarath commented Jun 6, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions Bot commented Jun 6, 2026 •

edited

Loading