Merge pull request #232 from microsoftgraph/dkershaw10-copilot-integration

dkershaw10 · web-flow · commit c55219d63088 · 2025-03-18T16:12:52.000Z
Updates to enable Bicep copilot integration
diff --git a/quickstart-templates/application-serviceprincipal-create-client-resource/README.md b/quickstart-templates/application-serviceprincipal-create-client-resource/README.md
@@ -1,6 +1,6 @@
 # Create client and resource apps
 
-> **Note**: Minimum Bicep version required to deploy this quickstart template is [v0.30.3](https://github.com/Azure/bicep/releases/tag/v0.30.3).
+> **Note**: Minimum Bicep version required to deploy this quickstart template is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 
 This template allows you to create a client application and a resource application, along with their service principals.
 
diff --git a/quickstart-templates/application-serviceprincipal-create-client-resource/bicepconfig.json b/quickstart-templates/application-serviceprincipal-create-client-resource/bicepconfig.json
@@ -4,6 +4,6 @@
     },
     // specify an alias for the version of the v1.0 dynamic types package you want to use
     "extensions": {
-      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
+      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"
     }
 }
diff --git a/quickstart-templates/application-serviceprincipal-create-client-resource/metadata.json b/quickstart-templates/application-serviceprincipal-create-client-resource/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Create client and resource apps",
+    "description": "This template creates a client application and a resource application, along with their service principals.",
+    "summary": "This template creates a client application and a resource application, along with their service principals.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+  }
diff --git a/quickstart-templates/apps-permissions-and-grants/README.md b/quickstart-templates/apps-permissions-and-grants/README.md
@@ -31,7 +31,7 @@ The sample also enables the deployer to set an owner of the client application,
 
 - A valid **Azure subscription**: If you don't own an Azure subscription, [create a free account](https://azure.microsoft.com/free/) before you begin.
 - An **Azure resource group** that you own under a valid Azure subscription, or [deploy without an Azure subscription][no-azure-sub].
-- [Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is v0.32.4.
+- [Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 - Have the requisite **Microsoft Entra roles** to deploy this template:
 
   - Permissions to create applications. [Users have this permission by default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#compare-member-and-guest-default-permissions). However, [admins can turn off this default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions) in which case you need to be assigned at least the [Application Developer](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#application-developer) role.
diff --git a/quickstart-templates/apps-permissions-and-grants/metadata.json b/quickstart-templates/apps-permissions-and-grants/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Configure an app with scopes to call Microsoft Graph",
+    "description": "This template configures an app with OAuth2.0 scopes to call Microsoft Graph. It creates a client application and depending on the mode parameter, and either sets the required resource access on the client application definition, or grants OAuth2.0 scopes to the client application. In either case, the target resource used is Microsoft Graph, and the deployer can select which Microsoft Graph OAuth2.0 scopes are used.",
+    "summary": "This template configures an app with OAuth2.0 scopes to call Microsoft Graph.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/create-client-app-sp-with-kv-cert/README.md b/quickstart-templates/create-client-app-sp-with-kv-cert/README.md
@@ -1,6 +1,6 @@
 # Create a client app with an X509 certificate from Key Vault as the credential
 
-> **Note**: Minimum Bicep version required to deploy this quickstart template is [v0.30.3](https://github.com/Azure/bicep/releases/tag/v0.30.3).
+> **Note**: Minimum Bicep version required to deploy this quickstart template is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 
 The template creates a Key Vault, through which the authorized managed identity can add an X509 certificate (if it doesn't exist) and get the certificate's public key (base64 encoded), along with the thumbprint and other metadata.
 Finally the template creates the client application resource using the certificate public key as its credential. followed
diff --git a/quickstart-templates/create-client-app-sp-with-kv-cert/bicepconfig.json b/quickstart-templates/create-client-app-sp-with-kv-cert/bicepconfig.json
@@ -4,6 +4,6 @@
     },
     // specify an alias for the version of the v1.0 dynamic types package you want to use
     "extensions": {
-      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
+      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"
     }
 }
diff --git a/quickstart-templates/create-client-app-sp-with-kv-cert/metadata.json b/quickstart-templates/create-client-app-sp-with-kv-cert/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Create an app with an X509 certificate using Key Vault.",
+    "description": "This template creates a Key Vault, through which the authorized managed identity can add an X509 certificate (if it doesn't exist) and get the certificate's public key (base64 encoded), along with the thumbprint and other metadata. Finally, the template creates the client application resource using the certificate public key as its credential. followed by creation of the service principal",
+    "summary": "This template creates a client app with an X509 certificate from Key Vault as the credential",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/create-fic-for-github-actions/README.md b/quickstart-templates/create-fic-for-github-actions/README.md
@@ -18,7 +18,7 @@ For limitations on federated identity credentials, please refer to [Federated id
 
 * Ownership of a GitHub repo.
 * Have a valid **Azure subscription**: If you don't own an Azure subscription, [create a free account](https://azure.microsoft.com/free/) before you begin.
-* [Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is v0.30.3.
+* [Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 * Have a **Microsoft Entra role** that assigns you permissions to create applications. [Users have this permission by default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#compare-member-and-guest-default-permissions). However, [admins can turn off this default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions) in which case you need to be assigned at least the [Application Developer](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#application-developer) role.
 
 ### Deploy the Bicep template
diff --git a/quickstart-templates/create-fic-for-github-actions/bicepconfig.json b/quickstart-templates/create-fic-for-github-actions/bicepconfig.json
@@ -4,6 +4,6 @@
     },
     // specify an alias for the version of the v1.0 dynamic types package you want to use
     "extensions": {
-      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
+      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"
     }
 }
diff --git a/quickstart-templates/create-fic-for-github-actions/metadata.json b/quickstart-templates/create-fic-for-github-actions/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Configure a federated identity credential for GitHub Actions",
+    "description": "This template configures a federated identity credential for GitHub Actions, without using any secrets. It enables a GitHub Actions workflow to exchange a GitHub access token for a Microsoft Entra ID access token, so that the GitHub Actions workflow can access Azure resources. To enable this, the template creates an application (to represent the GitHub Action) and configures it with a federated identity credential. When the GitHub Actions workflow requests to exchange a GitHub access token for an access token, from the Microsoft identity platform, the values in the federated identity credential are checked against the provided GitHub token's \"issuer\" and \"subject\" claim values.",
+    "summary": "This template configures a federated identity credential for GitHub Actions, without using any secrets.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/msi-as-a-fic-secretless/README.md b/quickstart-templates/msi-as-a-fic-secretless/README.md
@@ -24,7 +24,7 @@ This template sample deploys the following resources:
 
 * A valid **Azure subscription**: If you don't own an Azure subscription, [create a free account](https://azure.microsoft.com/free/) before you begin.
 * An **Azure resource group** that you own under a valid Azure subscription.
-[Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is v0.30.3.
+[Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 * Have the requisite **Microsoft Entra roles** to deploy this template:
 
   * Permissions to create applications. [Users have this permission by default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#compare-member-and-guest-default-permissions). However, [admins can turn off this default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions) in which case you need to be assigned at least the [Application Developer](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#application-developer) role.
diff --git a/quickstart-templates/msi-as-a-fic-secretless/bicepconfig.json b/quickstart-templates/msi-as-a-fic-secretless/bicepconfig.json
@@ -4,6 +4,6 @@
     },
     // specify an alias for the version of the v1.0 dynamic types package you want to use
     "extensions": {
-      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
+      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"
     }
 }
diff --git a/quickstart-templates/msi-as-a-fic-secretless/metadata.json b/quickstart-templates/msi-as-a-fic-secretless/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Configure a secret-less application to call Microsoft Graph.",
+    "description": "This template demonstrates how to create a secret-less client application, using a user-assigned managed identity as the credential (configured as part of the application's federated identity credential). It also creates other resources, that enable you to test using the application to call Microsoft Graph, all without any application secret or certificate.",
+    "summary": "This template creates a secret-less client application, using a user-assigned managed identity as the credential.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/resource-application-access-grant-to-client-application/README.md b/quickstart-templates/resource-application-access-grant-to-client-application/README.md
@@ -1,6 +1,6 @@
 # Grant a client app access to a resource app
 
-> **Note1**: Minimum Bicep version required to deploy this quickstart template is [v0.30.3](https://github.com/Azure/bicep/releases/tag/v0.30.3).
+> **Note1**: Minimum Bicep version required to deploy this quickstart template is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 
 > **Note2**: This template depends on a successful deployment of [application-serviceprincipal-create-client-resource](../application-serviceprincipal-create-client-resource/)
 
diff --git a/quickstart-templates/resource-application-access-grant-to-client-application/bicepconfig.json b/quickstart-templates/resource-application-access-grant-to-client-application/bicepconfig.json
@@ -4,6 +4,6 @@
     },
     // specify an alias for the version of the v1.0 dynamic types package you want to use
     "extensions": {
-      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
+      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"
     }
 }
diff --git a/quickstart-templates/resource-application-access-grant-to-client-application/metadata.json b/quickstart-templates/resource-application-access-grant-to-client-application/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Grant a client app access to a resource app.",
+    "description": "This template grants client app access to resource application by assigning the app role in the resource app to the client app.",
+    "summary": "This template grants client app access to resource application by assigning the app role in the resource app to the client app.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/security-group-add-user-members/metadata.json b/quickstart-templates/security-group-add-user-members/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Configure a security group's user members.",
+    "description": "This template creates a security group and adds users, referenced via their UPNs, as members. It demonstrates use of the read-only [`Microsoft.Graph/Users` bicep type][users-ref] which allows you to fetch `user` resources by their user principal name (UPN). The list of users to be added as members are in a txt file, with each user's UPN on a separate line.",
+    "summary": "This template creates a security group and adds users, referenced via their UPNs, as members.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/security-group-assign-azure-role/README.md b/quickstart-templates/security-group-assign-azure-role/README.md
@@ -14,7 +14,7 @@ This Bicep template configures three regional user-assigned managed identities,
 
 * Ownership of a GitHub repo.
 * Have a valid **Azure subscription**: If you don't own an Azure subscription, [create a free account](https://azure.microsoft.com/free/) before you begin.
-* [Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is v0.30.3.
+* [Bicep tools for authoring and deployment](https://learn.microsoft.com/graph/templates/quickstart-install-bicep-tools). The minimum required Bicep version is [v0.32.4](https://github.com/Azure/bicep/releases/tag/v0.32.4).
 * Have a **Microsoft Entra role** that assigns you permissions to create security groups. [Users have this permission by default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#compare-member-and-guest-default-permissions). However, [admins can turn off this default](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions) in which case you need to be assigned at least the [Groups Administrator](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#groups-administrator) role.
 
 ### Deploy the Bicep template
diff --git a/quickstart-templates/security-group-assign-azure-role/bicepconfig.json b/quickstart-templates/security-group-assign-azure-role/bicepconfig.json
@@ -4,6 +4,6 @@
     },
     // specify an alias for the version of the v1.0 dynamic types package you want to use
     "extensions": {
-      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
+      "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"
     }
 }
diff --git a/quickstart-templates/security-group-assign-azure-role/main.bicep b/quickstart-templates/security-group-assign-azure-role/main.bicep
@@ -17,7 +17,7 @@ resource managedIdentities 'Microsoft.ManagedIdentity/userAssignedIdentities@202
   }
 ]
 
-// Storage resource that the clinet services need access to
+// Storage resource that the client services need access to
 resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' existing = {
   name: storageName
 }
@@ -29,7 +29,10 @@ resource storageBlobReadersGroup 'Microsoft.Graph/groups@v1.0' = {
   mailNickname: uniqueString(groupName)
   securityEnabled: true
   uniqueName: groupName
-  members: [for (mi, i) in clientServiceList: managedIdentities[i].properties.principalId]
+  members: {
+    relationshipSemantics: 'replace'
+    relationships: [for (mi, i) in clientServiceList: managedIdentities[i].properties.principalId]
+  }
 }
 
 @description('Specify the storage blob reader role definition ID')
diff --git a/quickstart-templates/security-group-assign-azure-role/metadata.json b/quickstart-templates/security-group-assign-azure-role/metadata.json
@@ -0,0 +1,12 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Configure client services' access, via a security group.",
+    "description": "This template configures three regional user-assigned managed identities, that can be used to read from a Blob Storage account, via a security group. The user-assigned managed identities are added as members of the security group, and the security group is assigned an Azure Reader role to the Blob Storage account.",
+    "summary": "This template configures client services that can be used to read from Blob storage, via a Microsoft Entra security group",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}
diff --git a/quickstart-templates/security-group-create-with-owners-and-members/metadata.json b/quickstart-templates/security-group-create-with-owners-and-members/metadata.json
@@ -0,0 +1,11 @@
+{
+    "$schema": "https://aka.ms/azure-quickstart-templates-metadata-schema#",
+    "type": "QuickStart",
+    "itemDisplayName": "Create an Entra security group with members and owners",
+    "description": "This template allows you to create a security group with members and owners. Both \"members\" and \"owners\" use the MicrosoftGraphRelationship type. The resource service principal created previously in the \"application-serviceprincipal-create-client-resource\" quickstart is added to the owners. A managed identity is created and added to the members too.",
+    "githubUsername": "dkershaw10",
+    "docOwner": "dkershaw10",
+    "dateUpdated": "2025-03-17",
+    "validationType": "Manual",
+    "languages": ["bicep"]
+}

Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,6 @@`
`4`	`4`	`},`
`5`	`5`	`// specify an alias for the version of the v1.0 dynamic types package you want to use`
`6`	`6`	`"extensions": {`
`7`		`- "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"`
	`7`	`+ "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.2.0-preview"`
`8`	`8`	`}`
`9`	`9`	`}`