Fix RoleAssignment ObjectType fallback for insufficient MSGraph permissions #28584

Copilot · 2025-09-18T06:42:01Z

Fix RoleAssignment cmdlets to properly handle insufficient MSGraph permissions by falling back to cached principal type

Problem Fixed:
The ToPSRoleAssignment() method was incorrectly handling insufficient MSGraph permissions. When Active Directory lookup failed due to authorization denied or not found errors, it immediately set ObjectType = "Unknown" instead of following the documented priority order.

Root Cause:

Line 101 in AuthorizationClientExtensions.cs created PSADObject with Type = UnknownType when AD lookup failed
Line 202 in batch processing had the same issue
This skipped the intended fallback to cached assignment.PrincipalType

Solution:

Modified exception handling to use assignment.PrincipalType ?? UnknownType instead of immediately using UnknownType
Applied same fix to both single assignment and batch processing methods
Updated ChangeLog.md for Resources module
Addressed PR feedback: reverted main ChangeLog.md and test file changes, updated code comment

Priority Order Now Correctly Implemented:

Live Active Directory object type (when lookup succeeds)
Cached principal type from assignment (fallback when lookup fails)
"Unknown" type (only when both above are unavailable)

Files Changed:

src/Resources/Resources/Models.Authorization/AuthorizationClientExtensions.cs - Core fix
src/Resources/Resources/ChangeLog.md - Added changelog entry

Fixes #28583.

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

azure-client-tools-bot-prd · 2025-09-18T06:42:04Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

…ssions Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

VeryEarly · 2025-09-18T07:05:01Z

ChangeLog.md

 #### Az.Relay 2.1.2
 * Update the outputs of breaking change announcements.

+#### Az.Resources 8.1.1


why you changed this file copilot?

I updated the main ChangeLog.md by mistake. The change has been reverted in commit 56c9d2b.

isra-fel · 2025-09-18T07:18:38Z

src/Resources/Resources.Test/RoleAssignment/RoleAssignmentUnitTests.cs

Please revert the added test in this file as it isn't feasible to mock

Reverted the test file changes in commit 56c9d2b as it wasn't feasible to mock properly.

isra-fel · 2025-09-18T07:18:56Z

ChangeLog.md

Please revert the changes in this file as it is purely generated.

Reverted the main ChangeLog.md changes in commit 56c9d2b.

isra-fel · 2025-09-18T07:19:52Z

src/Resources/Resources/Models.Authorization/AuthorizationClientExtensions.cs

                {
-                    adObject = new PSADObject() { Id = assignment.PrincipalId, Type = UnknownType};
+                    // When AD lookup fails due to insufficient permissions or not found,
+                    // fall back to cached principal type instead of immediately using "Unknown"


Suggested change

// fall back to cached principal type instead of immediately using "Unknown"

// fall back to cached principal type from response,

// then finally fall back to "Unknown"

Updated the comment as suggested in commit 56c9d2b.

isra-fel · 2025-09-18T07:20:25Z

@copilot please address the comments

…e comment Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot · 2025-09-18T07:25:08Z

@copilot please address the comments

Addressed all feedback comments in commit 56c9d2b:

Reverted main ChangeLog.md (generated file)
Reverted test file changes (not feasible to mock)
Updated comment as suggested

VeryEarly · 2025-09-18T07:35:37Z

src/Resources/Resources.Test/RoleAssignment/RoleAssignmentUnitTests.cs


            AuthorizationClient.ValidateScope(null, true);
        }
+


this test creates arbitrary value for assignment object and performs assert for these arbitrary values, does it make sense copilot?

VeryEarly · 2025-09-18T07:36:20Z

src/Resources/Resources/ChangeLog.md

 ## Upcoming Release
+* Fixed issue where RoleAssignment cmdlets did not properly handle insufficient MSGraph permissions
+    - When Active Directory lookup fails due to insufficient permissions, the cmdlets now fall back to cached principal type instead of immediately using "Unknown" type
+    - Fixed issue [#28583]


why you need 2 bullet points when you can do a one liner, copilot?

Copilot

Pull Request Overview

This PR fixes RoleAssignment cmdlets to properly handle insufficient MSGraph permissions by implementing correct fallback logic to cached principal types instead of immediately defaulting to "Unknown".

Key changes:

Corrected the priority order for object type determination in role assignment processing
Applied the fix to both single assignment and batch processing methods
Added proper changelog documentation

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Resources/Resources/Models.Authorization/AuthorizationClientExtensions.cs	Fixed exception handling to use cached principal type fallback instead of immediately setting "Unknown" type
src/Resources/Resources/ChangeLog.md	Added changelog entry documenting the MSGraph permissions fix

isra-fel · 2025-09-19T00:23:12Z

/azp run azure-powershell - security-tools

azure-pipelines · 2025-09-19T00:23:22Z

Azure Pipelines successfully started running 1 pipeline(s).

Initial plan

e64ca77

Copilot AI assigned Copilot and isra-fel Sep 18, 2025

Copilot started work on behalf of isra-fel September 18, 2025 06:42 View session

Fix RoleAssignment ObjectType fallback for insufficient MSGraph permi…

f64066a

…ssions Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] [Bug]: RoleAssignment cmdlets didn't handle it properly when insufficient MSGraph permission~~ Fix RoleAssignment ObjectType fallback for insufficient MSGraph permissions Sep 18, 2025

Copilot finished work on behalf of isra-fel September 18, 2025 06:57

Copilot AI requested a review from isra-fel September 18, 2025 06:57

VeryEarly reviewed Sep 18, 2025

View reviewed changes

isra-fel requested changes Sep 18, 2025

View reviewed changes

Copilot started work on behalf of isra-fel September 18, 2025 07:20 View session

Address PR feedback: revert main ChangeLog.md and test changes, updat…

56c9d2b

…e comment Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot AI requested a review from isra-fel September 18, 2025 07:26

Copilot stopped work on behalf of isra-fel due to an error September 18, 2025 07:26
Copilot has encountered an error. See logs for additional details.

VeryEarly reviewed Sep 18, 2025

View reviewed changes

Simplify changelog entry for RoleAssignment cmdlets

e378a90

isra-fel marked this pull request as ready for review September 19, 2025 00:22

Copilot AI review requested due to automatic review settings September 19, 2025 00:22

Copilot AI reviewed Sep 19, 2025

View reviewed changes

isra-fel removed their assignment Sep 19, 2025

isra-fel approved these changes Sep 19, 2025

View reviewed changes

VeryEarly approved these changes Sep 19, 2025

View reviewed changes

VeryEarly merged commit 4b18d05 into main Sep 19, 2025
12 checks passed

VeryEarly deleted the copilot/fix-28583 branch September 19, 2025 03:05

isra-fel added this to the Az 14.5.0 (10/14/2025) milestone Sep 19, 2025

github-actions bot mentioned this pull request Oct 1, 2025

Monthly issue metrics report #28630

Closed

	// fall back to cached principal type instead of immediately using "Unknown"
	// fall back to cached principal type from response,
	// then finally fall back to "Unknown"

Fix RoleAssignment ObjectType fallback for insufficient MSGraph permissions #28584

Fix RoleAssignment ObjectType fallback for insufficient MSGraph permissions #28584

Uh oh!

Conversation

Copilot AI commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-client-tools-bot-prd bot commented Sep 18, 2025

Uh oh!

VeryEarly Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

isra-fel Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

isra-fel Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

isra-fel Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

isra-fel commented Sep 18, 2025

Uh oh!

Copilot AI commented Sep 18, 2025

Uh oh!

VeryEarly Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

VeryEarly Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

isra-fel commented Sep 19, 2025

Uh oh!

azure-pipelines bot commented Sep 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Sep 18, 2025 •

edited

Loading