Optimize Auth flow and switch from DCF to Interactive Authentication

[mengyimicro]

Summary

Switch from Device Code Flow (DCF) to Interactive Browser Authentication across the entire Agent365-devTools CLI to comply with production tenant security policies that discourage DCF usage.

This PR implements interactive browser authentication (WAM on Windows, browser on other platforms) while maintaining comprehensive token caching to ensure users only authenticate 1-2 times total for all CLI commands.

Changes

Authentication Method Changes (4 files)

1. AuthenticationService.cs

   • Changed default useInteractiveBrowser parameter from false to true (2 methods)
   • Now uses MsalBrowserCredential by default instead of DeviceCodeCredential
   • Added comprehensive class-level documentation explaining authentication strategy and token caching

2. MicrosoftGraphTokenProvider.cs

   • Changed default useDeviceCode parameter from true to false
   • Interactive browser authentication is now the default for PowerShell Graph operations
   • Added documentation about authentication method and caching strategy

3. AzureWebAppCreator.cs

   • Changed ExcludeInteractiveBrowserCredential from true to false
   • Allows DefaultAzureCredential to use interactive browser when Azure CLI is not authenticated
   • Updated comments to clarify credential chain order

4. InteractiveGraphAuthService.cs

   • Removed entire device code fallback logic (~68 lines)
   • Now exclusively uses browser authentication with no DCF fallback
   • Infrastructure errors throw immediately instead of falling back to DCF

Documentation & Logging Improvements (3 files)

5. AuthenticationService.cs - Added comprehensive documentation:

   • Authentication strategy (interactive browser, no DCF)
   • Token caching location: %LocalApplicationData%\Agent365\token-cache.json
   • Cache key format: {resourceUrl}:tenant:{tenantId}
   • Multi-command workflow (1-2 prompts total, 0 for subsequent commands)
   • Cache expiration (5-minute buffer) and automatic refresh

6. GraphApiService.cs - Enhanced EnsureGraphHeadersAsync:

   • Clear authentication strategy comments
   • Better debug logging for auth method selection (scopes vs Azure CLI)
   • Improved error messages with actionable guidance
   • Explicit handling for token provider vs Azure CLI fallback

7. MicrosoftGraphTokenProvider.cs - Added documentation:

   • Interactive browser as default (not device code)
   • In-memory and persistent caching explanation
   • Integration with overall CLI auth strategy

User Experience

Authentication Prompts

First-Time Run: 2 prompts

1. Azure CLI Authentication - For infrastructure/resource management
2. Microsoft Graph Authentication - For agent blueprints, permissions, service principals

Subsequent Runs: 0 prompts (tokens cached and reused)

Token Caching Strategy

• Azure CLI session: Managed by az CLI (~1 hour persistence)
• Graph tokens: Cached in %LocalApplicationData%\Agent365\token-cache.json
• Cache validation: 5-minute buffer before token expiry
• Cross-command reuse: All CLI commands share the same token cache

Example Workflow

# First time - 2 authentication prompts
a365 setup all                    # Prompts: Azure CLI + Graph

# All subsequent commands - 0 prompts (uses cached tokens)
a365 deploy app                   # No prompt
a365 develop list-available       # No prompt
a365 setup permissions            # No prompt
a365 cleanup blueprint            # No prompt

[Copilot]

Pull request overview

This pull request switches the Agent365-devTools CLI from Device Code Flow (DCF) to Interactive Browser Authentication to comply with production tenant security policies that discourage DCF usage. The change implements browser-based authentication using MsalBrowserCredential (WAM on Windows, browser on other platforms) while maintaining comprehensive token caching to minimize authentication prompts.

Changes:

• Modified default authentication method from Device Code Flow to Interactive Browser Authentication across all authentication services
• Removed device code fallback logic in favor of clear error messages when browser authentication fails
• Enhanced documentation explaining authentication strategy, token caching location, cache key format, and expected user experience (1-2 prompts for entire workflow)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
AuthenticationService.cs	Changed default useInteractiveBrowser parameter to true in two public methods; added comprehensive class-level documentation about authentication strategy and token caching
MicrosoftGraphTokenProvider.cs	Changed default useDeviceCode parameter to false; added documentation explaining interactive browser as default with token caching details
AzureWebAppCreator.cs	Enabled interactive browser credential in DefaultAzureCredential chain by setting ExcludeInteractiveBrowserCredential to false; updated credential chain documentation
InteractiveGraphAuthService.cs	Removed ~68 lines of device code fallback logic; infrastructure/connectivity errors now throw immediately with clear error messages
GraphApiService.cs	Enhanced EnsureGraphHeadersAsync with clearer authentication strategy comments and improved debug logging for auth method selection