Add cloud-aware authority/graph endpoint resolution by rbrighenti · Pull Request #478 · microsoft/Agent365-devTools

Rick Brighenti (rbrighenti) · 2026-07-24T16:00:34Z

Summary

Makes Graph, OAuth authority, and Agent 365 Tools endpoints cloud-agnostic so the CLI works in sovereign/government clouds in addition to commercial.

Cloud-specific Graph, authority, and Agent 365 Tools overrides now apply across setup, consent, authentication, query, and create-instance flows.
Arbitrary cloud names resolve via normalized environment-scoped variables (e.g. A365_GRAPH_BASE_URL_GCC_HIGH).
Configured endpoints are normalized and validated to HTTPS origins (no path/query/fragment/user-info).
Commercial cloud (https://login.microsoftonline.com, standard Graph base URL) remains the default fallback.

Testing

Added unit tests for ConfigConstants endpoint resolution/normalization and updated affected service/command tests.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Normalize cloud keys for environment overrides and route consent/token/Graph URL generation through cloud-aware helpers so arbitrary cloud names can be configured without code changes Make client-credential token authority cloud-aware

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2026-07-24T16:12:26Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 3 comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 2 comments.

- InteractiveGraphAuthService: append /v1.0 to the cloud-specific Graph BaseUrl so overriding RequestAdapter.BaseUrl doesn't drop the API version segment and 404 every request; add regression test. - BootstrapConfigResolver: pass the caller's CancellationToken into the 'az cloud show' invocation so bootstrap can be cancelled. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 44 out of 44 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/Microsoft.Agents.A365.DevTools.Cli/Services/Internal/MicrosoftGraphTokenProvider.cs:337

PowerShell fallback builds Connect-MgGraph -Scopes from validatedScopes, which are now normalized to fully-qualified URIs (e.g. https://graph.microsoft.com/User.Read). In this repo, PowerShell guidance consistently uses bare scope names (e.g. User.Read, Application.Read.All), and Connect-MgGraph commonly expects those. This risks breaking the PowerShell fallback path for commercial clouds when MSAL is unavailable/fails.

Preserve first-party CLI app behavior while routing bootstrap, validation, cleanup, authentication, and Graph calls through the configured sovereign cloud endpoints. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use the ambient administrator identity when validating and repairing tenant-owned fallback client apps, while preserving resolved-app token checks for issued claims. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 52 out of 52 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/Microsoft.Agents.A365.DevTools.Cli/Services/Internal/MicrosoftGraphTokenProvider.cs:177

PowerShell fallback is passed validatedScopes, but ValidateAndPrepareScopes now normalizes bare scopes into fully-qualified URIs (e.g. https://graph.microsoft.com/User.Read). Connect-MgGraph -Scopes typically expects plain scope names, so the fallback can fail even in commercial cloud and remove the intended MSAL→PowerShell recovery path. Strip the commercial Graph base URL prefix when building the PowerShell script (fallback is already gated to commercial endpoints).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The create-instance runner wires user-configured Graph/authority endpoints without guarding ArgumentException, so malformed endpoint values can crash the flow instead of failing cleanly with a targeted error.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 60/60 changed files
Comments generated: 1
Review effort level: Lite

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Select the cloud-specific Observability resource and fail safely when blueprint discovery or Graph authorization is inconclusive. Refresh Graph tokens after client app permission changes and preserve the configured blueprint when duplicate display names exist. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rick Brighenti (rbrighenti) · 2026-09-02T16:45:01Z

The latest GCC validation fixes are pushed through 6a4df0f.

Completed:

Refreshed the branch against current main and preserved commercial-cloud behavior.
Made the sovereign discover endpoint the canonical host for related Agent 365 routes, while retaining explicit endpoint overrides.
Added cloud-specific Observability resource selection for GCC Moderate and GCC High.
Fixed setup paths that treated failed Graph permission reads as successful empty results.
Made blueprint discovery fail closed so an authorization/query failure cannot create another blueprint or invalidate generated state.
When duplicate display names exist, setup now preserves the blueprint identified by generated state instead of choosing an arbitrary result.
Corrected Graph scope selection for application, service-principal, and inheritable-permission reads, and refreshes token caches after client-app permission changes.
Preserved customized manifest names and existing valid blueprint secrets on repeated setup.
Added migration and regression coverage for the above behavior.

Validation:

Full isolated CLI suite: 2,106 passed, 12 skipped, 0 failed.
GCC Moderate discovery succeeded using only the environment and discover-endpoint override.
GCC Observability service-principal and application-role resolution were verified.
GCC Observability S2S role assignment succeeded during live validation.

Remaining before merge:

Complete the targeted GCC Moderate rerun for existing-blueprint discovery and Observability inheritable permissions using the latest commit.
Verify stale commercial Observability permission/state is removed from the selected blueprint.
Agent registration remains blocked by the current GCC service behavior and should be retested when that capability is available.
MCP runtime validation is deferred; the remaining failure observed was in a downstream approval/authentication path rather than CLI endpoint routing.
Update the guided Observability documentation that still shows the commercial audience as separate follow-up work.

Copilot

🟡 Changes recommended

The review found functional issues in updated command logic (notably query-entra instance-scopes using appId instead of service principal objectId for grants filtering) that would produce incorrect results and should be fixed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 75/75 changed files
Comments generated: 2
Review effort level: Lite

Use service-principal IDs for direct grant queries and distinguish inherited consent from empty or unreadable results. Handle invalid endpoint and manifest values safely, and fail registration-only commands when registration fails. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

There are confirmed correctness issues around token caching across authority hosts and robustness of blueprint lookup JSON parsing that should be fixed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 77/77 changed files
Comments generated: 2
Review effort level: Lite

+                foreach (var candidate in valueElement.EnumerateArray())
+                {
+                    if (string.Equals(
+                            candidate.GetProperty("id").GetString(),
+                            preferredObjectId,
+                            StringComparison.OrdinalIgnoreCase))
+                    {
+                        selectedMatch = candidate;
+                        break;
+                    }
+                }


+        var resolvedGraphBaseUrl = ConfigConstants.NormalizeGraphBaseUrl(graphBaseUrl);
+        var resolvedAuthorityHost = ConfigConstants.NormalizeAuthorityHost(authorityHost);
+        var validatedScopes = ValidateAndPrepareScopes(scopes, resolvedGraphBaseUrl);


Copilot AI lite review requested due to automatic review settings July 24, 2026 16:00

Rick Brighenti (rbrighenti) requested review from a team as code owners July 24, 2026 16:00

Copilot AI reviewed Jul 24, 2026

Rick Brighenti (rbrighenti) requested a review from Copilot July 24, 2026 16:07

Copilot AI reviewed Jul 24, 2026

Add cloud-aware authority/graph endpoint resolution

c0d736c

Normalize cloud keys for environment overrides and route consent/token/Graph URL generation through cloud-aware helpers so arbitrary cloud names can be configured without code changes Make client-credential token authority cloud-aware

Rick Brighenti (rbrighenti) force-pushed the feature/cloud-agnostic-endpoints branch from 84723d1 to c0d736c Compare July 24, 2026 16:09

Copilot AI review requested due to automatic review settings July 24, 2026 16:09

Copilot AI reviewed Jul 24, 2026

github-actions Bot added documentation Improvements or additions to documentation feature labels Jul 24, 2026

Rick Brighenti (rbrighenti) requested a review from Copilot July 27, 2026 09:35

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) July 27, 2026 09:36 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/MsalBrowserCredential.cs Outdated

Comment thread CHANGELOG.md Outdated

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/Internal/MicrosoftGraphTokenProvider.cs

Address Copilot review: trim scopes, condense comment, tidy CHANGELOG

61a566b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 27, 2026 09:53

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) July 27, 2026 09:53 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Copilot started work on behalf of Rick Brighenti (rbrighenti) July 27, 2026 10:03 View session

test: add because: clauses to non-obvious test assertions

526eaaa

Copilot AI review requested due to automatic review settings July 27, 2026 10:05

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) July 27, 2026 10:06 View session

Copilot finished work on behalf of Rick Brighenti (rbrighenti) July 27, 2026 10:06

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/InteractiveGraphAuthService.cs Outdated

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/BootstrapConfigResolver.cs Outdated

Copilot AI review requested due to automatic review settings July 27, 2026 11:39

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) July 27, 2026 11:40 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

jaganp (jaganp-microsoft) previously approved these changes Jul 28, 2026

View reviewed changes

Rick Brighenti (rbrighenti) and others added 2 commits September 1, 2026 13:16

Merge main into cloud-aware endpoints

7dd816d

Preserve first-party CLI app behavior while routing bootstrap, validation, cleanup, authentication, and Graph calls through the configured sovereign cloud endpoints. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix custom CLI app validation authentication

112a929

Use the ambient administrator identity when validating and repairing tenant-owned fallback client apps, while preserving resolved-app token checks for issued claims. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 1, 2026 16:55

Rick Brighenti (rbrighenti) dismissed jaganp (jaganp-microsoft)’s stale review via 112a929 September 1, 2026 16:55

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) September 1, 2026 16:55 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Fix GCC permission and setup validation

432c7d0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 2, 2026 12:05

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) September 2, 2026 12:06 View session

Rick Brighenti (rbrighenti) mentioned this pull request Sep 2, 2026

Run client app validation as the ambient operator identity #491

Closed

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Services/A365CreateInstanceRunner.cs

Rick Brighenti (rbrighenti) and others added 2 commits September 2, 2026 15:35

Simplify sovereign endpoint configuration

749c1db

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 2, 2026 16:42

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) September 2, 2026 16:43 View session

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Commands/QueryEntraCommand.cs

Comment thread src/Microsoft.Agents.A365.DevTools.Cli/Commands/PublishCommand.cs

Copilot AI review requested due to automatic review settings September 9, 2026 13:29

Copilot started reviewing on behalf of Rick Brighenti (rbrighenti) September 9, 2026 13:30 View session

Copilot AI reviewed Sep 9, 2026

View reviewed changes

Uh oh!

Conversation

Rick Brighenti (rbrighenti) commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 24, 2026

Dependency Review

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Rick Brighenti (rbrighenti) commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Rick Brighenti (rbrighenti) commented Jul 24, 2026 •

edited

Loading

Rick Brighenti (rbrighenti) commented Sep 2, 2026 •

edited

Loading