fix(extensions): use UserTenantId for credential resolution across all extensions

[vhvb1989]

Fix

Follow-up to #7078 — the same bug existed in 5 more extensions.

Multiple extensions were using Subscription.TenantId (the resource tenant) instead of Subscription.UserTenantId (the user access tenant) when creating AzureDeveloperCLICredential after subscription selection. For multi-tenant/guest users these differ, causing AADSTS70043/AADSTS700082 "refresh token expired" errors.

Change

- tenantId = resp.Subscription.TenantId
+ tenantId = resp.Subscription.UserTenantId

Affected extensions

Extension	Files	Spots
azure.ai.models	custom.go, init.go	3
azure.ai.agents	init.go, init_from_code.go	2
azure.ai.finetune	init.go	2
microsoft.azd.ai.builder	start.go	1
microsoft.azd.demo	prompt.go	1

Extensions already correct (using LookupTenant()): azure.appservice, azure.ai.agents (parser.go, service_target_agent.go).

For single-tenant users, TenantId == UserTenantId, so no behavior change.

Prevention: Copilot review instruction

Added .github/instructions/extensions.instructions.md — a path-scoped instruction file that targets cli/azd/extensions/**. When the Copilot PR reviewer analyzes future PRs that touch extension code, it will flag uses of Subscription.TenantId for credential creation and recommend Subscription.UserTenantId instead. This prevents the same bug from being reintroduced in existing or new extensions.

Fixes #7077
Related: #7070, #7078

[Copilot]

Pull request overview

Fixes tenant selection for Azure Developer CLI credential creation across multiple azd extensions by using the user access tenant (Subscription.UserTenantId) instead of the resource tenant (Subscription.TenantId) after interactive subscription selection—aligning extension behavior with azd core and preventing multi-tenant/guest token refresh failures.

Changes:

• Updated multiple extensions to set azureContext.Scope.TenantId (and related tenantId locals) from Subscription.UserTenantId after PromptSubscription.
• Ensured subsequent credential creation and environment persistence flows use the corrected tenant value.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cli/azd/extensions/microsoft.azd.demo/internal/cmd/prompt.go	Uses UserTenantId when building AzureScope from a prompted subscription.
cli/azd/extensions/microsoft.azd.ai.builder/internal/cmd/start.go	Uses UserTenantId when persisting prompted subscription context into the environment.
cli/azd/extensions/azure.ai.models/internal/cmd/init.go	Uses UserTenantId when prompting for subscription during init flows (env + context).
cli/azd/extensions/azure.ai.models/internal/cmd/custom.go	Uses UserTenantId when prompting for subscription in the lightweight “custom” flow.
cli/azd/extensions/azure.ai.finetune/internal/cmd/init.go	Uses UserTenantId when prompting for subscription during init flows.
cli/azd/extensions/azure.ai.agents/internal/cmd/init_from_code.go	Uses UserTenantId when prompting for subscription during init-from-code flow.
cli/azd/extensions/azure.ai.agents/internal/cmd/init.go	Uses UserTenantId when prompting for subscription during init flow.

Comments suppressed due to low confidence (3)

cli/azd/extensions/azure.ai.finetune/internal/cmd/init.go:606

• The comment says this sets the subscription ID, but the code is setting AZURE_TENANT_ID. Please update the comment to match what is being written to the environment (tenant ID).

		// Set the subscription ID in the environment
		_, err = azdClient.Environment().SetValue(ctx, &azdext.SetEnvRequest{
			EnvName: env.Name,
			Key:     "AZURE_TENANT_ID",

cli/azd/extensions/azure.ai.agents/internal/cmd/init.go:652

• The comment says this sets the subscription ID, but the code is setting AZURE_TENANT_ID. Please update the comment to match what is being written to the environment (tenant ID).

		// Set the subscription ID in the environment
		_, err = azdClient.Environment().SetValue(ctx, &azdext.SetEnvRequest{
			EnvName: env.Name,
			Key:     "AZURE_TENANT_ID",
			Value:   azureContext.Scope.TenantId,

cli/azd/extensions/microsoft.azd.ai.builder/internal/cmd/start.go:702

• The comment says this sets the subscription ID, but the code is setting AZURE_TENANT_ID. Please update the comment to match what is being written to the environment (tenant ID).

		// Set the subscription ID in the environment
		_, err = azdClient.Environment().SetValue(ctx, &azdext.SetEnvRequest{
			EnvName: env.Name,
			Key:     "AZURE_TENANT_ID",
			Value:   azureContext.Scope.TenantId,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[rajeshkamal5050]

/check-enforcer override