Revert "feat: add web consent redirect URIs to BYO Entra apps (#450)" (#455)

ragurubhaarath · bhaarathms · web-flow · commit a398cfcc175d · 2026-06-12T10:04:07.000-07:00
This reverts commit 091d51d. Co-authored-by: Bhaarath Raguru <bhraguru@microsoft.com>
diff --git a/src/Microsoft.Agents.A365.DevTools.Cli/Commands/PublishCommandExecutor.cs b/src/Microsoft.Agents.A365.DevTools.Cli/Commands/PublishCommandExecutor.cs
@@ -319,7 +319,7 @@ private void DisplayPublishSummary(ResolvedInput input)
         var provisioner = new EntraAppProvisioner(_logger, _graphApiService!, _retryHelper);
 
         var publicClients = await provisioner.CreatePublicClientsAppAsync(
-            input.ServerName, tenantId, serviceTreeId: null, warnings, ct: ct);
+            input.ServerName, tenantId, serviceTreeId: null, warnings, ct);
 
         return new EntraAppSet(
             PublicClientsClientId: publicClients.ClientId,
diff --git a/src/Microsoft.Agents.A365.DevTools.Cli/Commands/RegisterCommandExecutor.cs b/src/Microsoft.Agents.A365.DevTools.Cli/Commands/RegisterCommandExecutor.cs
@@ -705,25 +705,20 @@ private async Task ConfigureEntraAppsAsync(
         }
         else
         {
-            var msg = "A365 Proxy redirect URI was not returned by the server. Setting consent redirect URIs only.";
+            var msg = "A365 Proxy redirect URI was not returned by the server. Redirect URI configuration skipped.";
             _logger.LogWarning(msg);
             concurrentWarnings.Add(msg);
-            tasks.Add(SetConsentOnlyRedirectUrisAsync(tenantId, apps.A365AppObjectId, apps.A365AppName, concurrentWarnings, ct));
         }
 
         if (input.IsEntra && !string.IsNullOrWhiteSpace(remoteRedirectUri) && apps.RemoteProxyObjectId != null)
         {
             tasks.Add(UpdateRemoteProxyRedirectUrisAsync(tenantId, apps, remoteRedirectUri, concurrentWarnings, ct));
         }
-        else if (input.IsEntra && apps.RemoteProxyObjectId != null)
+        else if (input.IsEntra && string.IsNullOrWhiteSpace(remoteRedirectUri))
         {
-            if (string.IsNullOrWhiteSpace(remoteRedirectUri))
-            {
-                var msg = "Remote MCP Proxy redirect URI was not returned by the server. Setting consent redirect URIs only.";
-                _logger.LogWarning(msg);
-                concurrentWarnings.Add(msg);
-            }
-            tasks.Add(SetConsentOnlyRedirectUrisAsync(tenantId, apps.RemoteProxyObjectId, apps.RemoteProxyAppName, concurrentWarnings, ct));
+            var msg = "Remote MCP Proxy redirect URI was not returned by the server. Redirect URI configuration skipped.";
+            _logger.LogWarning(msg);
+            concurrentWarnings.Add(msg);
         }
         else if (input.IsEntra && apps.RemoteProxyObjectId == null)
         {
@@ -790,10 +785,7 @@ private async Task UpdateA365RedirectUrisAsync(
         {
             var a365TcUri = DevelopMcpCommand.AddTcPrefix(a365RedirectUri);
             var a365NonTcUri = DevelopMcpCommand.RemoveTcPrefix(a365RedirectUri);
-            var a365Uris = DevelopMcpCommand.BuildRedirectUriList(a365RedirectUri, a365TcUri, a365NonTcUri)
-                .Concat(EntraAppProvisioner.GetConsentRedirectUris())
-                .Distinct(StringComparer.Ordinal)
-                .ToArray();
+            var a365Uris = DevelopMcpCommand.BuildRedirectUriList(a365RedirectUri, a365TcUri, a365NonTcUri);
             _logger.LogDebug("Updating redirect URIs on '{AppName}' ({ObjectId})", apps.A365AppName, apps.A365AppObjectId);
             var success = await _retryHelper.ExecuteWithRetryAsync(
                 async retryCt => await _graphApiService!.UpdateAppRedirectUrisAsync(tenantId, apps.A365AppObjectId, a365Uris, retryCt),
@@ -827,10 +819,7 @@ private async Task UpdateRemoteProxyRedirectUrisAsync(
         {
             var remoteTcUri = DevelopMcpCommand.AddTcPrefix(remoteRedirectUri);
             var remoteNonTcUri = DevelopMcpCommand.RemoveTcPrefix(remoteRedirectUri);
-            var remoteUris = DevelopMcpCommand.BuildRedirectUriList(remoteRedirectUri, remoteTcUri, remoteNonTcUri)
-                .Concat(EntraAppProvisioner.GetConsentRedirectUris())
-                .Distinct(StringComparer.Ordinal)
-                .ToArray();
+            var remoteUris = DevelopMcpCommand.BuildRedirectUriList(remoteRedirectUri, remoteTcUri, remoteNonTcUri);
             _logger.LogDebug("Updating redirect URIs on '{AppName}' ({ObjectId})", apps.RemoteProxyAppName, apps.RemoteProxyObjectId);
             var success = await _retryHelper.ExecuteWithRetryAsync(
                 async retryCt => await _graphApiService!.UpdateAppRedirectUrisAsync(tenantId, apps.RemoteProxyObjectId!, remoteUris, retryCt),
@@ -855,37 +844,6 @@ private async Task UpdateRemoteProxyRedirectUrisAsync(
         }
     }
 
-    private async Task SetConsentOnlyRedirectUrisAsync(
-        string tenantId, string objectId, string appName,
-        System.Collections.Concurrent.ConcurrentBag<string> concurrentWarnings,
-        CancellationToken ct = default)
-    {
-        try
-        {
-            var consentUris = EntraAppProvisioner.GetConsentRedirectUris();
-            var success = await _retryHelper.ExecuteWithRetryAsync(
-                async retryCt => await _graphApiService!.UpdateAppRedirectUrisAsync(tenantId, objectId, consentUris, retryCt),
-                result => !result,
-                cancellationToken: ct);
-            if (!success)
-            {
-                var msg = $"Failed to set web redirect URIs on '{appName}' after retries.";
-                _logger.LogError(msg);
-                concurrentWarnings.Add(msg);
-            }
-            else
-            {
-                _logger.LogDebug("Set {Count} web redirect URIs on '{AppName}'", consentUris.Length, appName);
-            }
-        }
-        catch (Exception ex)
-        {
-            var msg = $"Failed to set web redirect URIs on '{appName}': {ex.Message}";
-            _logger.LogError(msg);
-            concurrentWarnings.Add(msg);
-        }
-    }
-
     private async Task AddRemoteProxyScopePermissionAsync(
         string tenantId, ResolvedInput input, EntraAppSet apps,
         System.Collections.Concurrent.ConcurrentBag<string> concurrentWarnings,
diff --git a/src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs b/src/Microsoft.Agents.A365.DevTools.Cli/Services/EntraAppProvisioner.cs
@@ -22,27 +22,6 @@ internal class EntraAppProvisioner
         "http://localhost",
     ];
 
-    private static readonly string[] ProdConsentRedirectUris =
-    [
-        "https://admin.cloud.microsoft/?ref=tools/consent",
-    ];
-
-    internal static string[] GetConsentRedirectUris(string? environment = null)
-    {
-        var trimmed = environment?.Trim();
-        var resolved = string.IsNullOrEmpty(trimmed)
-            ? Environment.GetEnvironmentVariable("A365_ENVIRONMENT")?.Trim() ?? "prod"
-            : trimmed;
-        var envKey = resolved.ToUpperInvariant();
-        var customUris = Environment.GetEnvironmentVariable($"A365_CONSENT_REDIRECT_URIS_{envKey}");
-        if (!string.IsNullOrWhiteSpace(customUris))
-        {
-            return customUris.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-        }
-
-        return [.. ProdConsentRedirectUris];
-    }
-
     private readonly ILogger _logger;
     private readonly GraphApiService _graphApiService;
     private readonly RetryHelper _retryHelper;
@@ -116,30 +95,6 @@ internal sealed record PublicClientsAppResult(string? ClientId, string? ObjectId
         return new ProxyAppResult(app.Value.ClientId, secret, app.Value.ObjectId, appName);
     }
 
-    private async Task SetWebConsentRedirectUrisAsync(
-        string tenantId, string objectId, string appName, string roleDisplay,
-        string? environment, CancellationToken ct, List<string>? warnings = null)
-    {
-        var consentUris = GetConsentRedirectUris(environment);
-
-        var success = await _retryHelper.ExecuteWithRetryAsync(
-            async retryCt => await _graphApiService.UpdateAppRedirectUrisAsync(tenantId, objectId, consentUris, retryCt),
-            result => !result,
-            cancellationToken: ct);
-        if (success)
-        {
-            _logger.LogDebug(
-                "Set {RedirectUriCount} web redirect URIs on '{AppName}' ({ObjectId}): {RedirectUris}",
-                consentUris.Length, appName, objectId, string.Join(", ", consentUris));
-        }
-        else
-        {
-            var msg = $"Failed to set web redirect URIs on {roleDisplay} app '{appName}' after retries.";
-            _logger.LogWarning(msg);
-            warnings?.Add(msg);
-        }
-    }
-
     /// <summary>
     /// Best-effort compensating delete for an Entra app that was successfully created but failed
     /// a follow-up step (secret creation, post-create validation). Without this, partial failures
@@ -192,7 +147,6 @@ internal virtual async Task<PublicClientsAppResult> CreatePublicClientsAppAsync(
         string tenantId,
         string? serviceTreeId,
         List<string> warnings,
-        string? environment = null,
         CancellationToken ct = default)
     {
         var appName = $"{serverName}-PublicClients";
@@ -222,21 +176,19 @@ internal virtual async Task<PublicClientsAppResult> CreatePublicClientsAppAsync(
                 cancellationToken: ct);
             if (!success)
             {
-                var msg = $"Failed to set publicClient redirect URIs on Public Clients app '{appName}' after retries.";
+                var msg = $"Failed to set redirect URIs on Public Clients app '{appName}' after retries.";
                 _logger.LogError(msg);
                 warnings.Add(msg);
             }
             else
             {
                 _logger.LogDebug(
-                    "Set {RedirectUriCount} publicClient redirect URIs on '{AppName}' ({ObjectId}): {RedirectUris}",
+                    "Set {RedirectUriCount} redirect URIs on '{AppName}' ({ObjectId}): {RedirectUris}",
                     publicClientUris.Length,
                     appName,
                     objectId,
                     string.Join(", ", publicClientUris));
             }
-
-            await SetWebConsentRedirectUrisAsync(tenantId, objectId, appName, "Public Clients", environment, ct, warnings);
         }
         catch (Exception ex)
         {
diff --git a/src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/EntraAppProvisionerTests.cs b/src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/EntraAppProvisionerTests.cs
