] Issue provisioning a Copilot agent in Teams

[CarlosGuadamuz]

Is your feature request related to a problem?

When using the A365 CLI–generated agent blueprint, the App Registration created by the CLI appears to be managed/locked in a way that prevents:
Adding or changing Owners
Modifying permissions
Creating client secrets
Adding federated credentials
Successfully acquiring access tokens (401 errors observed)
Because these actions are required to complete authentication and onboarding, the customer cannot proceed with a fully seamless, end-to-end setup using the CLI today. This looks like a product limitation, not a misconfiguration.

Priority

High

Describe the solution you'd like

Is there a supported way today to add owners and permissions, and to configure secrets or federated credentials, on App Registrations created by the A365 CLI?
If not, can this be confirmed as a known gap that requires CLI adjustments?
The customer is proceeding with an alternate non-CLI path to unblock progress, but they’re looking for clarity on whether full identity control for CLI-created agents is supported now or requires a product fix.

Describe alternatives you've considered

The customer is proceeding with an alternate non-CLI path to unblock progress, but they’re looking for clarity on whether full identity control for CLI-created agents is supported now or requires a product fix.

Available workarounds

Non-CLI path to unblock progress.

Additional context

N/A

Code of Conduct

• I agree to follow the Microsoft Open Source Code of Conduct.

[github-actions]

[AUTO-TRIAGE] Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'bug' because the issue describes a limitation in the product that prevents expected functionality (e.g., modifying permissions, adding owners, and acquiring access tokens) and is identified as a product limitation rather than a misconfiguration.
Priority: Elevated to P1 due to security concern: The issue highlights potential security concerns related to authentication and authorization, specifically the inability to modify permissions, add owners, or configure secrets for App Registrations created by the CLI, which could impact secure identity management and access control.
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. The issue highlights potential security concerns related to authentication and authorization, specifically the inability to modify permissions, add owners, or configure secrets for App Registrations created by the CLI, which could impact secure identity management and access control.
Labels: Applied labels bug, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

[github-actions]

[AUTO-TRIAGE] Results

Classification: bug
Priority: P1
Confidence: 95.0%

Recommended Assignee: @sellakumaran

Analysis:
type rationale: Classified as 'bug' because the issue describes a limitation in the product that prevents expected functionality (e.g., modifying permissions, adding owners, and acquiring access tokens) and is identified as a product limitation rather than a misconfiguration.

priority rationale: Elevated to P1 due to security concern: The issue highlights potential security concerns related to authentication and authorization, specifically the inability to modify permissions, add owners, or configure secrets for App Registrations created by the CLI, which could impact secure identity management and access control.

copilot rationale: Security issues require human review and should not be auto-fixed

assignment rationale: Security issue assigned to security lead. The issue highlights potential security concerns related to authentication and authorization, specifically the inability to modify permissions, add owners, or configure secrets for App Registrations created by the CLI, which could impact secure identity management and access control.

labels rationale: Applied labels bug, P1, security based on issue type and priority

[SUGGESTION] Suggested Approach

1. Investigate the CLI logic responsible for App Registration creation in the src/Commands directory. Specifically, check for any restrictions or default configurations applied to the created App Registrations that might lock ownership, permissions, or credential management. Focus on files related to Azure AD integration.
2. Review the Azure AD API calls in the CLI implementation. Ensure that the API calls used for provisioning App Registrations allow for full identity control (e.g., adding owners, modifying permissions, etc.). If necessary, update the CLI to include additional API calls to enable these actions.
3. Add integration tests in src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Integration to verify that App Registrations created by the CLI can successfully perform the required actions (e.g., adding owners, modifying permissions, creating secrets). Simulate scenarios where the customer encounters 401 errors and debug the root cause.
4. Update the documentation in the docs directory to clarify any limitations or required manual steps for managing App Registrations created by the CLI. Include a troubleshooting section for common issues like 401 errors and provide workarounds if full identity control is not yet supported.
5. Check the dependencies in autoTriage/requirements.txt to ensure the Azure DevOps and Azure Functions libraries are up-to-date and compatible with the latest Azure AD API features. If necessary, upgrade azure-devops and test for compatibility with the CLI's provisioning logic.

---

Generated by TeamAssistant Auto-Triage powered by GitHub Models

[github-actions]

SLA Escalation Alert

This P1 issue has exceeded its SLA threshold.

Metric	Value
Priority	P1
SLA Threshold	48 hours
Time Since Update	63.0 hours
Current Assignees	@sellakumaran

Action: This issue is already assigned to a Tech Lead but remains unresolved.

Escalating to Engineering Manager @ajmfehr for visibility.

Tech Leads: @sellakumaran

---

Generated by AutoTriage SLA Escalation

[github-actions]

SLA Escalation Alert

This P1 issue has exceeded its SLA threshold.

Metric	Value
Priority	P1
SLA Threshold	48 hours
Time Since Update	72.0 hours
Current Assignees	@sellakumaran

Action: This issue is already assigned to a Tech Lead but remains unresolved.

Escalating to Engineering Manager @ajmfehr for visibility.

Tech Leads: @sellakumaran

---

Generated by AutoTriage SLA Escalation

[CarlosGuadamuz]

@sellakumaran

Do you need anything else to investigate this issue or provide feedback?