Setup Blueprint with Copilot Studio Permissions

[JesuTerraz]

This pull request adds support for configuring Copilot Studio permissions in the agent setup CLI, allowing agent blueprints to invoke Copilot Studio copilots via the Power Platform API. It introduces a new copilotstudio subcommand under a365 setup permissions, updates documentation, centralizes validation logic, and ensures the new functionality is covered by unit tests.

Copilot Studio Permissions Support

• Added new CopilotStudioSubcommand implementing the copilotstudio subcommand, which configures the delegated CopilotStudio.Copilots.Invoke permission for the Power Platform API, including dry-run and verbose options. (src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/CopilotStudioSubcommand.cs)
• Registered the new subcommand with the main permissions command, so a365 setup permissions now supports copilotstudio alongside mcp and bot. (src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/PermissionsSubcommand.cs)

Documentation Updates

• Added detailed usage documentation for the new command, including prerequisites, options, examples, and troubleshooting. (docs/commands/setup/setup-permissions-copilotstudio.md, Readme-Usage.md) [1] [2]

Centralized Validation Logic

• Refactored validation logic for blueprint and permissions prerequisites into a shared helper, improving code reuse and maintainability. (src/Microsoft.Agents.A365.DevTools.Cli/Helpers/ValidationHelper.cs, removal from PermissionsSubcommand.cs) [1] [2]

Constants and Configuration

• Added new constants for the Copilot Studio permission scope and resource, and integrated them into the configuration objects. (src/Microsoft.Agents.A365.DevTools.Cli/Constants/MosConstants.cs) [1] [2] [3]

Testing

• Added unit tests for the new subcommand, verifying command structure, options, descriptions, and validation logic. Updated permissions subcommand tests to account for the new subcommand. (src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Commands/CopilotStudioSubcommandTests.cs, src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Commands/PermissionsSubcommandTests.cs) [1] [2] [3]

[Copilot]

Pull request overview

This PR adds support for configuring Copilot Studio permissions in agent blueprints, enabling them to invoke Copilot Studio copilots via the Power Platform API. The implementation follows the existing pattern for permission subcommands and centralizes validation logic for better code reuse.

Changes:

• Added CopilotStudioSubcommand to configure CopilotStudio.Copilots.Invoke delegated permission for Power Platform API
• Refactored validation logic into a shared ValidationHelper class to reduce code duplication across permission subcommands
• Updated documentation and tests to reflect the new command

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CopilotStudioSubcommand.cs	New subcommand implementing CopilotStudio permission configuration with dry-run support
PermissionsSubcommand.cs	Registered new copilotstudio subcommand and removed validation methods moved to helper
ValidationHelper.cs	New shared helper centralizing validation logic for blueprint and MCP prerequisites
MosConstants.cs	Added Power Platform API permission constants for CopilotStudio.Copilots.Invoke
CopilotStudioSubcommandTests.cs	Comprehensive unit tests for the new subcommand
PermissionsSubcommandTests.cs	Updated tests to expect 3 subcommands instead of 2
SubcommandValidationTests.cs	Updated to use ValidationHelper methods
setup-permissions-copilotstudio.md	New documentation for the copilotstudio command
Readme-Usage.md	Added copilotstudio command to usage examples

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

[Josina20]

Is someone runs setup-all will it add this permission, should we make it optional somehow? so that only if needed we add it

[JesuTerraz]

Is someone runs setup-all will it add this permission, should we make it optional somehow? so that only if needed we add it

This permission isn't added to the setup all flow:

Agent365-devTools/src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/AllSubcommand.cs

Lines 353 to 406 in 386f550

	// Step 3: MCP Permissions
	try
	{
	bool mcpPermissionSetup = await PermissionsSubcommand.ConfigureMcpPermissionsAsync(
	config.FullName,
	logger,
	configService,
	executor,
	graphApiService,
	blueprintService,
	setupConfig,
	true,
	setupResults);
	setupResults.McpPermissionsConfigured = mcpPermissionSetup;
	if (mcpPermissionSetup)
	{
	setupResults.InheritablePermissionsConfigured = setupConfig.IsInheritanceConfigured();
	}
	}
	catch (Exception mcpPermEx)
	{
	setupResults.McpPermissionsConfigured = false;
	setupResults.Errors.Add($"MCP Permissions: {mcpPermEx.Message}");
	logger.LogWarning("MCP permissions failed: {Message}. Setup will continue, but MCP server permissions must be configured manually", mcpPermEx.Message);
	}
	// Step 4: Bot API Permissions
	try
	{
	bool botPermissionSetup = await PermissionsSubcommand.ConfigureBotPermissionsAsync(
	config.FullName,
	logger,
	configService,
	executor,
	setupConfig,
	graphApiService,
	blueprintService,
	true,
	setupResults);
	setupResults.BotApiPermissionsConfigured = botPermissionSetup;
	}
	catch (Exception botPermEx)
	{
	setupResults.BotApiPermissionsConfigured = false;
	setupResults.Errors.Add($"Bot API Permissions: {botPermEx.Message}");
	logger.LogWarning("Bot permissions failed: {Message}. Setup will continue, but Bot API permissions must be configured manually", botPermEx.Message);
	}
	// Display setup summary
	logger.LogInformation("");
	SetupHelpers.DisplaySetupSummary(setupResults, logger);
	}

This permission would only be added if running a365 setup permissions copilotstudio