Fix PR comments.

Improve error handling for AAD app config checks

Switch to fail-closed logic in client app validation methods to ensure users are prompted on errors, preventing silent misconfiguration. Use GraphApiService with correct permissions for service principal propagation checks to avoid 403s and unnecessary retries. Update log messages to clarify intentional fail-closed behavior for safer, more robust error handling.

Author: sellakumaran

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/BlueprintSubcommand.cs

@@ -1060,12 +1060,16 @@ public static async Task<bool> EnsureDelegatedConsentWithRetriesAsync(
                 var spPropagated = await retryHelper.ExecuteWithRetryAsync(
                     async ct =>
                     {
-                        // Probe oauth2PermissionGrants directly — a 200 (even empty list) confirms
-                        // the SP's clientId is visible to the grants API replication layer.
-                        // GET /servicePrincipals resolves too fast and gives false confidence.
-                        using var checkResp = await httpClient.GetAsync(
-                            $"{Constants.GraphApiConstants.BaseUrl}/v1.0/oauth2PermissionGrants?$filter=clientId eq '{servicePrincipalId}'", ct);
-                        return checkResp.IsSuccessStatusCode;
+                        // Probe oauth2PermissionGrants via GraphApiService (which acquires a token
+                        // with DelegatedPermissionGrant.ReadWrite.All scope). A non-null response —
+                        // even an empty list — confirms the SP's clientId is visible to the grants
+                        // API replication layer. Using the raw httpClient here (Application.ReadWrite.All
+                        // scope only) caused 403s on every probe, wasting 8+ minutes of retries.
+                        using var checkDoc = await graphApiService.GraphGetAsync(
+                            setupConfig.TenantId!,
+                            $"/v1.0/oauth2PermissionGrants?$filter=clientId eq '{servicePrincipalId}'",
+                            ct);
+                        return checkDoc != null;
                     },
                     result => !result,
                     maxRetries: 12,

src/Microsoft.Agents.A365.DevTools.Cli/Services/ClientAppValidator.cs

@@ -659,8 +659,10 @@ private async Task<List<string>> CollectMissingRedirectUrisAsync(
         }
         catch (Exception ex)
         {
-            _logger.LogDebug("CollectMissingRedirectUrisAsync failed (non-fatal): {Message}", ex.Message);
-            return new List<string>();
+            // On error, assume all redirect URIs are missing so the prompt still appears.
+            // Failing closed (prompt) is safer than failing open (silent mutation without disclosure).
+            _logger.LogDebug("CollectMissingRedirectUrisAsync failed — assuming all redirect URIs missing: {Message}", ex.Message);
+            return AuthenticationConstants.GetRequiredRedirectUris(clientAppId).ToList();
         }
     }
 
@@ -689,8 +691,10 @@ private async Task<bool> IsPublicClientFlowsDisabledAsync(
         }
         catch (Exception ex)
         {
-            _logger.LogDebug("IsPublicClientFlowsDisabledAsync failed (non-fatal): {Message}", ex.Message);
-            return false;
+            // On error, assume public client flows need enabling so the prompt still appears.
+            // Failing closed (prompt) is safer than failing open (silent mutation without disclosure).
+            _logger.LogDebug("IsPublicClientFlowsDisabledAsync failed — assuming public client flows need enabling: {Message}", ex.Message);
+            return true;
         }
     }