From e214e8dc1a58f3159bed771ee2affe46a3582437 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Fri, 21 Aug 2026 18:32:48 +0200
Subject: [PATCH] feat(scripts): -Features All meta-value grants every optional
 permission at once

All is a script-side convenience that expands to every GraphFeatureCatalog
feature (works with -Revoke too). The catalog sync test now pins All in the
ValidateSet while keeping it out of the catalog comparison, and the admin UI
mentions the shorthand next to the generated grant command.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../CustomerSetup/Grant-AutopilotMonitorAddOn.ps1    | 12 +++++++++++-
 .../GraphFeatureCatalogSyncTests.cs                  |  6 +++++-
 .../sections/SectionOptionalGraphCapabilities.tsx    |  7 +++++++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1 b/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1
index 4b20e0fb..d320097d 100644
--- a/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1
+++ b/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1
@@ -28,6 +28,8 @@
         (validates Windows 365 Cloud PCs against the tenant's Cloud PC inventory --
          Cloud PCs are never Autopilot-registered, so this enables agent monitoring
          of Cloud PC first-connect enrollment)
+      - All                    -> every optional permission above, in one run
+        (also works with -Revoke to remove all optional grants at once)
 
 .PARAMETER Permissions
     Microsoft Graph application permission names to grant directly. Use when the admin UI
@@ -53,6 +55,10 @@
         -Permissions "DeviceManagementScripts.Read.All" `
         -TenantId "contoso.onmicrosoft.com"
 
+.EXAMPLE
+    # Grant every optional capability in one run:
+    .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features All
+
 .EXAMPLE
     # Verify current state only, no changes:
     .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features ScriptDisplayNames -VerifyOnly
@@ -86,7 +92,7 @@ param(
     [string]$ClientId,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByFeatures')]
-    [ValidateSet('ScriptDisplayNames', 'W365CloudPcValidation')]
+    [ValidateSet('All', 'ScriptDisplayNames', 'W365CloudPcValidation')]
     [string[]]$Features,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByPermissions')]
@@ -112,7 +118,11 @@ $FeatureCatalog = @{
 }
 
 # Translate Features -> Permissions when caller used the high-level form.
+# 'All' is a script-side meta-value: it expands to every catalog feature.
 if ($PSCmdlet.ParameterSetName -eq 'ByFeatures') {
+    if ($Features -contains 'All') {
+        $Features = @($FeatureCatalog.Keys)
+    }
     $Permissions = @()
     foreach ($f in $Features) {
         $Permissions += $FeatureCatalog[$f]
diff --git a/src/Backend/AutopilotMonitor.Functions.Tests/GraphFeatureCatalogSyncTests.cs b/src/Backend/AutopilotMonitor.Functions.Tests/GraphFeatureCatalogSyncTests.cs
index ddc338aa..b1bb1015 100644
--- a/src/Backend/AutopilotMonitor.Functions.Tests/GraphFeatureCatalogSyncTests.cs
+++ b/src/Backend/AutopilotMonitor.Functions.Tests/GraphFeatureCatalogSyncTests.cs
@@ -54,9 +54,13 @@ public class GraphFeatureCatalogSyncTests
             .Select(m => m.Groups["f"].Value)
             .ToArray();
 
+        // 'All' is a script-side meta-value that expands to every catalog feature — it is not
+        // (and must never become) a GraphFeatureCatalog entry, but the script must keep offering it.
+        Assert.Contains("All", scriptFeatures);
+
         Assert.Equal(
             GraphFeatureCatalog.Features.OrderBy(f => f, StringComparer.OrdinalIgnoreCase),
-            scriptFeatures.OrderBy(f => f, StringComparer.OrdinalIgnoreCase));
+            scriptFeatures.Where(f => f != "All").OrderBy(f => f, StringComparer.OrdinalIgnoreCase));
     }
 
     private static string ReadGrantScript()
diff --git a/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx b/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx
index fdfe7b8c..a085d655 100644
--- a/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx
+++ b/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx
@@ -246,6 +246,13 @@ export function SectionOptionalGraphCapabilities() {
             )}
           </div>
 
+          <p className="mt-3 text-xs text-gray-500">
+            Prefer the high-level form? Run the script with{" "}
+            <span className="font-mono">-Features All</span> instead of the permission list to grant every
+            optional capability in one go —{" "}
+            <span className="font-mono">-Features All -Revoke</span> removes them all again.
+          </p>
+
           <details className="mt-4 text-sm text-gray-600">
             <summary className="cursor-pointer text-gray-700 font-medium">What this script does (no surprises)</summary>
             <ul className="mt-2 list-disc list-inside space-y-1">