Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Weekly sync updating the permissions/provisioning metadata, adding new permission entries and adjusting cross-tenant access policy endpoint mappings.
Changes:
- Added provisioning metadata for
Policy.Read.CrossTenantAccessandPreAuthorizationGrant.Read.All. - Changed several
/policies/crosstenantaccesspolicy*endpoint permission mappings to empty strings and introduced a dedicatedGETblock for those paths.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| permissions/new/provisioningInfo.json | Adds new provisioning entries for cross-tenant access and pre-authorization grant permissions. |
| permissions/new/permissions.json | Updates required-permission mappings for cross-tenant access policy endpoints and splits GET handling into a separate block. |
Comments suppressed due to low confidence (3)
permissions/new/permissions.json:1
- These endpoints previously had values like
least=DelegatedWork,Applicationand are now set to"". If the permissions resolver/parser expects a structured value (e.g.,least=...) or expects missing keys to mean “no mapping”, an empty string risks being treated as an invalid permission expression and can break generation/validation. Prefer either (a) restoring a valid permission expression, or (b) removing the keys entirely if the intent is “no permissions mapping / unsupported”.
permissions/new/permissions.json:1 - These endpoints previously had values like
least=DelegatedWork,Applicationand are now set to"". If the permissions resolver/parser expects a structured value (e.g.,least=...) or expects missing keys to mean “no mapping”, an empty string risks being treated as an invalid permission expression and can break generation/validation. Prefer either (a) restoring a valid permission expression, or (b) removing the keys entirely if the intent is “no permissions mapping / unsupported”.
permissions/new/permissions.json:1 - This new
GETblock introduces path mappings with empty-string permission requirements. Even if the intent is to represent “no permission required” or “unknown”, encoding that as""is ambiguous and inconsistent with the rest of the file’s schema (least=...). Use the established representation for “no mapping” (typically omitting the path entry) or a schema-supported explicit marker (if one exists) to avoid confusing API consumers and tooling.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "Policy.Read.CrossTenantAccess": [ | ||
| { | ||
| "id": "", | ||
| "scheme": "DelegatedWork", | ||
| "environment": "public", | ||
| "isHidden": true, | ||
| "isEnabled": true, | ||
| "resourceAppId": "00000002-0000-0000-c000-000000000000" | ||
| }, | ||
| { | ||
| "id": "", | ||
| "scheme": "Application", | ||
| "environment": "public", | ||
| "isHidden": true, | ||
| "isEnabled": true, | ||
| "resourceAppId": "00000002-0000-0000-c000-000000000000" | ||
| } | ||
| ], |
There was a problem hiding this comment.
id is set to an empty string for the newly added permissions, and environment is also empty for PreAuthorizationGrant.Read.All. If downstream tooling expects a real scope/appRole GUID and a non-empty environment (as it appears to for other entries), these records will be unusable and may cause lookups/exports to fail. Populate the correct id values (scope/appRole IDs) and set environment consistently (e.g., "public"), or omit these entries until the authoritative IDs are available.
| "PreAuthorizationGrant.Read.All": [ | ||
| { | ||
| "id": "", | ||
| "scheme": "DelegatedWork", | ||
| "environment": "", | ||
| "isHidden": true, | ||
| "isEnabled": true, | ||
| "resourceAppId": "00000002-0000-0000-c000-000000000000" | ||
| }, | ||
| { | ||
| "id": "", | ||
| "scheme": "Application", | ||
| "environment": "", | ||
| "isHidden": true, | ||
| "isEnabled": true, | ||
| "resourceAppId": "00000002-0000-0000-c000-000000000000" | ||
| } | ||
| ] |
There was a problem hiding this comment.
id is set to an empty string for the newly added permissions, and environment is also empty for PreAuthorizationGrant.Read.All. If downstream tooling expects a real scope/appRole GUID and a non-empty environment (as it appears to for other entries), these records will be unusable and may cause lookups/exports to fail. Populate the correct id values (scope/appRole IDs) and set environment consistently (e.g., "public"), or omit these entries until the authoritative IDs are available.
Weekly Permissions sync 2026-04-14