From e612c691782d1da3120bc274270761c03de4bf09 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Fri, 21 Aug 2026 19:27:51 +0200 Subject: [PATCH] feat(web): feature-form default for the grant command + docs link The generated PowerShell command now uses the readable -Features form (first catalog feature as the example) instead of raw permission strings; a note below lists all available values incl. the All meta-feature and how to fall back to -Permissions via Copy permissions. The section links to the Optional Graph Permissions customer docs (via DOCS_URL registry), and the "What this script does" bullet reflects the Cloud Shell ambient-identity sign-in. Script help no longer claims the admin UI generates the -Permissions form. Co-Authored-By: Claude Fable 5 --- .../Grant-AutopilotMonitorAddOn.ps1 | 7 +++-- .../SectionOptionalGraphCapabilities.tsx | 31 ++++++++++++++----- 2 files changed, 27 insertions(+), 11 deletions(-) diff --git a/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1 b/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1 index d320097d..fe8b5ab0 100644 --- a/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1 +++ b/scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1 @@ -32,8 +32,9 @@ (also works with -Revoke to remove all optional grants at once) .PARAMETER Permissions - Microsoft Graph application permission names to grant directly. Use when the admin UI - rendered a copy-paste command for you, or when you have a specific list in mind. + Microsoft Graph application permission names to grant directly. Use when you copied the + permission list from the admin UI ("Copy permissions"), or when you have a specific list + in mind. .PARAMETER TenantId Tenant ID (GUID) or verified domain. Optional -- defaults to the signed-in context. @@ -49,7 +50,7 @@ .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "" -Features ScriptDisplayNames .EXAMPLE - # Same effect, using the explicit-permission form (what the admin UI generates): + # Same effect, using the explicit-permission form: .\Grant-AutopilotMonitorAddOn.ps1 ` -ClientId "" ` -Permissions "DeviceManagementScripts.Read.All" ` diff --git a/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx b/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx index a085d655..2f235669 100644 --- a/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx +++ b/src/Web/autopilot-monitor-web/app/settings/tenant/sections/SectionOptionalGraphCapabilities.tsx @@ -4,7 +4,7 @@ import { useCallback, useEffect, useState } from "react"; import { useAuth } from "../../../../contexts/AuthContext"; import { useTenant } from "../../../../contexts/TenantContext"; import { api } from "@/lib/api"; -import { AGENT_DOWNLOAD_URL } from "@/utils/config"; +import { AGENT_DOWNLOAD_URL, DOCS_URL } from "@/utils/config"; import { authenticatedFetch } from "@/lib/authenticatedFetch"; import { trackEvent } from "@/lib/appInsights"; @@ -116,10 +116,13 @@ export function SectionOptionalGraphCapabilities() { const featureRows = status?.features ?? []; const allPermissions = Array.from(new Set(featureRows.flatMap(f => f.requiredPermissions))); const allPermissionsLine = allPermissions.map(p => `"${p}"`).join(","); + const featureNames = featureRows.map(f => f.name); + const exampleFeature = featureNames[0] ?? "ScriptDisplayNames"; const scriptDownloadUrl = `${AGENT_DOWNLOAD_URL}/Grant-AutopilotMonitorAddOn.ps1`; + const docsUrl = `${DOCS_URL}/reference/optional-graph-permissions`; const psCommand = status?.clientId - ? `irm '${scriptDownloadUrl}' -OutFile .\\Grant-AutopilotMonitorAddOn.ps1\n.\\Grant-AutopilotMonitorAddOn.ps1 \`\n -ClientId "${status.clientId}" \`\n -Permissions ${allPermissionsLine} \`\n -TenantId "${tenantId ?? ""}"` + ? `irm '${scriptDownloadUrl}' -OutFile .\\Grant-AutopilotMonitorAddOn.ps1\n.\\Grant-AutopilotMonitorAddOn.ps1 \`\n -ClientId "${status.clientId}" \`\n -Features ${exampleFeature} \`\n -TenantId "${tenantId ?? ""}"` : ""; return ( @@ -133,7 +136,16 @@ export function SectionOptionalGraphCapabilities() { additional permissions on the Autopilot Monitor service principal in your tenant. Grant them at any time by running the small Grant-AutopilotMonitorAddOn.ps1{" "}script with a Global Administrator (or Privileged Role Administrator) sign-in — the script does not change - the published app manifest, only your tenant's local grant. + the published app manifest, only your tenant's local grant. See the{" "} + + Optional Graph Permissions documentation + {" "} + for the full walkthrough.

@@ -247,16 +259,19 @@ export function SectionOptionalGraphCapabilities() {

- Prefer the high-level form? Run the script with{" "} - -Features All instead of the permission list to grant every - optional capability in one go —{" "} - -Features All -Revoke removes them all again. + The command above grants the {exampleFeature}{" "}capability. + Swap the -Features value as needed — available:{" "} + {[...featureNames, "All"].join(", ")}, where{" "} + All grants every optional capability in one go and{" "} + -Features All -Revoke removes them all again. If you prefer raw + permission strings, pass -Permissions with the list from{" "} + Copy permissions.

What this script does (no surprises)
    -
  • Signs in to Microsoft Graph with delegated permissions AppRoleAssignment.ReadWrite.All + Application.Read.All.
    • +
  • Signs in to Microsoft Graph — in Azure Cloud Shell via the ambient identity of the signed-in admin (no device-code prompt), elsewhere interactively with delegated permissions AppRoleAssignment.ReadWrite.All + Application.Read.All.
  • Finds the Autopilot Monitor service principal in your tenant (by ClientId above).
  • Adds an appRoleAssignment for each listed Graph permission, only if missing.
  • Never touches the published app manifest. Revoke at any time via -Revoke.