Fix: Move OAuth2 grant logging from Information to Debug level

[Copilot]

During a365 setup operations, OAuth2 grant details (client IDs, resource IDs, scopes) were being logged to console at Information level:

OAuth2 grant: client 2a479473-7188-45d0-973c-a1a8d92bac91 to resource 51ee9df3-62eb-46ee-b00e-10c50e28a2b2 scopes [Mail.ReadWrite Mail.Send Chat.ReadWrite User.Read.All Sites.Read.All]

This is excessive technical detail for normal operation.

Changes

• SetupHelpers.cs (line 263): LogInformation → LogDebug for OAuth2 grant messages
• DeployCommand.cs (line 400): LogInformation → LogDebug for OAuth2 granted messages

Grant details remain available when debug logging is enabled (e.g., --verbose flag).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• graph.microsoft.com
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/Agent365-devTools/Agent365-devTools/src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/bin/Release/net8.0/Microsoft.Agents.A365.DevTools.Cli.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/Agent365-devTools/Agent365-devTools/src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/bin/Release/net8.0/Microsoft.Agents.A365.DevTools.Cli.Tests.deps.json /home/REDACTED/work/Agent365-devTools/Agent365-devTools/src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/bin/Release/net8.0/testhost.dll --port 42393 --endpoint 127.0.0.1:042393 --role client --parentprocessid 4006 --telemetryoptedin false (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli rest --method GET --url REDACTED$filter=appId eq 'a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6'&$select=id --headers Authorization=Bearer fake-token-123 (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli rest --method PATCH --url REDACTED --headers Content-Type=application/json Authorization=Bearer fake-token-123 --body {"publicClient":{"redirectUris":["http://localhost","http://localhost:8400/","ms-appx-web://microsoft.aad.brokerplugin/a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6"]}} (dns block)
• login.microsoftonline.com
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli login --tenant 12345678-1234-1234-1234-123456789012 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>A365 CLI setup comments emit access token into console</issue_title>
<issue_description>Version: v1.1.40-preview+4c5eb33773

Describe the bug
During Setup operation. the A365 CLI is writing the access token it is creating to the console.

While i respect that is useful in debugging, it is appearing during normal operation w/out log level's being set beyond default.

To Reproduce
Steps to reproduce the behavior:
setup an intial config using a365 config init
start deployment - a365 setup blueprint

example output:
....
Opening browser for Graph API admin consent...
Consent granted (Graph API Scopes).
Graph API admin consent granted successfully!
Configuring inheritable permissions for Microsoft Graph...
Acquiring Microsoft Graph delegated access token via PowerShell (Device Code: False)

Microsoft Graph access token acquired successfully

OAuth2 grant: client 2a479473-7188-45d0-973c-a1a8d92bac91 to resource 51ee9df3-62eb-46ee-b00e-10c50e28a2b2 scopes [Mail.ReadWrite Mail.Send Chat.ReadWrite User.Read.All Sites.Read.All]</issue_description>

<agent_instructions>Can you please analyze the codebase and find out places where we are emitting tokens in the log/console and fix those?</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes A365 CLI setup comments emit access token into console #160

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR addresses excessive technical detail logging during a365 setup operations by moving OAuth2 grant configuration details from Information to Debug logging level. The reported issue showed OAuth2 client IDs, resource IDs, and scopes being displayed in normal console output, which provides unnecessary technical detail for typical users.

Changes:

• Modified two logging statements to use LogDebug instead of LogInformation for OAuth2 grant details
• Grant information remains available when debug/verbose logging is enabled

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/SetupHelpers.cs	Changed OAuth2 grant logging from Information to Debug level (line 263)
src/Microsoft.Agents.A365.DevTools.Cli/Commands/DeployCommand.cs	Changed OAuth2 granted logging from Information to Debug level (line 400)