Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin #4775

marrobi · 2025-11-26T17:55:22Z

Summary

Removes the requirement for users to provide a client secret when creating workspaces and eliminates the Directory.Read.All Microsoft Graph permission from the automation admin identity.

Changes

Base workspace bundle 3.0.0: Terraform now creates, imports, and manages workspace Microsoft Entra ID applications automatically, including secret rotation via azuread_application_password resources
API simplification: Removed extract_workspace_auth_information function - workspace auth info is now handled through Terraform outputs
Removed parameters: client_secret, register_aad_application, scope_id, sp_id, app_role_id_*
New script: add_automation_admin_to_workspace_application.sh for adding automation admin as workspace app owner
Permission reduction: Directory.Read.All no longer required; only Application.ReadWrite.All, Group.Create, Group.Read.All, User.ReadBasic.All, DelegatedPermissionGrant.ReadWrite.All (depending on configuration)

Migration

Existing workspaces continue to work without changes
Upgrading: Ensure Application Admin owns the workspace app, then run upgrade - Terraform will import and manage secrets automatically (needs testing)
New workspaces: No client_secret needed; optionally provide client_id to reuse an existing app

Closes #2247

Fixes microsoft#4772

…robi/issue2247

github-actions · 2025-11-26T17:57:31Z

Unit Test Results

669 tests 669 ✅ 8s ⏱️
1 suites 0 💤
1 files 0 ❌

Results for commit 6769d1a.

♻️ This comment has been updated with latest results.

Copilot

Pull request overview

This PR removes the requirement for users to provide a client secret when creating workspaces and eliminates the Directory.Read.All Microsoft Graph permission dependency from the automation admin identity. The changes introduce automatic workspace app provisioning/import via Terraform with built-in password rotation, simplify the API by removing the extract_workspace_auth_information function, and update all related documentation and scripts.

Key changes include:

Terraform now provisions or imports the workspace Entra ID app automatically with dual password rotation using azuread_application_password resources
API no longer requires Directory.Read.All permissions as workspace auth information is handled via Terraform outputs
Major version bump for base workspace bundle (2.8.0 → 3.0.0) due to breaking changes

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
templates/workspaces/base/terraform/workspace.tf	Adds import block for existing workspace apps and removes conditional AAD module creation
templates/workspaces/base/terraform/variables.tf	Removes register_aad_application and client_secret variables
templates/workspaces/base/terraform/providers.tf	Adds hashicorp/time provider for password rotation
templates/workspaces/base/terraform/outputs.tf	Simplifies outputs to always reference AAD module directly
templates/workspaces/base/terraform/keyvault.tf	Removes manual client_id and client_secret key vault secret resources
templates/workspaces/base/terraform/aad/variables.tf	Adds client_id variable, changes create_aad_groups type to bool
templates/workspaces/base/terraform/aad/providers.tf	Adds time provider requirement
templates/workspaces/base/terraform/aad/aad.tf	Implements dual password rotation with primary/secondary passwords and intelligent current password selection
templates/workspaces/base/terraform/.terraform.lock.hcl	Adds lock file entry for time provider v0.11.0
templates/workspaces/base/template_schema.json	Removes client_secret from schema and moves create_aad_groups to top level
templates/workspaces/base/porter.yaml	Major version bump to 3.0.0, removes register_aad_application and client_secret parameters
api_app/services/authentication.py	Removes extract_auth_information function
api_app/services/access_service.py	Removes extract_workspace_auth_information abstract method
api_app/services/aad_authentication.py	Removes _get_app_auth_info and extract_workspace_auth_information implementation
api_app/db/repositories/workspaces.py	Removes auth_info parameter from create_workspace_item
api_app/api/routes/workspaces.py	Removes extract_auth_information call and auth_info parameter
api_app/_version.py	Minor version bump to 0.25.5
api_app/tests_ma/test_services/test_aad_access_service.py	Removes tests for extract_workspace_auth_information
api_app/tests_ma/test_db/test_repositories/test_workpaces_repository.py	Updates test calls to remove auth_info parameter
api_app/tests_ma/test_api/test_routes/test_workspaces.py	Removes extract_auth_information mock patches
api_app/tests_ma/test_api/test_routes/test_workspace_users.py	Removes auth_info parameter from sample_workspace
docs/tre-developers/end-to-end-tests.md	Adds instructions for adding automation admin as workspace app owner
docs/tre-admins/setup-instructions/ui-install-base-workspace.md	Simplifies workspace app creation script usage
docs/tre-admins/setup-instructions/installing-base-workspace.md	Removes client_secret from workspace creation example
docs/tre-admins/setup-instructions/cicd-pre-deployment-steps.md	Removes TEST_WORKSPACE_APP_SECRET from required secrets
docs/tre-admins/identities/workspace.md	Removes client secret references and simplifies workspace app creation
docs/tre-admins/identities/application_admin.md	Updates required permissions from Directory.Read.All to Group.Read.All and User.ReadBasic.All
docs/tre-admins/environment-variables.md	Updates permission descriptions for auto workspace features
docs/tre-admins/auth.md	Updates permission descriptions and removes workspace_api_client_secret
devops/scripts/setup_local_debugging.sh	Removes TEST_WORKSPACE_APP_SECRET from environment setup
devops/scripts/create_aad_assets.sh	Removes Directory.Read.All from AUTO_WORKSPACE_APP_REGISTRATION permissions and removes automatic workspace app creation
devops/scripts/aad/wait_for_new_app_registration.sh	Minor cleanup removing echo statement
devops/scripts/aad/create_workspace_application.sh	Significantly simplified to only create minimal app registration without consent/permission setup
devops/scripts/aad/add_automation_admin_to_workspace_application.sh	New script for adding automation admin as workspace app owner
core/terraform/outputs.sh	Removes TEST_WORKSPACE_APP_SECRET from private.env
config_schema.json	Removes workspace_api_client_secret from schema
config.sample.yaml	Updates permission descriptions in comments

Files not reviewed (1)

templates/workspaces/base/terraform/.terraform.lock.hcl: Language not supported

docs/tre-admins/auth.md

config.sample.yaml

templates/workspaces/base/porter.yaml

docs/tre-admins/identities/application_admin.md

docs/tre-admins/environment-variables.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 37 out of 38 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

templates/workspaces/base/terraform/.terraform.lock.hcl: Language not supported

api_app/_version.py

templates/workspaces/base/terraform/aad/aad.tf

docs/tre-admins/identities/application_admin.md

docs/tre-admins/environment-variables.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

marrobi · 2026-01-23T09:46:04Z

/test-extended be1b46c

github-actions · 2026-01-23T09:46:19Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21281770962 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-23T12:51:08Z

/test-extended aa72c7a

github-actions · 2026-01-23T12:51:24Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21286771080 (with refid 679d0163)

(in response to this comment from @marrobi)

- Use Application Admin credentials for direct app role assignment via Graph API - Application Admin owns workspace service principals and can assign roles immediately - Direct assignment bypasses AAD group propagation delays (5-15+ min) - Revert _is_user_in_role to user-only (service principal support not needed for API) - Simplify _add_user_to_group by using _ms_graph_query helper - Update unit tests to match current implementation - Remove unused _get_assignable_user_id function and global cache

marrobi · 2026-01-23T17:10:13Z

/test-extended 49518a5

github-actions · 2026-01-23T17:10:30Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21294548197 (with refid 679d0163)

(in response to this comment from @marrobi)

- Use Application Admin credentials for direct app role assignment via Graph API - Application Admin owns workspace service principals and can assign roles immediately - Direct assignment bypasses AAD group propagation delays (5-15+ min) - Revert _is_user_in_role to user-only (service principal support not needed for API) - Simplify _add_user_to_group by using _ms_graph_query helper - Update unit tests to match current implementation - Remove unused _get_assignable_user_id function and global cache

… into marrobi/issue2247

- Add APPLICATION_ADMIN_CLIENT_ID and APPLICATION_ADMIN_CLIENT_SECRET env vars to devcontainer action - Pass APPLICATION_ADMIN secrets to E2E test steps in deploy_tre_reusable.yml

marrobi · 2026-01-23T20:37:25Z

/test-extended 5b371c5

github-actions · 2026-01-23T20:37:49Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21300416465 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-26T08:57:47Z

/test-extended 5b371c5

github-actions · 2026-01-26T08:58:00Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21351779214 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi · 2026-01-26T10:41:21Z

/test-extended 1cac0eb

github-actions · 2026-01-26T10:41:34Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21354756330 (with refid 679d0163)

(in response to this comment from @marrobi)

… into marrobi/issue2247

marrobi · 2026-01-26T23:26:24Z

/test-extended 6769d1a

github-actions · 2026-01-26T23:26:42Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/21377968136 (with refid 679d0163)

(in response to this comment from @marrobi)

marrobi added 6 commits November 25, 2025 17:14

Use Group.Create instead of Group.ReadWrite.All for group creation

8a391ec

Fixes microsoft#4772

Deployment works, permetations need testing, and docs updating.

481daf8

Update scripts and docs.

6904b72

Remove need for Directory.Read.All

c755f30

Rotating secret

9fd75cf

Merge branch 'main' of https://github.com/microsoft/AzureTRE into mar…

6114d09

…robi/issue2247

marrobi changed the title ~~Simplify Workspace Entra ID Automation and Remove Directory.Read.All Dependency~~ Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency Nov 26, 2025

marrobi linked an issue Nov 26, 2025 that may be closed by this pull request

Supply Workspace client secret without having to pass it in the API #2247

Open

3 tasks

marrobi changed the title ~~Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency~~ Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin Nov 26, 2025

marrobi linked an issue Nov 27, 2025 that may be closed by this pull request

Add docs for rotating workspace app registration secrets. #2903

Open

Merge branch 'main' into marrobi/issue2247

e7479bd

marrobi requested a review from Copilot November 27, 2025 10:34

Copilot started reviewing on behalf of marrobi November 27, 2025 10:35 View session

Copilot finished reviewing on behalf of marrobi November 27, 2025 10:38

Copilot AI reviewed Nov 27, 2025

View reviewed changes

marrobi requested review from Copilot and removed request for Copilot November 27, 2025 10:42

Update docs/tre-admins/auth.md

1b9c090

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of marrobi November 27, 2025 10:43 View session

marrobi and others added 3 commits November 27, 2025 10:44

Update docs/tre-admins/identities/application_admin.md

ccf5aee

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/tre-admins/environment-variables.md

f93845e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/tre-admins/identities/application_admin.md

b79940f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot finished reviewing on behalf of marrobi November 27, 2025 10:47

Copilot finished reviewing on behalf of marrobi November 27, 2025 10:48

Copilot AI reviewed Nov 27, 2025

View reviewed changes

Update templates/workspaces/base/terraform/aad/aad.tf

173ebd1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

marrobi assigned Copilot Nov 27, 2025

marrobi added 4 commits January 23, 2026 10:31

Restore backwards compatibility.

a2eca08

Revert some changes and highlight deprecation.

09e476d

Fix role assignemnt logic

0f98f05

fix test

aa72c7a

marrobi added 4 commits January 23, 2026 17:24

Merge branch 'marrobi/issue2247' of https://github.com/marrobi/AzureTRE…

b0e8c2d

… into marrobi/issue2247

Pass APPLICATION_ADMIN credentials to E2E tests in CI

d5028fc

- Add APPLICATION_ADMIN_CLIENT_ID and APPLICATION_ADMIN_CLIENT_SECRET env vars to devcontainer action - Pass APPLICATION_ADMIN secrets to E2E test steps in deploy_tre_reusable.yml

Switch to direct assingment

5b371c5

marrobi added 2 commits January 26, 2026 10:40

Add dependency on ampls_log_anaytics for azure_monitor_private_endpoint

3687a5f

Merge branch 'main' into marrobi/issue2247

1cac0eb

marrobi added 3 commits January 26, 2026 15:54

Update e2e helpers to verify token roles.

d6d4288

Merge branch 'marrobi/issue2247' of https://github.com/marrobi/AzureTRE…

4dc7347

… into marrobi/issue2247

blank line

6769d1a

marrobi closed this Jan 26, 2026

marrobi reopened this Jan 26, 2026

Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin #4775

Are you sure you want to change the base?

Remove need to provide client secret when creating workspace and remove Directory.Read.All Dependency from automation admin #4775

Uh oh!

Conversation

marrobi commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Migration

Uh oh!

github-actions bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marrobi commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

marrobi commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

marrobi commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

marrobi commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026

Uh oh!

marrobi commented Jan 26, 2026

Uh oh!

github-actions bot commented Jan 26, 2026

Uh oh!

marrobi commented Jan 26, 2026

Uh oh!

github-actions bot commented Jan 26, 2026

Uh oh!

marrobi commented Jan 26, 2026

Uh oh!

github-actions bot commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

marrobi commented Nov 26, 2025 •

edited

Loading

github-actions bot commented Nov 26, 2025 •

edited

Loading