Add azurebackup policy update command to Azure Backup toolset

[shrja-ms]

Summary

Adds a new azurebackup policy update command that modifies an existing RSV backup policy's schedule time and daily retention settings. Supports IaasVM, SQL/SAP HANA (VmWorkload), and FileShare policy types. DPP vaults return a clear error since they do not support policy update.

Changes

New Tool: azurebackup policy update

RSV implementation:

• Fetches existing policy via GetAsync, mutates schedule/retention in-place on the existing properties object (preserving all other fields like PolicyId, WorkloadType, etc.)
• Handles IaasVM (IaasVmProtectionPolicy), VmWorkload SQL/HANA (VmWorkloadProtectionPolicy Full sub-policy), and FileShare (FileShareProtectionPolicy)
• Calls CreateOrUpdateAsync with the modified policy data
• Returns Succeeded with no-op message when no changes specified

DPP implementation:

• Returns InvalidOperationException with clear message that DPP does not support policy update

Files Added (3)

File	Purpose
PolicyUpdateCommand.cs	Sealed command with error handling for 403/404/DPP-not-supported
PolicyUpdateOptions.cs	Options class with Policy, ScheduleTime, DailyRetentionDays
PolicyUpdateCommandTests.cs	12 unit tests (success, errors, validation, deserialization, partial updates)

Files Modified (13)

File	Change
IAzureBackupService.cs	Added UpdatePolicyAsync to service contract
AzureBackupService.cs	Routes update to RSV; throws InvalidOperationException for DPP
IRsvBackupOperations.cs	Added RSV update interface method
RsvBackupOperations.cs	RSV implementation: fetch-modify-save pattern with UpdatePolicyScheduleAndRetention helper
AzureBackupSetup.cs	Registers PolicyUpdateCommand in DI + policy command group
AzureBackupJsonContext.cs	AOT serialization context for PolicyUpdateCommandResult
AzureBackupSetupTests.cs	Verifies update command in policy group
AzureBackupCommandTests.cs	6 live tests (IaasVM retention, IaasVM schedule, SQL retention, SQL schedule+retention, no-changes, DPP rejection)
assets.json	Updated recording tag
consolidated-tools.json	Added azurebackup_policy_update to update_azure_backup_settings
azmcp-commands.md	Command reference + metadata
e2eTestPrompts.md	2 e2e test prompts
changelog entry	Features Added

Test Results

• 343 unit tests: All pass (12 new policy update tests)
• 51 live tests (playback): All pass (6 new: IaasVM x2, SQL x2, no-changes, DPP rejection)
• Consolidated tool tests: 5/5 pass
• dotnet format: Clean
• ToolDescriptionEvaluator: azurebackup_policy_update ranks Update README.md #1 for both test prompts (0.664, 0.689)

Invoking Livetests

Copilot submitted PRs are not trustworthy by default. Users with write access to the repo need to validate the contents of this PR before leaving a comment with the text /azp run mcp - pullrequest - live. This will trigger the necessary livetest workflows to complete required validation.

[Copilot]

Pull request overview

Adds a new azurebackup policy update command to the Azure Backup toolset to update an existing RSV backup policy’s schedule time and/or daily retention days, with explicit rejection for DPP vaults.

Changes:

• Introduces PolicyUpdateCommand + PolicyUpdateOptions, wires command into DI/command groups, and adds source-gen JSON context support.
• Implements RSV update behavior in RsvBackupOperations via fetch–mutate–save (GetAsync + CreateOrUpdateAsync) and exposes it through service interfaces.
• Adds unit + live test coverage and updates server docs/tool mapping/changelog entries.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Policy/PolicyUpdateCommand.cs	New command implementation and error mapping for policy update.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Policy/PolicyUpdateOptions.cs	New options model for policy update inputs.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/RsvBackupOperations.cs	RSV implementation of policy update (fetch-modify-save + helper).
tools/Azure.Mcp.Tools.AzureBackup/src/Services/IRsvBackupOperations.cs	Adds RSV update method contract.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/IAzureBackupService.cs	Adds service-level update policy contract.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/AzureBackupService.cs	Routes update to RSV and rejects DPP updates.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/AzureBackupJsonContext.cs	Adds source-gen JSON support for update command result.
tools/Azure.Mcp.Tools.AzureBackup/src/AzureBackupSetup.cs	Registers the new command in DI and the policy command group.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.UnitTests/Policy/PolicyUpdateCommandTests.cs	New unit tests for command behavior and error handling.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.UnitTests/AzureBackupSetupTests.cs	Verifies policy update command registration.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.LiveTests/AzureBackupCommandTests.cs	Adds live tests for RSV updates and DPP rejection.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.LiveTests/assets.json	Updates recorded-test tag.
servers/Azure.Mcp.Server/src/Resources/consolidated-tools.json	Exposes azurebackup_policy_update in consolidated tool mapping.
servers/Azure.Mcp.Server/docs/e2eTestPrompts.md	Adds e2e prompts for the new command.
servers/Azure.Mcp.Server/docs/azmcp-commands.md	Adds command reference entry for azmcp azurebackup policy update.
servers/Azure.Mcp.Server/changelog-entries/1776767571721.yaml	Adds changelog entry for the new feature.

[shrja-ms]

Addressed all 3 Copilot review comments in the latest push:

Comment 1 (scheduleTime/dailyRetentionDays silently treated as null):
Fixed. Non-empty values that fail parsing now throw \ArgumentException\ with clear messages (e.g., \Invalid schedule time 'abc'. Provide a valid time in UTC HH:mm format). Retention days <= 0 also rejected. Added \GetStatusCode\ override so \ArgumentException\ returns 400 BadRequest. Added 2 new unit tests verifying this.

Comment 2 (all InvalidOperationException mapped to DPP message):
Fixed. Narrowed mapping to only match when \�x.Message\ contains \DPP. Other \InvalidOperationException\s now surface their original message. Added 1 new unit test verifying non-DPP exceptions surface correctly.

Comment 3 (missing default case in UpdatePolicyScheduleAndRetention):
Fixed. Added \default\ case that throws \InvalidOperationException\ for unsupported policy subtypes, preventing false-positive success responses.

Additional (cross-checked with PR #2441 feedback):

• In-place mutation pattern already correct (no new property instances that strip fields)
• Added policy update prompt example to README.md Azure Backup section
• Validated with \Process-PackageReadMe.ps1 -Command validate\

All 346 unit tests pass (15 policy update tests now). All 49 live tests pass in playback. Format clean.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[jongio]

Two items from my previous review are still open after the latest push. Replied on both threads with specifics.

1. GetStatusCode still has no InvalidOperationException mapping - DPP and unsupported-policy-type errors return 500 instead of 400. The unit test asserts the wrong status code.

2. scheduleApplied flag is set in the wrong place in the IaasVM and FileShare branches - the retention sync block sets it even when the actual schedule policy wasn't updated. VmWorkload branch is correct and can be used as reference.

[anannya03]

/azp run mcp - pullrequest - live

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[anannya03]

Hi @shrja-ms ,
There's a live test failure for Azure Backup at the Test Resource step. Could you also please take a look into it?

CC: @jongio

[jongio]

Addresses my previous feedback cleanly:

1. GetStatusCode now maps InvalidOperationException to BadRequest - both DPP-not-supported and unsupported-policy-type errors return 400 instead of 500.
2. Removed the misplaced scheduleApplied = true from the IaasVM and FileShare retention sync blocks. Schedule tracking is now scoped correctly.
3. Test assertions updated to match.
4. est-resources-post.ps1 key casing fix should resolve the live test failure.

One action item: live tests need to be re-triggered to verify the DeploymentOutputs key casing fix works in CI.

[shrja-ms]

Hi @anannya03 - the live test failure at the Test Resource step was caused by a case mismatch in test-resources-post.ps1: the script was reading DeploymentOutputs (PascalCase) but the pipeline sets deploymentOutputs (camelCase). Fixed in commit 9c34fd8. All review threads from both Copilot and @jongio are now resolved. Could someone please re-trigger live tests to verify the fix?

[jongio]

Addresses all my previous feedback. The four items I flagged are fixed and the threads are resolved:

• GetStatusCode maps InvalidOperationException to BadRequest (both DPP and unsupported-policy-type cases)
• scheduleApplied/retentionApplied tracking prevents false-positive success
• scheduleApplied no longer set inside the retention sync blocks for IaasVM and FileShare
• Default case throws for unsupported policy types

One blocker before merge: there are merge conflicts on this branch that need rebasing.

[jongio]

Clean implementation following the established AzureBackup command patterns. Error handling is solid - GetStatusCode maps both ArgumentException and InvalidOperationException to BadRequest, and GetErrorMessage has specific messages for DPP rejection vs generic IOEx.

The scheduleApplied/retentionApplied tracking correctly catches unsupported schedule/retention types at the end of UpdatePolicyScheduleAndRetention. Tests cover the key paths including DPP rejection, invalid inputs, schedule-only and retention-only updates.

One item to add before merge - see inline comment.

[jongio]

All prior feedback addressed. The rebase pulled in #2505 (telemetry tags for all AzureBackup commands), so PolicyUpdateCommand now includes the AddVaultTags call I flagged. The scheduleApplied/retentionApplied tracking, input validation, error handling, and test coverage all look solid. No new issues.

[jongio]

Reviewed the rebase changes (HEAD moved from accefe2 to 6bb3a0a). Two new commits since my last review:

• CommandMetadata attribute applied to PolicyUpdateCommand (per anannya03's request) - values look correct: Destructive=true, Idempotent=true, OpenWorld=false, ReadOnly=false.
• Live tests re-recorded after rebase, retention test updated to increase rather than decrease (handles immutable vault constraints).

All prior feedback remains addressed. No new issues found.

[jongio]

The merge of main brought in the AddCommand<T> API migration (#2538/#2539/#2540), but the policy group wasn't updated to match. The private RegisterCommand helper was deleted, so the three RegisterCommand<> calls on lines 78-80 won't compile - that's why all build checks are failing.

Also, the policy group description on line 76 still has an em-dash while all other descriptions were updated to hyphens.