From e247438fc29f2ac70d98f569189b3a57ba5a1dbf Mon Sep 17 00:00:00 2001
From: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Date: Thu, 16 Jul 2026 14:39:37 +0800
Subject: [PATCH] feat(config): add copilot policy permissions

Add CopilotPolicySettings.ReadWrite to the permissions translator for both Delegated and Application origins, and include the corresponding scope/role IDs in SAMManifest requiredResourceAccess. This updates the SAM app permission set so Copilot policy settings can be managed in both signed-in and app-only flows.
---
 Config/PermissionsTranslator.json | 18 ++++++++++++++++++
 Config/SAMManifest.json           |  8 ++++++++
 2 files changed, 26 insertions(+)

diff --git a/Config/PermissionsTranslator.json b/Config/PermissionsTranslator.json
index 52f29c1194335..c7163822eb098 100644
--- a/Config/PermissionsTranslator.json
+++ b/Config/PermissionsTranslator.json
@@ -5371,5 +5371,23 @@
     "userConsentDescription": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
     "userConsentDisplayName": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
     "value": "TeamsTelephoneNumber.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read and write Copilot policy settings for the organization, on behalf of the signed-in user.",
+    "displayName": "Read and write Copilot policy settings",
+    "id": "e2edbde8-4448-4e49-8ebb-d53ba72df0f3",
+    "Origin": "Delegated",
+    "userConsentDescription": "Allows the app to read and write Copilot policy settings for the organization, on your behalf.",
+    "userConsentDisplayName": "Read and write Copilot policy settings",
+    "value": "CopilotPolicySettings.ReadWrite"
+  },
+  {
+    "description": "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user.",
+    "displayName": "Read and write Copilot policy settings",
+    "id": "cc147c17-b8e8-4d3f-9f94-aa9e279a079a",
+    "Origin": "Application",
+    "userConsentDescription": "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user.",
+    "userConsentDisplayName": "Read and write Copilot policy settings",
+    "value": "CopilotPolicySettings.ReadWrite"
   }
 ]
diff --git a/Config/SAMManifest.json b/Config/SAMManifest.json
index 1f7dd716f19c2..56fc2811de489 100644
--- a/Config/SAMManifest.json
+++ b/Config/SAMManifest.json
@@ -610,6 +610,14 @@
         {
           "id": "1ff1be21-34eb-448c-9ac9-ce1f506b2a68",
           "type": "Scope"
+        },
+        {
+          "id": "cc147c17-b8e8-4d3f-9f94-aa9e279a079a",
+          "type": "Role"
+        },
+        {
+          "id": "e2edbde8-4448-4e49-8ebb-d53ba72df0f3",
+          "type": "Scope"
         }
       ]
     },