Infer --m365 for blueprint/cleanup endpoint operations; address review comments

- setup blueprint --endpoint-only / --update-endpoint and cleanup blueprint
  --endpoint-only now infer --m365 (these always use the Teams Graph path), so
  the flag is no longer required; removed the non-M365 skip branches and the
  LogNonM365EndpointGuidance helper.
- Reword TeamsGraphBackendConfigurator error logs from "backend configuration"
  to "messaging endpoint" (Grant review comment).
- Sweep now-redundant --m365 from user-facing guidance, option help, README,
  and CHANGELOG; tighten the CHANGELOG --m365 entry to the shipped end state.
- Replace the WithoutM365 exit-1 test with one asserting endpoint-only infers
  --m365 and registers.

Author: sellakumaran

CHANGELOG.md

@@ -40,7 +40,7 @@ Agents provisioned before this release need `Agent365.Observability.OtelWrite` g
 - `setup requirements` runs without `a365.config.json` — system checks (PowerShell modules, Frontier enrollment) always run; client app checks run when a config file or Azure CLI session is available.
 - `--agent-name` and `--tenant-id` options added to `setup blueprint`, `setup permissions` (all subcommands), `create-instance`, `publish`, and `query-entra` — all commands can now resolve configuration from Entra ID without requiring `a365.config.json`.
 - `setup permissions custom --resource-app-id <guid> --scopes <scopes>` — apply inline custom API permissions to the agent blueprint without editing `a365.config.json`.
-- `--m365` opt-in flag on `a365 setup blueprint`, `a365 cleanup blueprint`, and `a365 setup all` — when set, the CLI registers or clears the agent blueprint's messaging endpoint via the Teams Graph backend configuration endpoint on MCP Platform. Default is **off**: without `--m365`, endpoint registration is skipped and the CLI points users at the Teams Developer Portal (https://learn.microsoft.com/en-us/microsoft-agent-365/developer/create-instance#1-configure-agent-in-teams-developer-portal) for manual configuration. Intended for M365 agents; opt-in because the Teams Graph rollout on MCP Platform is ongoing.
+- `--m365` opt-in flag on `a365 setup all` registers the agent blueprint's messaging endpoint via Teams Graph (MCP Platform); off by default, the step is skipped and you're pointed at the Teams Developer Portal. `setup blueprint --endpoint-only` / `--update-endpoint` and `cleanup blueprint --endpoint-only` always use this path and don't need the flag.
 - `--messaging-endpoint <url>` on `setup all` and `setup blueprint --endpoint-only` — supply the agent's HTTPS messaging endpoint directly; interactive `setup all --m365` prompts for it when none is configured.
 - Messaging endpoint row added to `a365 setup all` summary output, with "registered"/"reused"/"skipped (non-M365)"/"manual config required"/"failed" states. When registration can't complete, the summary surfaces an "Action Required" entry with the Teams Developer Portal URL so the user knows exactly what to do next.
 - Defensive fallback when the server rejects the new request with a known contract-mismatch signature — the CLI logs `"Automated messaging endpoint registration is not available for this tenant yet. You'll need to configure it manually."` and directs the user to the Teams Developer Portal. Same user-facing path is reused when registration fails because the signed-in user is not a blueprint owner.

src/Microsoft.Agents.A365.DevTools.Cli/Commands/CleanupCommand.cs

@@ -196,10 +196,10 @@ private static Command CreateBlueprintCleanupCommand(
 
         var m365Option = new Option<bool>(
             new[] { "--m365" },
-            description: "Only meaningful with --endpoint-only. When set, clears the messaging endpoint from " +
-                        "Teams Graph via MCP Platform. Default is false (opt-in). Ignored (with a warning) " +
-                        "for full blueprint cleanup, since deleting the blueprint application cascades to " +
-                        "the backend configuration on the server side.");
+            description: "Treat this agent as an M365 agent. Optional — --endpoint-only already clears the " +
+                        "messaging endpoint via Teams Graph automatically. Ignored (with a warning) for full " +
+                        "blueprint cleanup, since deleting the blueprint application removes the messaging " +
+                        "endpoint on the server side.");
 
         var dryRunOption = new Option<bool>("--dry-run", "Show what would be deleted without making any changes");
 
@@ -224,6 +224,10 @@ private static Command CreateBlueprintCleanupCommand(
             var dryRun = context.ParseResult.GetValueForOption(dryRunOption);
             var endpointOnly = context.ParseResult.GetValueForOption(endpointOnlyOption);
             var isM365 = context.ParseResult.GetValueForOption(m365Option);
+            // Endpoint clearing goes through Teams Graph (the M365 path), so infer --m365 for
+            // --endpoint-only — users shouldn't have to pass it (mirrors 'setup blueprint').
+            if (endpointOnly)
+                isM365 = true;
             var yes = context.ParseResult.GetValueForOption(yesOption);
             var ct = context.GetCancellationToken();
 
@@ -276,15 +280,9 @@ private static Command CreateBlueprintCleanupCommand(
                     agentBlueprintService.CustomClientAppId = config.ClientAppId;
                 }
 
-                // If endpoint-only mode, only delete the messaging endpoint — gated on --m365.
+                // Endpoint-only: clear just the messaging endpoint (--m365 is inferred above).
                 if (endpointOnly)
                 {
-                    if (!isM365)
-                    {
-                        SetupSubcommands.BlueprintSubcommand.LogNonM365EndpointGuidance(logger, "clear");
-                        return;
-                    }
-
                     await ExecuteEndpointOnlyCleanupAsync(logger, config, backendConfigurator, correlationId: correlationId);
                     return;
                 }
@@ -294,9 +292,9 @@ private static Command CreateBlueprintCleanupCommand(
                 if (isM365)
                 {
                     logger.LogWarning(
-                        "--m365 has no effect on full blueprint cleanup. The Teams Graph backend " +
-                        "configuration is removed automatically when the blueprint is deleted. " +
-                        "Use 'a365 cleanup blueprint --endpoint-only --m365' to clear the endpoint " +
+                        "--m365 has no effect on full blueprint cleanup. The messaging endpoint is " +
+                        "removed automatically when the blueprint is deleted. " +
+                        "Use 'a365 cleanup blueprint --endpoint-only' to clear the endpoint " +
                         "while preserving the blueprint.");
                 }
 
@@ -529,10 +527,10 @@ private static Command CreateBlueprintCleanupCommand(
 
                 logger.LogInformation("Agent blueprint application deleted successfully");
 
-                // Teams Graph backend configuration is a child resource of the blueprint and is
-                // removed on the server side when the blueprint is deleted. No separate clear
-                // call is needed here. Use `a365 cleanup blueprint --endpoint-only --m365` to
-                // clear just the backend configuration while preserving the blueprint.
+                // The messaging endpoint is a child resource of the blueprint and is removed on the
+                // server side when the blueprint is deleted. No separate clear call is needed here.
+                // Use `a365 cleanup blueprint --endpoint-only` to clear just the messaging endpoint
+                // while preserving the blueprint.
                 PrintOrphanSummary(logger, failedResources);
 
                 // Clear configuration after successful blueprint deletion

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/AllSubcommand.cs

@@ -162,7 +162,7 @@ public static Command CreateCommand(
                         "When supplied, the endpoint is registered as part of setup. When omitted, an\n" +
                         "interactive run prompts for it and a non-interactive run defers it — the endpoint\n" +
                         "is a post-deploy artifact, so it can be set later with\n" +
-                        "'a365 setup blueprint --endpoint-only --m365 --messaging-endpoint <url>'.");
+                        "'a365 setup blueprint --endpoint-only --messaging-endpoint <url>'.");
 
         command.AddOption(verboseOption);
         command.AddOption(dryRunOption);
@@ -887,7 +887,7 @@ internal static async Task ExecuteMessagingEndpointStepAsync(SetupContext ctx)
             ctx.Results.MessagingEndpointResult = Models.EndpointRegistrationResult.Failed;
             ctx.Results.MessagingEndpointFailureReason = MessagingEndpointFailureReasons.BlueprintMissing;
             ctx.Results.MessagingEndpoint = ctx.Config.MessagingEndpoint;
-            ctx.Results.Warnings.Add("Messaging endpoint: agent blueprint ID is missing, so endpoint registration was not attempted. Resolve the blueprint creation failure first, then re-run 'a365 setup blueprint --endpoint-only --m365'.");
+            ctx.Results.Warnings.Add("Messaging endpoint: agent blueprint ID is missing, so endpoint registration was not attempted. Resolve the blueprint creation failure first, then re-run 'a365 setup blueprint --endpoint-only'.");
             return;
         }
 

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/BlueprintSubcommand.cs

@@ -172,9 +172,9 @@ public static Command CreateCommand(
 
         var m365Option = new Option<bool>(
             "--m365",
-            description: "Treat this agent as an M365 agent. Only affects --endpoint-only and --update-endpoint " +
-                        "on this command. To configure the messaging endpoint as part of full setup, use " +
-                        "'a365 setup all --m365'.");
+            description: "Treat this agent as an M365 agent. Optional on this command — --endpoint-only and " +
+                        "--update-endpoint already use the M365 (Teams Graph) path automatically. To configure " +
+                        "the messaging endpoint as part of full setup, use 'a365 setup all --m365'.");
 
         var showSecretOption = new Option<bool>(
             "--show-secret",
@@ -210,6 +210,11 @@ public static Command CreateCommand(
             var messagingEndpointFlag = context.ParseResult.GetValueForOption(messagingEndpointOption)?.Trim();
             var skipRequirements = context.ParseResult.GetValueForOption(skipRequirementsOption);
             var isM365 = context.ParseResult.GetValueForOption(m365Option);
+            // Endpoint operations always go through Teams Graph (the M365 path), so infer --m365 for
+            // --endpoint-only / --update-endpoint — users shouldn't have to pass it. ('setup all' keeps
+            // --m365 explicit because there it also affects the granted permission set.)
+            if (endpointOnly || !string.IsNullOrWhiteSpace(updateEndpoint))
+                isM365 = true;
             var showSecret = context.ParseResult.GetValueForOption(showSecretOption);
             var ct = context.GetCancellationToken();
 
@@ -357,15 +362,9 @@ public static Command CreateCommand(
             // target the correct national cloud endpoint (commercial by default).
             graphApiService.GraphBaseUrl = setupConfig.GraphBaseUrl;
 
-            // Handle --update-endpoint flag
+            // Handle --update-endpoint flag (--m365 is inferred for endpoint operations).
             if (!string.IsNullOrWhiteSpace(updateEndpoint))
             {
-                if (!isM365)
-                {
-                    LogNonM365EndpointGuidance(logger, "update");
-                    return;
-                }
-
                 await UpdateEndpointAsync(
                     config.FullName,
                     updateEndpoint,
@@ -405,18 +404,12 @@ await RequirementsSubcommand.RunChecksOrExitAsync(
             {
                 logger.LogInformation(
                     "Note: --m365 has no effect on 'setup blueprint' by itself. Use 'a365 setup all --m365' to register the messaging endpoint, " +
-                    "or 'a365 setup blueprint --endpoint-only --m365' after the blueprint exists.");
+                    "or 'a365 setup blueprint --endpoint-only' after the blueprint exists.");
             }
 
-            // Handle --endpoint-only flag — only wired up for --m365 agents.
+            // Handle --endpoint-only flag (--m365 is inferred for endpoint operations).
             if (endpointOnly)
             {
-                if (!isM365)
-                {
-                    LogNonM365EndpointGuidance(logger, "register");
-                    return;
-                }
-
                 var endpointResult = await RegisterEndpointAndSyncAsync(
                     config.FullName,
                     logger,
@@ -462,22 +455,6 @@ await CreateBlueprintImplementationAsync(
         return command;
     }
 
-    /// <summary>
-    /// Logs the standard "non-M365 agent" message directing the user to configure the messaging
-    /// endpoint in the Teams Developer Portal. Used when the user did not pass --m365 on commands
-    /// that would otherwise call into the Teams Graph backend configurator.
-    /// </summary>
-    /// <param name="logger">Logger instance.</param>
-    /// <param name="action">Either "register" or "update" — included in the skip message.</param>
-    internal static void LogNonM365EndpointGuidance(ILogger logger, string action)
-    {
-        logger.LogInformation(
-            "Skipping messaging endpoint {Action} — this command only applies to M365 agents. " +
-            "Pass --m365 to opt in, or configure the endpoint manually in the Teams Developer Portal:",
-            action);
-        logger.LogInformation("  {Url}", Constants.ConfigConstants.TeamsDeveloperPortalConfigureEndpointUrl);
-    }
-
     /// <summary>
     /// Validates that mutually exclusive command options are not used together.
     /// </summary>

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/README.md

@@ -96,22 +96,21 @@ a365 setup all --authmode both
 
 ### Messaging endpoint (M365 agents)
 
-The `--m365` flag opts into registering the messaging endpoint with Teams Graph via MCP Platform. It is **off by default** — without it, `--endpoint-only`, `--update-endpoint`, and the messaging-endpoint step in `setup all` skip the API call and point you at the Teams Developer Portal for manual configuration.
+The `--m365` flag opts into registering the messaging endpoint with Teams Graph via MCP Platform. On `setup all` it is **off by default** — without it, the messaging-endpoint step is skipped and you're pointed at the Teams Developer Portal for manual configuration. The `--endpoint-only` and `--update-endpoint` operations always use the Teams Graph path, so `--m365` is inferred there and doesn't need to be passed.
 
 ```bash
 # Full setup including messaging endpoint registration
 a365 setup all --m365
 
-# Register the messaging endpoint only (existing blueprint)
-a365 setup blueprint --endpoint-only --m365
+# Register the messaging endpoint only (existing blueprint; --m365 is inferred)
+a365 setup blueprint --endpoint-only
 
 # Update the endpoint URL (clears and re-registers)
-a365 setup blueprint --update-endpoint https://your-host.example.com/api/messages --m365
-
-# Non-M365 agent: CLI prints the Teams Developer Portal link and skips the API call
-a365 setup blueprint --endpoint-only
+a365 setup blueprint --update-endpoint https://your-host.example.com/api/messages
 ```
 
+If the tenant's Teams Graph backend can't service the request, the CLI logs a contract-mismatch notice and points to the Teams Developer Portal for manual configuration.
+
 When the server rejects the request with a recognized contract-mismatch signature (today: the pre-migration Azure Bot Service validator), the CLI logs at INFO:
 
 ```

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/SetupHelpers.cs

@@ -900,20 +900,20 @@ public static void DisplaySetupSummary(SetupResults results, ILogger logger)
                     logger.LogInformation("");
                     logger.LogInformation("     B. Ask the blueprint owner to add you as a co-owner, then re-run just");
                     logger.LogInformation("        the endpoint step (no need to re-run the full setup):");
-                    logger.LogInformation("          a365 setup blueprint --endpoint-only --m365");
+                    logger.LogInformation("          a365 setup blueprint --endpoint-only");
                 }
                 else if (string.Equals(results.MessagingEndpointFailureReason, MessagingEndpointFailureReasons.BlueprintMissing, StringComparison.Ordinal))
                 {
                     logger.LogInformation("  {N}. Messaging endpoint — not attempted because agent blueprint creation did not", actionCount);
                     logger.LogInformation("     complete. Resolve the blueprint step (see errors above), then re-run just");
                     logger.LogInformation("     the endpoint step:");
-                    logger.LogInformation("       a365 setup blueprint --endpoint-only --m365");
+                    logger.LogInformation("       a365 setup blueprint --endpoint-only");
                 }
                 else
                 {
                     logger.LogInformation("  {N}. Messaging endpoint — registration failed; see the error above for details.", actionCount);
                     logger.LogInformation("     To retry after addressing the issue, re-run just the endpoint step:");
-                    logger.LogInformation("       a365 setup blueprint --endpoint-only --m365");
+                    logger.LogInformation("       a365 setup blueprint --endpoint-only");
                     logger.LogInformation("");
                     logger.LogInformation("     Or configure the endpoint manually in the Teams Developer Portal:");
                     logger.LogInformation("       {Url}", ConfigConstants.TeamsDeveloperPortalConfigureEndpointUrl);
@@ -989,7 +989,7 @@ public static void DisplaySetupSummary(SetupResults results, ILogger logger)
                 nextStepLines.Add(() =>
                 {
                     logger.LogInformation("  Messaging endpoint — set it once your agent is deployed:");
-                    logger.LogInformation("    a365 setup blueprint --endpoint-only --m365 --messaging-endpoint <https-url>");
+                    logger.LogInformation("    a365 setup blueprint --endpoint-only --messaging-endpoint <https-url>");
                     logger.LogInformation("  Or register it manually in the Teams Developer Portal:");
                     logger.LogInformation("    {Url}", ConfigConstants.TeamsDeveloperPortalConfigureEndpointUrl);
                 });

src/Microsoft.Agents.A365.DevTools.Cli/Services/TeamsGraphBackendConfigurator.cs

@@ -52,7 +52,7 @@ public TeamsGraphBackendConfigurator(
 
             if (string.IsNullOrEmpty(tenantId))
             {
-                _logger.LogError("Could not determine tenant ID for backend configuration");
+                _logger.LogError("Could not determine tenant ID to register the messaging endpoint.");
                 return (EndpointRegistrationResult.Failed, "Other");
             }
 
@@ -124,7 +124,7 @@ public TeamsGraphBackendConfigurator(
                     return (EndpointRegistrationResult.SkippedContractMismatch, null);
                 }
 
-                _logger.LogError("Failed to set backend configuration. Status: {Status}", response.StatusCode);
+                _logger.LogError("Failed to register the messaging endpoint. Status: {Status}", response.StatusCode);
                 _logger.LogError("Response: {Error}", errorContent);
                 return (EndpointRegistrationResult.Failed, ClassifyFailureReason(errorContent));
             }
@@ -143,7 +143,7 @@ public TeamsGraphBackendConfigurator(
         }
         catch (Exception ex)
         {
-            _logger.LogError(ex, "Unexpected error setting backend configuration: {Message}", ex.Message);
+            _logger.LogError(ex, "Unexpected error registering the messaging endpoint: {Message}", ex.Message);
             return (EndpointRegistrationResult.Failed, ClassifyFailureReason(ex.Message));
         }
     }
@@ -164,7 +164,7 @@ public async Task<bool> ClearBackendConfigurationAsync(
 
             if (string.IsNullOrEmpty(tenantId))
             {
-                _logger.LogError("Could not determine tenant ID for backend configuration");
+                _logger.LogError("Could not determine tenant ID to remove the messaging endpoint.");
                 return false;
             }
 
@@ -267,7 +267,7 @@ public async Task<bool> ClearBackendConfigurationAsync(
         }
         catch (Exception ex)
         {
-            _logger.LogError(ex, "Unexpected error clearing backend configuration: {Message}", ex.Message);
+            _logger.LogError(ex, "Unexpected error removing the messaging endpoint: {Message}", ex.Message);
             return false;
         }
     }