Harden migrated App Service samples and migrate archived Entra/RBAC security samples - #49935
Merged
weidongxu-microsoft merged 6 commits intoJul 28, 2026
Conversation
…TTPS-only) Security follow-up to Azure#49923: - ConnectWebAppToStorageAccount: remove storage account-key connection string; disable shared-key access, use system-assigned managed identity + Storage Blob Data Contributor role, expose only the blob endpoint. Convert the web app to Linux Node.js and deploy a small dependency-free managed-identity blob verifier via zipDeploy (bounded retry on HTTP 409). Re-recorded on personal sub. - All web-app samples: set httpsOnly(true) explicitly; note TLS 1.2 / FTPS-only are already App Service defaults. - Wire src/samples/resources onto the test classpath for the verifier assets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4727c5a4-1b1d-4c1d-af70-7b9e7f83f806
…sourcemanager Add ManageUsersGroupsAndRoles and ManageServicePrincipal under authorization/samples, migrated from the archived MS Learn security-samples page. ManageServicePrincipal is modernized off the retired Track 1 sample (no auth file / self-signed cert; password credential + ClientSecretCredential). Tests run live-only (@liveonly, GraphRbacSampleTests): these create Entra users/apps/service principals with secrets that must not be recorded, and SP re-auth cannot replay through the test proxy. Validated LIVE on a personal subscription; cleanup verified against an Entra before/after snapshot. Security: least-privilege Reader for the SP (only lists VMs); complete cleanup of the created application (cascades to the SP), role assignment, users and groups so nothing is orphaned. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4727c5a4-1b1d-4c1d-af70-7b9e7f83f806
github-actions
Bot
added
the
Mgmt
|
Azure Pipelines: Successfully started running 1 pipeline(s). 33 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
weidongxu-microsoft
force-pushed
the
mgmt-harden-mslearn-samples-security
branch
from
July 27, 2026 06:55
75e2ea2 to
37889a8
Compare
… pom Fixes CI 'Verify versions in POM files' failure requiring a <version> element with x-version-update tag for org.codehaus.mojo:build-helper-maven-plugin. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7882f7ff-8f5e-41d1-817d-c11ab59a2c14
weidongxu-microsoft
marked this pull request as ready for review
July 27, 2026 07:32
weidongxu-microsoft
requested review from
a team,
ArthurMa1978,
XiaofeiCao and
haolingdong-msft
as code owners
July 27, 2026 07:32
|
Azure Pipelines: Successfully started running 1 pipeline(s). 33 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR follows up on the earlier MS Learn sample migration by (1) hardening the App Service samples with secure-by-default patterns (notably HTTPS-only and passwordless managed identity for Storage) and (2) adding new Microsoft Entra ID / RBAC samples plus a live-only test suite for them.
Changes:
- Harden App Service samples: enforce HTTPS-only across web app creations and update the Storage connection sample to use system-assigned managed identity + RBAC instead of storage keys.
- Add Microsoft Entra ID / RBAC samples (users/groups/roles and service principals) and add
@LiveOnlytests to run them safely without recordings. - Update build/test wiring so sample resource files under
src/samples/resourcesare available at test runtime; update assets tag for refreshed recordings.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/resourcemanager/azure-resourcemanager/src/test/java/com/azure/resourcemanager/samples/GraphRbacSampleTests.java | Adds live-only tests for Entra/RBAC samples. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/resources/appservice/mi-blob-verify/server.js | Adds dependency-free Node verifier app for managed-identity Blob access. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/resources/appservice/mi-blob-verify/package.json | Declares start script for the verifier app. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/samples/SampleUtils.java | Adds password generator helper used by Entra samples. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/authorization/samples/package-info.java | Introduces package docs for Entra/RBAC samples. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/authorization/samples/ManageUsersGroupsAndRoles.java | New sample for creating users/groups and managing role assignments. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/authorization/samples/ManageServicePrincipal.java | New sample for creating and using a service principal with least-privilege access. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/appservice/samples/ScaleWebAppWithTrafficManager.java | Enforces HTTPS-only for created web apps. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/appservice/samples/ManageWebAppWithCustomDomain.java | Enforces HTTPS-only and documents defaults. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/appservice/samples/ManageWebAppSlots.java | Enforces HTTPS-only and documents defaults. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/appservice/samples/DeployImageFromAcrToLinuxWebApp.java | Enforces HTTPS-only and documents defaults. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/appservice/samples/ConnectWebAppToStorageAccount.java | Migrates to passwordless MI + RBAC model, deploys verifier app package. |
| sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/appservice/samples/ConnectWebAppToSqlDatabase.java | Enforces HTTPS-only and documents defaults. |
| sdk/resourcemanager/azure-resourcemanager/pom.xml | Adds src/samples/resources as test resources so samples can load packaged files. |
| sdk/resourcemanager/azure-resourcemanager/assets.json | Updates assets tag to reference refreshed recordings. |
Address bot review feedback that does not require re-recording: - ManageUsersGroupsAndRoles: guard getByName(spName) in the cleanup finally block so a null lookup (eventual consistency / name collision) no longer throws and skips remaining identity cleanup. - ConnectWebAppToStorageAccount: throw a clear FileNotFoundException when a bundled mi-blob-verify resource is missing instead of a message-less NullPointerException. These are Java-only logic changes that do not alter recorded HTTP traffic (storage sample stays playback-compatible; GraphRbac sample is @liveonly). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7882f7ff-8f5e-41d1-817d-c11ab59a2c14
Add a src/samples/README.md following the standard samples layout used by other modules (YAML front-matter + grouped, linked sample list). Lists the runnable management samples migrated from the archived MS Learn pages, grouped by service (App Service, Authorization, Compute, Container Registry, Container Service, SQL), and links to the SDK getting-started, SAMPLE.md snippets, and management SDK docs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7882f7ff-8f5e-41d1-817d-c11ab59a2c14
Add a pointer from the module README Examples section to the new src/samples/README.md listing the runnable management samples. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7882f7ff-8f5e-41d1-817d-c11ab59a2c14
XiaofeiCao
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #49923 (which migrated the archived MS Learn Java sample pages into
azure-resourcemanager). This PR:Archived source page added in this PR:
Mapping: MS Learn sample → file path
Paths are relative to
sdk/resourcemanager/azure-resourcemanager/src/samples/java/com/azure/resourcemanager/.Security (Microsoft Entra ID / RBAC) — new in this PR
authorization/samples/ManageUsersGroupsAndRoles.javaauthorization/samples/ManageServicePrincipal.java(modernized off the retired Track 1 sample — no auth file / self-signed cert)azure-resourcemanagerVirtual machines (from #49923, for context)
compute/samples/CreateVirtualMachineUsingCustomImageFromVM.javacompute/samples/CreateVirtualMachineUsingSpecializedDiskFromSnapshot.javacompute/samples/ManageVirtualMachinesInParallel.javaWeb apps
./)appservice/samples/ManageWebAppSlots.javaappservice/samples/ManageWebAppWithCustomDomain.javaappservice/samples/ScaleWebAppWithTrafficManager.javaappservice/samples/ConnectWebAppToStorageAccount.java(hardened in this PR)appservice/samples/ConnectWebAppToSqlDatabase.java(hardened in this PR)SQL Database
sql/samples/ManageSqlDatabase.javasql/samples/ManageSqlDatabasesAcrossRegions.javaContainers
containerregistry/samples/ManageContainerRegistry.javacontainerservice/samples/ManageKubernetesCluster.java(ACS retired → AKS)appservice/samples/DeployImageFromAcrToLinuxWebApp.javaSecurity hardening (App Service samples)
ConnectWebAppToStorageAccount— passwordless: grants the web app's system-assigned managed identity theStorage Blob Data Contributorrole instead of storing an account key in app settings. Re-recorded on a personalsubscription (Japan East); the recording deploys a dependency-free Node verifier that confirms managed-identity
blob access. Recording asset pushed to
Azure/azure-sdk-assets.ConnectWebAppToSqlDatabase— Microsoft Entra-only SQL Server with the web app's managed identity as admin(already in Migrate archived MS Learn Java samples into azure-resourcemanager #49923; noted here for completeness).
Security samples (Entra / RBAC): live-only, not recorded
GraphRbacSampleTests(testManageUsersGroupsAndRoles,testManageServicePrincipal) is@LiveOnly— neverrecorded — because these create real Entra users/apps/service principals with secrets that must not be persisted, and
service-principal re-authentication cannot replay through the test proxy. Both were validated LIVE on a personal
subscription; an Entra before/after snapshot confirmed complete cleanup (no leftover identities or dangling role
assignments).
ManageServicePrincipalassigns Reader (only lists VMs), not Contributor.and groups — nothing orphaned.
Verification
spotless:check/checkstyle:check.