[SergeyMenshykh]

Motivation and Context

_CopilotStudioAgentTokenFactory._cert_thumbprint computes the X.509 certificate thumbprint that is passed to MSAL as the thumbprint client credential. This value is the JWT x5t header, which MSAL and Microsoft Entra ID require to be a SHA-1 digest - any other digest would be rejected by the token endpoint.

Because it is a plain digest call, static analysis tooling flags it even though the hash is used purely as a certificate identifier, not as a cryptographic/security primitive (the call already passes usedforsecurity=False).

Description

Adds a comment explaining why SHA-1 is required here and annotates the call so static analysis does not flag it. No behavior change.

Note: MSAL itself carries the same annotation on its own x5t fingerprint computation.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[github-actions]

Automated Code Review

Reviewers: 1 | Confidence: 46% | Result: All clear

Reviewed: Design Approach

---

Automated review by SergeyMenshykh's agents

[Copilot]

Pull request overview

Documents why SHA-1 is intentionally used when computing the X.509 certificate thumbprint for the Copilot Studio agent’s MSAL certificate-based authentication flow, and adds an inline static-analysis suppression annotation (no functional behavior change).

Changes:

• Add an explanatory comment clarifying that SHA-1 is required for the MSAL/Entra ID thumbprint (x5t) thumbprint identifier, not used as a security primitive.
• Add an inline “CodeQL [SM02167]” annotation to reduce static-analysis noise for the SHA-1 usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
agents/copilot_studio
copilot_studio_agent.py	247	61	75%	89, 93–95, 99–102, 104, 110–111, 117, 122, 130–131, 135–137, 139–140, 143, 148, 151, 153, 179–180, 182–183, 187, 237–239, 243–248, 291, 299, 301, 305, 308, 442, 491, 538, 544–545, 547, 549–550, 558, 560–562, 605–607, 615, 624, 647
TOTAL	29020	5619	80%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
4091	23 💤	0 ❌	0 🔥	2m 20s ⏱️