setup permissions custom uses User.Read token for OAuth2 grant operation

[lsl-2020]

Summary

a365 setup permissions custom attempts to create/read oauth2PermissionGrants with a Microsoft Graph token requested for only User.Read. The operation fails with Authorization_RequestDenied even when the signed-in user is a Global Administrator.

Environment

• Agent 365 CLI: 1.1.214+90c444832f
• Windows / PowerShell
• Signed-in user: Global Administrator

Reproduction

a365 setup permissions custom `
  --resource-app-id 90ecec28-f5a6-42b3-9bde-dae1ca98f8b5 `
  --scopes "Computer.See,Computer.Control" `
  --verbose

Actual behavior

The CLI successfully adds the resource to the blueprint's requiredResourceAccess, then fails while reading/creating the OAuth2 permission grant:

OAuth2 permission grant failed ... Authorization_RequestDenied:
Insufficient privileges to complete the operation.

Verbose logging shows the token provider explicitly requests and reuses a Graph token scoped only to User.Read:

Acquiring Graph token via token provider (... scopes: User.Read)
Reusing cached Graph token ... ::User.Read::...
Graph POST /v1.0/oauth2PermissionGrants ... failed 403 Forbidden

The CLI then reports that tenant admin action is required even though the user is a Global Administrator.

Expected behavior

The CLI should acquire a Graph token containing the permission required by the Graph operation—at minimum DelegatedPermissionGrant.ReadWrite.All—or drive the documented admin-consent handoff when its client app lacks that permission.

Microsoft Graph documents DelegatedPermissionGrant.ReadWrite.All as the least-privileged permission for POST /oauth2PermissionGrants:
https://learn.microsoft.com/graph/api/oauth2permissiongrant-post?view=graph-rest-1.0#permissions

Workaround / validation

Using an independently acquired Graph token containing DelegatedPermissionGrant.ReadWrite.All succeeds for the grant operation. The remaining blueprint inheritance entry can also be created directly through the official inheritablePermissions Graph API.

This issue is especially confusing because the user's directory role is sufficient, but both the directory role and the client token's Graph scopes are required.

[github-actions]

[AUTO-TRIAGE] Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'bug' because the issue describes a failure in expected functionality where the CLI does not request the appropriate permissions for the operation, leading to an error.
Priority: Elevated to P1 due to security concern: The issue describes a problem where insufficient token permissions (User.Read instead of DelegatedPermissionGrant.ReadWrite.All) prevent the CLI from performing an OAuth2 grant operation, which could lead to improper handling of authorization and permission delegation, potentially exposing sensitive operations to unauthorized users or failing to enforce security policies.
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. The issue describes a problem where insufficient token permissions (User.Read instead of DelegatedPermissionGrant.ReadWrite.All) prevent the CLI from performing an OAuth2 grant operation, which could lead to improper handling of authorization and permission delegation, potentially exposing sensitive operations to unauthorized users or failing to enforce security policies.
Labels: Applied labels bug, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

[github-actions]

[AUTO-TRIAGE] Results

Classification: bug
Priority: P1
Confidence: 95.0%

Recommended Assignee: ajmfehr

Analysis:
type rationale: Classified as 'bug' because the issue describes a failure in expected functionality where the CLI does not request the appropriate permissions for the operation, leading to an error.

priority rationale: Elevated to P1 due to security concern: The issue describes a problem where insufficient token permissions (`User.Read` instead of `DelegatedPermissionGrant.ReadWrite.All`) prevent the CLI from performing an OAuth2 grant operation, which could lead to improper handling of authorization and permission delegation, potentially exposing sensitive operations to unauthorized users or failing to enforce security policies.

copilot rationale: Security issues require human review and should not be auto-fixed

assignment rationale: Security issue assigned to security lead. The issue describes a problem where insufficient token permissions (`User.Read` instead of `DelegatedPermissionGrant.ReadWrite.All`) prevent the CLI from performing an OAuth2 grant operation, which could lead to improper handling of authorization and permission delegation, potentially exposing sensitive operations to unauthorized users or failing to enforce security policies.

labels rationale: Applied labels bug, P1, security based on issue type and priority

[SUGGESTION] Suggested Approach

1. 1. **Update Token Scope in Authentication Logic**: Locate the token provider logic in the `src` directory, likely under `src/Microsoft.Agents.A365.DevTools.Cli/Authentication` or similar. Modify the token acquisition process to request the `DelegatedPermissionGrant.ReadWrite.All` scope instead of just `User.Read` when performing operations on `oauth2PermissionGrants`. Ensure this change is scoped to the `a365 setup permissions custom` command to avoid unnecessary permissions elsewhere.
2. 2. **Add Permission Validation Before API Call**: In the `a365 setup permissions custom` command implementation (likely in `src/Microsoft.Agents.A365.DevTools.Cli/Commands`), add a check to validate that the acquired token contains the required permissions (`DelegatedPermissionGrant.ReadWrite.All`). If the token lacks the necessary scope, prompt the user to re-authenticate with admin consent or provide a clear error message.
3. 3. **Implement Admin Consent Flow**: If the CLI's registered app lacks the required permissions, implement a fallback to drive the admin consent flow. Use the Microsoft Graph documentation on admin consent (https://learn.microsoft.com/graph/auth\-v2\-admin\-consent\) to guide users through granting the necessary permissions. Update the verbose logging to include instructions for this scenario.
4. 4. **Add Unit and Integration Tests**: Extend the test coverage in `src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Integration` to include scenarios where the `a365 setup permissions custom` command is executed with insufficient token scopes. Mock the token provider and Microsoft Graph API calls to simulate both success and failure cases, ensuring the CLI handles these scenarios gracefully.
5. 5. **Update Documentation**: Modify the relevant documentation in the `docs` directory to include details about the required permissions for the `a365 setup permissions custom` command. Provide examples of how to grant admin consent and acquire tokens with the necessary scopes. Additionally, update the command's help text to mention the required permissions explicitly.

---

Generated by TeamAssistant Auto-Triage powered by GitHub Models

[github-actions]

SLA Escalation Alert

This P1 issue has exceeded its SLA threshold.

Metric	Value
Priority	P1
SLA Threshold	48 hours
Time Since Update	71.4 hours
Current Assignees	ajmfehr

Action: This issue is already assigned to a Tech Lead but remains unresolved.

Escalating to Engineering Manager ajmfehr for visibility.

Tech Leads: ajmfehr

---

Generated by AutoTriage SLA Escalation