Fix graph consent Issue (#216)

* Fix graph consent Issue

* code review

---------

Co-authored-by: Josina Joy <josjoy@microsoft.com>

Author: Josina20

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/AllSubcommand.cs

@@ -308,6 +308,19 @@ public static Command CreateCommand(
                         setupResults.Errors.Add("Messaging endpoint registration failed");
                     }
 
+                    // Track Graph permissions status - critical for agent token exchange
+                    setupResults.GraphPermissionsConfigured = result.GraphPermissionsConfigured;
+                    if (result.GraphInheritablePermissionsFailed)
+                    {
+                        setupResults.GraphInheritablePermissionsError = result.GraphInheritablePermissionsError 
+                            ?? "Microsoft Graph inheritable permissions failed to configure";
+                        setupResults.Warnings.Add($"Microsoft Graph inheritable permissions: {setupResults.GraphInheritablePermissionsError}");
+                    }
+                    else
+                    {
+                        setupResults.GraphInheritablePermissionsConfigured = true;
+                    }
+
                     if (!result.BlueprintCreated)
                     {
                         throw new GraphApiException(
@@ -393,6 +406,10 @@ public static Command CreateCommand(
                         setupResults);
 
                     setupResults.BotApiPermissionsConfigured = botPermissionSetup;
+                    if (botPermissionSetup)
+                    {
+                        setupResults.BotInheritablePermissionsConfigured = setupConfig.IsBotInheritanceConfigured();
+                    }
                 }
                 catch (Exception botPermEx)
                 {

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/BlueprintSubcommand.cs

@@ -33,6 +33,20 @@ internal class BlueprintCreationResult
     /// Indicates whether endpoint registration was attempted (vs. skipped via --no-endpoint or missing config)
     /// </summary>
     public bool EndpointRegistrationAttempted { get; set; }
+
+    /// <summary>
+    /// Indicates whether Graph admin consent (OAuth2 permissions) was granted.
+    /// </summary>
+    public bool GraphPermissionsConfigured { get; set; }
+    /// <summary>
+    /// Indicates whether Graph inheritable permissions failed to be configured.
+    /// This is critical for agent token exchange functionality.
+    /// </summary>
+    public bool GraphInheritablePermissionsFailed { get; set; }
+    /// <summary>
+    /// Error message when Graph inheritable permissions fail.
+    /// </summary>
+    public string? GraphInheritablePermissionsError { get; set; }
 }
 
 /// <summary>
@@ -589,7 +603,10 @@ await CreateBlueprintClientSecretAsync(
             BlueprintAlreadyExisted = blueprintAlreadyExisted,
             EndpointRegistered = endpointRegistered,
             EndpointAlreadyExisted = endpointAlreadyExisted,
-            EndpointRegistrationAttempted = !skipEndpointRegistration
+            EndpointRegistrationAttempted = !skipEndpointRegistration,
+            GraphPermissionsConfigured = blueprintResult.graphPermissionsConfigured,
+            GraphInheritablePermissionsFailed = blueprintResult.graphInheritablePermissionsFailed,
+            GraphInheritablePermissionsError = blueprintResult.graphInheritablePermissionsError
         };
     }
 
@@ -649,9 +666,9 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
     /// Implements displayName-first discovery for idempotency: always searches by displayName from a365.config.json (the source of truth).
     /// Cached objectIds are only used for dependent resources (FIC, etc.) after blueprint existence is confirmed.
     /// Used by: BlueprintSubcommand and A365SetupRunner Phase 2.2
-    /// Returns: (success, appId, objectId, servicePrincipalId, alreadyExisted)
+    /// Returns: (success, appId, objectId, servicePrincipalId, alreadyExisted, graphPermissionsConfigured, graphInheritablePermissionsFailed, graphInheritablePermissionsError)
     /// </summary>
-    public static async Task<(bool success, string? appId, string? objectId, string? servicePrincipalId, bool alreadyExisted)> CreateAgentBlueprintAsync(
+    public static async Task<(bool success, string? appId, string? objectId, string? servicePrincipalId, bool alreadyExisted, bool graphPermissionsConfigured, bool graphInheritablePermissionsFailed, string? graphInheritablePermissionsError)> CreateAgentBlueprintAsync(
         ILogger logger,
         CommandExecutor executor,
         GraphApiService graphApiService,
@@ -736,7 +753,7 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
             {
                 logger.LogError("Existing blueprint found but required identifiers are missing (AppId: {AppId}, ObjectId: {ObjectId})", 
                     existingAppId, existingObjectId);
-                return (false, null, null, null, alreadyExisted: false);
+                return (false, null, null, null, alreadyExisted: false, graphPermissionsConfigured: false, graphInheritablePermissionsFailed: false, graphInheritablePermissionsError: null);
             }
 
             return await CompleteBlueprintConfigurationAsync(
@@ -812,7 +829,7 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
             if (string.IsNullOrEmpty(graphToken))
             {
                 logger.LogError("Failed to extract access token from Graph client");
-                return (false, null, null, null, alreadyExisted: false);
+                return (false, null, null, null, alreadyExisted: false, graphPermissionsConfigured: false, graphInheritablePermissionsFailed: false, graphInheritablePermissionsError: null);
             }
 
             // Create the application using Microsoft Graph SDK
@@ -857,13 +874,13 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
                     {
                         errorContent = await appResponse.Content.ReadAsStringAsync(ct);
                         logger.LogError("Failed to create application (fallback): {Status} - {Error}", appResponse.StatusCode, errorContent);
-                        return (false, null, null, null, alreadyExisted: false);
+                        return (false, null, null, null, alreadyExisted: false, graphPermissionsConfigured: false, graphInheritablePermissionsFailed: false, graphInheritablePermissionsError: null);
                     }
                 }
                 else
                 {
                     logger.LogError("Failed to create application: {Status} - {Error}", appResponse.StatusCode, errorContent);
-                    return (false, null, null, null, alreadyExisted: false);
+                    return (false, null, null, null, alreadyExisted: false, graphPermissionsConfigured: false, graphInheritablePermissionsFailed: false, graphInheritablePermissionsError: null);
                 }
             }
 
@@ -893,7 +910,7 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
             if (!appAvailable)
             {
                 logger.LogError("Application object not available after creation and retries. Aborting setup.");
-                return (false, null, null, null, alreadyExisted: false);
+                return (false, null, null, null, alreadyExisted: false, graphPermissionsConfigured: false, graphInheritablePermissionsFailed: false, graphInheritablePermissionsError: null);
             }
 
             logger.LogInformation("Application object verified in directory");
@@ -1013,15 +1030,15 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
         catch (Exception ex)
         {
             logger.LogError(ex, "Failed to create agent blueprint: {Message}", ex.Message);
-            return (false, null, null, null, alreadyExisted: false);
+            return (false, null, null, null, alreadyExisted: false, graphPermissionsConfigured: false, graphInheritablePermissionsFailed: false, graphInheritablePermissionsError: null);
         }
     }
 
     /// <summary>
     /// Completes blueprint configuration by validating/creating federated credentials and requesting admin consent.
     /// Called by both existing blueprint and new blueprint paths to ensure consistent configuration.
     /// </summary>
-    private static async Task<(bool success, string? appId, string? objectId, string? servicePrincipalId, bool alreadyExisted)> CompleteBlueprintConfigurationAsync(
+    private static async Task<(bool success, string? appId, string? objectId, string? servicePrincipalId, bool alreadyExisted, bool graphPermissionsConfigured, bool graphInheritablePermissionsFailed, string? graphInheritablePermissionsError)> CompleteBlueprintConfigurationAsync(
         ILogger logger,
         CommandExecutor executor,
         GraphApiService graphApiService,
@@ -1152,7 +1169,7 @@ await retryHelper.ExecuteWithRetryAsync(
         // Admin Consent
         // ========================================================================
 
-        var (consentSuccess, consentUrlGraph) = await EnsureAdminConsentAsync(
+        var (consentSuccess, consentUrlGraph, graphInheritablePermissionsConfigured, graphInheritablePermissionsError) = await EnsureAdminConsentAsync(
             logger,
             executor,
             graphApiService,
@@ -1189,7 +1206,9 @@ await retryHelper.ExecuteWithRetryAsync(
             logger.LogWarning("Consent URL: {Url}", consentUrlGraph);
         }
 
-        return (true, appId, objectId, servicePrincipalId, alreadyExisted);
+        // Track Graph permissions status - this is critical for agent token exchange
+        bool graphPermissionsFailed = !graphInheritablePermissionsConfigured;
+        return (true, appId, objectId, servicePrincipalId, alreadyExisted, consentSuccess, graphPermissionsFailed, graphInheritablePermissionsError);
     }
 
     /// <summary>
@@ -1225,9 +1244,9 @@ private static List<string> GetApplicationScopes(Models.Agent365Config setupConf
     /// Ensures admin consent for the blueprint application.
     /// For existing blueprints, checks if consent already exists before requesting browser interaction.
     /// For new blueprints, skips verification and directly requests consent.
-    /// Returns: (consentSuccess, consentUrl)
+    /// Returns: (consentSuccess, consentUrl, graphInheritablePermissionsConfigured, graphInheritablePermissionsError)
     /// </summary>
-    private static async Task<(bool consentSuccess, string consentUrl)> EnsureAdminConsentAsync(
+    private static async Task<(bool consentSuccess, string consentUrl, bool graphInheritablePermissionsConfigured, string? graphInheritablePermissionsError)> EnsureAdminConsentAsync(
         ILogger logger,
         CommandExecutor executor,
         GraphApiService graphApiService,
@@ -1294,7 +1313,39 @@ private static List<string> GetApplicationScopes(Models.Agent365Config setupConf
 
         if (consentAlreadyExists)
         {
-            return (true, consentUrlGraph);
+            // For existing consent, we still need to verify/configure inheritable permissions
+            logger.LogInformation("Configuring inheritable permissions for Microsoft Graph...");
+            bool graphInheritableConfigured = false;
+            string? graphInheritableError = null;
+            try
+            {
+                setupConfig.AgentBlueprintId = appId;
+
+                await SetupHelpers.EnsureResourcePermissionsAsync(
+                    graph: graphApiService,
+                    blueprintService: blueprintService,
+                    config: setupConfig,
+                    resourceAppId: AuthenticationConstants.MicrosoftGraphResourceAppId,
+                    resourceName: "Microsoft Graph",
+                    scopes: applicationScopes.ToArray(),
+                    logger: logger,
+                    addToRequiredResourceAccess: false,
+                    setInheritablePermissions: true,
+                    setupResults: null,
+                    ct: ct);
+
+                logger.LogInformation("Microsoft Graph inheritable permissions configured successfully");
+                graphInheritableConfigured = true;
+            }
+            catch (Exception ex)
+            {
+                graphInheritableError = ex.Message;
+                logger.LogWarning("Failed to configure Microsoft Graph inheritable permissions: {Message}", ex.Message);
+                logger.LogWarning("Agent instances may not be able to access Microsoft Graph resources");
+                logger.LogWarning("You can configure these manually later with: a365 setup blueprint");
+            }
+
+            return (true, consentUrlGraph, graphInheritableConfigured, graphInheritableError);
         }
 
         // Request consent via browser
@@ -1305,6 +1356,9 @@ private static List<string> GetApplicationScopes(Models.Agent365Config setupConf
 
         var consentSuccess = await AdminConsentHelper.PollAdminConsentAsync(executor, logger, appId, "Graph API Scopes", 180, 5, ct);
 
+        bool graphInheritablePermissionsConfigured = false;
+        string? graphInheritablePermissionsError = null;
+
         if (consentSuccess)
         {
             logger.LogInformation("Graph API admin consent granted successfully!");
@@ -1329,20 +1383,22 @@ await SetupHelpers.EnsureResourcePermissionsAsync(
                     ct: ct);
 
                 logger.LogInformation("Microsoft Graph inheritable permissions configured successfully");
+                graphInheritablePermissionsConfigured = true;
             }
             catch (Exception ex)
             {
+                graphInheritablePermissionsError = ex.Message;
                 logger.LogWarning("Failed to configure Microsoft Graph inheritable permissions: {Message}", ex.Message);
                 logger.LogWarning("Agent instances may not be able to access Microsoft Graph resources");
-                logger.LogWarning("You can configure these manually later with: a365 setup permissions");
+                logger.LogWarning("You can configure these manually later with: a365 setup blueprint");
             }
         }
         else
         {
             logger.LogWarning("Graph API admin consent may not have completed");
         }
 
-        return (consentSuccess, consentUrlGraph);
+        return (consentSuccess, consentUrlGraph, graphInheritablePermissionsConfigured, graphInheritablePermissionsError);
     }
 
     /// <summary>

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/SetupHelpers.cs

@@ -92,20 +92,23 @@ public static void DisplaySetupSummary(SetupResults results, ILogger logger)
             var status = results.BlueprintAlreadyExisted ? "configured (already exists)" : "created";
             logger.LogInformation("  [OK] Agent blueprint {Status} (Blueprint ID: {BlueprintId})", status, results.BlueprintId ?? "unknown");
         }
-        if (results.McpPermissionsConfigured)
+        if (results.McpPermissionsConfigured && results.InheritablePermissionsConfigured)
         {
-            var status = results.McpPermissionsAlreadyExisted ? "verified (already configured)" : "configured";
-            logger.LogInformation("  [OK] MCP server permissions {Status}", status);
+            var permStatus = results.McpPermissionsAlreadyExisted ? "verified" : "configured";
+            var inheritStatus = results.InheritablePermissionsAlreadyExisted ? "verified" : "configured";
+            logger.LogInformation("  [OK] MCP Tools permissions {PermStatus}, inheritable permissions {InheritStatus}", permStatus, inheritStatus);
         }
-        if (results.InheritablePermissionsConfigured)
+        if (results.BotApiPermissionsConfigured && results.BotInheritablePermissionsConfigured)
         {
-            var status = results.InheritablePermissionsAlreadyExisted ? "verified (already configured)" : "configured";
-            logger.LogInformation("  [OK] Inheritable permissions {Status}", status);
+            var permStatus = results.BotApiPermissionsAlreadyExisted ? "verified" : "configured";
+            var inheritStatus = results.BotInheritablePermissionsAlreadyExisted ? "verified" : "configured";
+            logger.LogInformation("  [OK] Messaging Bot API permissions {PermStatus}, inheritable permissions {InheritStatus}", permStatus, inheritStatus);
         }
-        if (results.BotApiPermissionsConfigured)
+        if (results.GraphPermissionsConfigured && results.GraphInheritablePermissionsConfigured)
         {
-            var status = results.BotApiPermissionsAlreadyExisted ? "verified (already configured)" : "configured";
-            logger.LogInformation("  [OK] Messaging Bot API permissions {Status}", status);
+            var permStatus = results.GraphPermissionsAlreadyExisted ? "verified" : "configured";
+            var inheritStatus = results.GraphInheritablePermissionsAlreadyExisted ? "verified" : "configured";
+            logger.LogInformation("  [OK] Microsoft Graph permissions {PermStatus}, inheritable permissions {InheritStatus}", permStatus, inheritStatus);
         }
         if (results.MessagingEndpointRegistered)
         {
@@ -144,19 +147,19 @@ public static void DisplaySetupSummary(SetupResults results, ILogger logger)
             logger.LogInformation("");
             logger.LogInformation("Recovery Actions:");
 
-            if (!results.InheritablePermissionsConfigured)
+            if (!results.McpPermissionsConfigured || !results.InheritablePermissionsConfigured)
             {
-                logger.LogInformation("  - Inheritable Permissions: Run 'a365 setup permissions mcp' to retry");
+                logger.LogInformation("  - MCP Tools Permissions: Run 'a365 setup permissions mcp' to retry");
             }
 
-            if (!results.McpPermissionsConfigured)
+            if (!results.BotApiPermissionsConfigured || !results.BotInheritablePermissionsConfigured)
             {
-                logger.LogInformation("  - MCP Permissions: Run 'a365 setup permissions mcp' to retry");
+                logger.LogInformation("  - Messaging Bot API Permissions: Run 'a365 setup permissions bot' to retry");
             }
 
-            if (!results.BotApiPermissionsConfigured)
+            if (!results.GraphPermissionsConfigured || !results.GraphInheritablePermissionsConfigured)
             {
-                logger.LogInformation("  - Bot API Permissions: Run 'a365 setup permissions bot' to retry");
+                logger.LogInformation("  - Microsoft Graph Permissions: Run 'a365 setup blueprint' to retry");
             }
 
             if (!results.MessagingEndpointRegistered)
@@ -168,6 +171,15 @@ public static void DisplaySetupSummary(SetupResults results, ILogger logger)
         else if (results.HasWarnings)
         {
             logger.LogInformation("Setup completed successfully with warnings");
+            logger.LogInformation("");
+            logger.LogInformation("Recovery Actions:");
+            
+            if (!string.IsNullOrEmpty(results.GraphInheritablePermissionsError))
+            {
+                logger.LogInformation("  - Graph Inheritable Permissions: Run 'a365 setup blueprint' to retry");
+            }
+            
+            logger.LogInformation("");
             logger.LogInformation("Review warnings above and take action if needed");
         }
         else
@@ -386,6 +398,7 @@ public static async Task EnsureResourcePermissionsAsync(
             else if (resourceName.Contains("Bot", StringComparison.OrdinalIgnoreCase))
             {
                 setupResults.BotApiPermissionsAlreadyExisted = inheritanceAlreadyExisted;
+                setupResults.BotInheritablePermissionsAlreadyExisted = inheritanceAlreadyExisted;
             }
         }