feat(scripts): -Features All meta-value grants every optional permission at once

All is a script-side convenience that expands to every GraphFeatureCatalog
feature (works with -Revoke too). The catalog sync test now pins All in the
ValidateSet while keeping it out of the catalog comparison, and the admin UI
mentions the shorthand next to the generated grant command.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1

@@ -28,6 +28,8 @@
         (validates Windows 365 Cloud PCs against the tenant's Cloud PC inventory --
          Cloud PCs are never Autopilot-registered, so this enables agent monitoring
          of Cloud PC first-connect enrollment)
+      - All                    -> every optional permission above, in one run
+        (also works with -Revoke to remove all optional grants at once)
 
 .PARAMETER Permissions
     Microsoft Graph application permission names to grant directly. Use when the admin UI
@@ -53,6 +55,10 @@
         -Permissions "DeviceManagementScripts.Read.All" `
         -TenantId "contoso.onmicrosoft.com"
 
+.EXAMPLE
+    # Grant every optional capability in one run:
+    .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features All
+
 .EXAMPLE
     # Verify current state only, no changes:
     .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features ScriptDisplayNames -VerifyOnly
@@ -86,7 +92,7 @@ param(
     [string]$ClientId,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByFeatures')]
-    [ValidateSet('ScriptDisplayNames', 'W365CloudPcValidation')]
+    [ValidateSet('All', 'ScriptDisplayNames', 'W365CloudPcValidation')]
     [string[]]$Features,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByPermissions')]
@@ -112,7 +118,11 @@ $FeatureCatalog = @{
 }
 
 # Translate Features -> Permissions when caller used the high-level form.
+# 'All' is a script-side meta-value: it expands to every catalog feature.
 if ($PSCmdlet.ParameterSetName -eq 'ByFeatures') {
+    if ($Features -contains 'All') {
+        $Features = @($FeatureCatalog.Keys)
+    }
     $Permissions = @()
     foreach ($f in $Features) {
         $Permissions += $FeatureCatalog[$f]

src/Backend/AutopilotMonitor.Functions.Tests/GraphFeatureCatalogSyncTests.cs

@@ -54,9 +54,13 @@ public class GraphFeatureCatalogSyncTests
             .Select(m => m.Groups["f"].Value)
             .ToArray();
 
+        // 'All' is a script-side meta-value that expands to every catalog feature — it is not
+        // (and must never become) a GraphFeatureCatalog entry, but the script must keep offering it.
+        Assert.Contains("All", scriptFeatures);
+
         Assert.Equal(
             GraphFeatureCatalog.Features.OrderBy(f => f, StringComparer.OrdinalIgnoreCase),
-            scriptFeatures.OrderBy(f => f, StringComparer.OrdinalIgnoreCase));
+            scriptFeatures.Where(f => f != "All").OrderBy(f => f, StringComparer.OrdinalIgnoreCase));
     }
 
     private static string ReadGrantScript()

src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx

@@ -246,6 +246,13 @@ export function SectionOptionalGraphCapabilities() {
             )}
           </div>
 
+          <p className="mt-3 text-xs text-gray-500">
+            Prefer the high-level form? Run the script with{" "}
+            <span className="font-mono">-Features All</span> instead of the permission list to grant every
+            optional capability in one go —{" "}
+            <span className="font-mono">-Features All -Revoke</span> removes them all again.
+          </p>
+
           <details className="mt-4 text-sm text-gray-600">
             <summary className="cursor-pointer text-gray-700 font-medium">What this script does (no surprises)</summary>
             <ul className="mt-2 list-disc list-inside space-y-1">