Enable portal-only admin consent for bulk onboarding

[Walter Luna (walterluna)]

Declare application roles and delegated scopes with -SkipGrant so administrators can grant consent in Entra without running the script.

• Preserve existing API permissions and avoid duplicate declarations
• Report declared permissions, consent failures, and portal links
• Add regression coverage for permission merging and idempotency

[Copilot]

Copilot review overview

🟡 Changes recommended

Resolve merge conflicts and add execution-level coverage for skip-grant behavior.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Resolve merge conflict markers preventing PowerShell script parsing · New

What changed in this PR

Enables portal-only admin consent for bulk onboarding by declaring permissions and reporting Entra consent links.

Changes:

• Adds permission merging and idempotency handling.
• Adds -SkipGrant behavior and consent reporting.
• Adds regression coverage for permission declarations.

File	Summary
scripts/​bulk-agent-registration/​New-A365AutomationApp.ps1	Implements permission declaration and consent reporting; unresolved merge conflicts prevent parsing.
scripts/​bulk-agent-registration/​tests/​PermissionDeclaration.Tests.ps1	Tests permission merging, but lacks execution-level coverage for -SkipGrant behavior.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved issues remain in WhatIf reporting, duplicate reconciliation, and consent-status accuracy.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Deduplicate existing Graph permissions before PATCHing · New
• Avoid reporting planned permissions as applied during WhatIf · New
• Add changelog entry for portal-only bulk onboarding consent · New

Resolved since last review (1)

• Resolve merge conflict markers preventing PowerShell script parsing

[Copilot]

Copilot review overview

🟡 Changes recommended

Resolve partial permission reporting and add the required release note; test organization also needs improvement.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Check unresolved roles before marking all permissions declared · New
• Document portal-only consent changes in the Unreleased changelog · New

Resolved since last review (3)

• Avoid reporting planned permissions as applied during WhatIf
• Deduplicate existing Graph permissions before PATCHing
• Add changelog entry for portal-only bulk onboarding consent

[Copilot]

Copilot review overview

🟡 Changes recommended

The user-facing change lacks a changelog entry, and the oversized test suite should be split.

Review effort: Balanced
Findings: 1

Open (1)

• Split oversized merge-helper and script scenario test file · New

Resolved since last review (2)

• Check unresolved roles before marking all permissions declared
• Document portal-only consent changes in the Unreleased changelog

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unresolved permissions can be reported as complete, and the generated consent link can fail for newly created apps.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Split oversized merge-helper and script scenario test file

Previously missed (3)

In code that hasn't changed since last review

Confirmation uses unrelated default app display name

scripts/​bulk-agent-registration/​New-A365AutomationApp.ps1:1232

When an existing app is selected with -AppId, $DisplayName can still be the unrelated default value, even though the fetched application has its real display name. The confirmation can therefore ask the operator to approve a permissions PATCH for the wrong-looking target. Use the fetched app identity (ideally name plus app ID) in this approval boundary.

This issue also appears on line 1569 of the same file.

Completeness check ignores unresolved permissions

scripts/​bulk-agent-registration/​New-A365AutomationApp.ps1:1270

This completeness check only considers permissions that resolved successfully. Roles recorded in $missing and delegated scopes skipped as unpublished never enter these collections, so a partially enrolled tenant can be told that all selected permissions are declared and be sent to consent to an incomplete set. Track unresolved delegated scopes as well, include all unresolved permissions in this predicate, and expose them in the summary/guidance.

Legacy admin consent link lacks registered redirect URI

scripts/​bulk-agent-registration/​New-A365AutomationApp.ps1:1571

The script creates applications without a redirect URI, so this legacy /adminconsent link has no registered reply address and can fail with AADSTS500113 for a newly created app. That makes the advertised handoff link unusable. Either direct administrators only to the working Entra portal URL, or register a callback and generate a consent URL with its matching redirect_uri; update the summary and regression assertion consistently.