[Pages] Allow az auth without an Azure subscription - #132
Merged
Priyanshu Agrawal (priyanshu92) merged 1 commit intoApr 29, 2026
Merged
Conversation
Pass `--allow-no-subscriptions` on AAD-only Azure CLI calls so the plugin works for users whose Microsoft account has no Azure subscription (Dataverse and Power Platform tokens are AAD-scoped and don't require a subscription). - Update the shared `getAuthToken` helper in `validation-helpers.js` to pass the flag on `az account get-access-token`. - Refresh user-facing `az login` hint strings across scripts, SKILL.md, agent, and reference files to recommend `az login --allow-no-subscriptions`. - Clarify the `list-azure-keyvaults.js` error message — Key Vault is subscription-scoped, the flag does not apply there. - Document the convention in `plugins/power-pages/AGENTS.md`: apply the flag on AAD-only commands, never on subscription-scoped ones. - Add `validation-helpers.test.js` (stubs `child_process.execSync` via require.cache) to lock the flag in. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copilot started reviewing on behalf of
Priyanshu Agrawal (priyanshu92)
April 29, 2026 11:34
View session
Priyanshu Agrawal (priyanshu92)
enabled auto-merge (squash)
April 29, 2026 11:34
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Power Pages plugin’s Azure CLI authentication flow so AAD-scoped token acquisition works even when the signed-in Microsoft account has no Azure subscriptions, and aligns user-facing guidance across scripts/docs.
Changes:
- Add
--allow-no-subscriptionsto the sharedgetAuthToken()Azure CLI call (az account get-access-token) used by multiple scripts. - Refresh error/help text across scripts, skills, and agent/reference docs to recommend
az login --allow-no-subscriptionsfor AAD-only operations. - Add a Node test intended to lock in the new
getAuthToken()CLI flag behavior and document the new convention inAGENTS.md.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| plugins/power-pages/skills/audit-permissions/scripts/query-table-relationships.js | Update auth failure hint to recommend az login --allow-no-subscriptions. |
| plugins/power-pages/skills/audit-permissions/scripts/query-table-lookups.js | Update auth failure hint to recommend az login --allow-no-subscriptions. |
| plugins/power-pages/skills/add-server-logic/assets/serverlogic-plan.html | Update Azure CLI login guidance shown in generated plan HTML. |
| plugins/power-pages/skills/add-cloud-flow/scripts/list-cloud-flows.js | Update auth failure hint to recommend az login --allow-no-subscriptions. |
| plugins/power-pages/skills/add-cloud-flow/SKILL.md | Update prerequisites + error-handling guidance for Azure CLI login. |
| plugins/power-pages/skills/activate-site/scripts/activate-site.js | Update Azure CLI login hint string. |
| plugins/power-pages/skills/activate-site/SKILL.md | Update Azure CLI verification/login guidance and 401 remediation text. |
| plugins/power-pages/scripts/verify-dataverse-access.js | Update token acquisition + expired token remediation hints. |
| plugins/power-pages/scripts/tests/validation-helpers.test.js | New test intended to ensure getAuthToken() passes --allow-no-subscriptions. |
| plugins/power-pages/scripts/list-custom-actions.js | Update token acquisition failure hint. |
| plugins/power-pages/scripts/list-azure-keyvaults.js | Clarify error message that Key Vault listing is subscription-scoped. |
| plugins/power-pages/scripts/lib/validation-helpers.js | Add --allow-no-subscriptions to az account get-access-token command. |
| plugins/power-pages/scripts/dataverse-request.js | Update token acquisition + refresh failure hints. |
| plugins/power-pages/scripts/create-environment-variable.js | Update token acquisition failure hint. |
| plugins/power-pages/scripts/clear-site-cache.js | Update token acquisition failure hint. |
| plugins/power-pages/references/dataverse-prerequisites.md | Update docs to explain --allow-no-subscriptions and subscription-scoped exceptions. |
| plugins/power-pages/agents/webapi-settings-architect.md | Update agent guidance for Azure CLI login hint. |
| plugins/power-pages/agents/table-permissions-architect.md | Update agent guidance for Azure CLI login hint. |
| plugins/power-pages/agents/data-model-architect.md | Update agent guidance for Azure CLI login hint. |
| plugins/power-pages/AGENTS.md | Document convention on when to use --allow-no-subscriptions and to reuse getAuthToken(). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Neeraj Nandwana (neerajnandwana-msft)
approved these changes
Apr 29, 2026
Neeraj Nandwana (neerajnandwana-msft)
left a comment
Neeraj Nandwana (neerajnandwana-msft)
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me.
Priyanshu Agrawal (priyanshu92)
deleted the
users/priyanshuag/az-allow-no-subscriptions
branch
April 29, 2026 11:39
2 tasks
Priyanshu Agrawal (priyanshu92)
added a commit
that referenced
this pull request
Apr 29, 2026
…st (#133) Follow-up to #132. The initial test stubbed `child_process` by swapping the entry in `require.cache`, which relies on Node's caching of built-in modules — implementation detail that may not hold across versions. Switch to monkeypatching `childProcess.execSync` directly before requiring `validation-helpers.js`, with cleanup via `t.after()`. This exercises the helper through its real `require('child_process')` call and is the idiomatic node:test approach. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pass
--allow-no-subscriptionson AAD-only Azure CLI calls so the plugin works for users whose Microsoft account has no Azure subscription (Dataverse and Power Platform tokens are AAD-scoped and don't require a subscription).getAuthTokenhelper invalidation-helpers.jsto pass the flag onaz account get-access-token.az loginhint strings across scripts, SKILL.md, agent, and reference files to recommendaz login --allow-no-subscriptions.list-azure-keyvaults.jserror message — Key Vault is subscription-scoped, the flag does not apply there.plugins/power-pages/AGENTS.md: apply the flag on AAD-only commands, never on subscription-scoped ones.validation-helpers.test.js(stubschild_process.execSyncvia require.cache) to lock the flag in.