Add Defender permissions part of "a365 setup all" - #485
Draft
Slava Reznitsky (slreznit) wants to merge 3 commits into
Draft
Add Defender permissions part of "a365 setup all"#485Slava Reznitsky (slreznit) wants to merge 3 commits into
Slava Reznitsky (slreznit) wants to merge 3 commits into
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
github-actions
Bot
added
the
documentation
Updates the Defender API app role and delegated scope value from AIAgentsRTP.ToolInvocation to RealtimeProtection.Process, and renames the constant accordingly since the old name no longer described the role. NOT YET VERIFIED AGAINST A LIVE RESOURCE. The resource SP still publishes AIAgentsRTP.ToolInvocation in the agent365003 tenant, and the resource is not provisioned in the corp tenant at all, so the new value could not be confirmed anywhere. Until the Defender-side rename ships, the combined /v2.0/adminconsent URL will fail with AADSTS650053 for every resource in the request - Graph, MCP, Bot, Observability and Power Platform - not just Defender, and the S2S app role lookup will find no matching appRoles entry. Confirm the resource publishes the new value before merging. Adds DefenderApi_ScopeValue_MatchesValuePublishedOnResource pinning the literal string so future drift fails a test that explains the blast radius. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
| /// <summary> | ||
| /// Defender API identifier URI. | ||
| /// </summary> | ||
| public const string DefenderApiIdentifierUri = "https://rtp-a365.ai.defender.microsoft.com"; |
There was a problem hiding this comment.
will replace with api://86a21212-634e-4553-b3d6-e477e4c9d9ec
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AIAgentsRTP.ToolInvocationpermission duringa365 setupfor both delegated (OBO) and application (S2S) flows.Testing