a token minted for a single org cannot touch the other. we cannot actually create the pullrequest with maintainer_can_modify unless the token has at least collaborator on BOTH repos. so this is just a gap identified by the token (#46721)

Co-authored-by: Scott Beddall <scbedd@microsoft.com>

Author: azure-sdk

eng/common/pipelines/templates/steps/create-pull-request.yml

@@ -70,5 +70,6 @@ steps:
       -UserReviewers "${{ parameters.GHReviewers }}"
       -TeamReviewers "${{ parameters.GHTeamReviewers }}"
       -Assignees "${{ parameters.GHAssignees }}"
+      -MaintainerCanModify $${{ eq(parameters.PROwner, parameters.RepoOwner) }}
       -CloseAfterOpenForTesting $${{ coalesce(parameters.CloseAfterOpenForTesting, 'false') }}
       -OpenAsDraft $${{ parameters.OpenAsDraft }}

eng/common/scripts/Submit-PullRequest.ps1

@@ -29,6 +29,10 @@ List of github teams to add as reviewers
 .PARAMETER Assignees
 Users to assign to the PR after opening. Users should be a comma-separated list
 with no preceding `@` symbol (e.g. "user1,usertwo,user3")
+.PARAMETER MaintainerCanModify
+Whether to allow maintainers of the base repo to push to the PR branch.
+Set to false for cross-fork PRs where the token lacks permission to grant
+collaborator access on the fork.
 .PARAMETER CloseAfterOpenForTesting
 Close the PR after opening to save on CI resources and prevent alerts to code
 owners, assignees, requested reviewers, or others.
@@ -73,6 +77,8 @@ param(
 
   [boolean]$OpenAsDraft=$false,
 
+  [boolean]$MaintainerCanModify=$true,
+
   [boolean]$AddBuildSummary=($null -ne $env:SYSTEM_TEAMPROJECTID)
 )
 
@@ -114,7 +120,7 @@ else {
       -Head "${PROwner}:${PRBranch}" `
       -Base $BaseBranch `
       -Body $PRBody `
-      -Maintainer_Can_Modify $true `
+      -Maintainer_Can_Modify $MaintainerCanModify `
       -Draft:$OpenAsDraft `
       -AuthToken $AuthToken