feat: non-admin setup flow, a365 setup admin command, and cleanup 403 fixes

CHANGELOG.md

@@ -14,6 +14,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `a365 publish` updates manifest IDs, creates `manifest.zip`, and prints concise upload instructions for Microsoft 365 Admin Center (Agents > All agents > Upload custom agent). Interactive prompts only occur in interactive terminals; redirect stdin to suppress them in scripts.
 
 ### Fixed
+- `a365 cleanup` now uses correct Graph scopes for blueprint deletion (`AgentIdentityBlueprint.DeleteRestore.All`) and federated credential deletion (`AgentIdentityBlueprint.AddRemoveCreds.All`); the previous scopes (`AgentIdentityBlueprint.ReadWrite.All` and `Application.ReadWrite.All`) no longer allow write operations to Agent ID entities per a breaking change in the permissions model
+- Token cache now isolates per-user so a cached token from one account is not reused when a different account runs a subsequent command
 - macOS/Linux: device code fallback when browser authentication is unavailable (#309)
 - Linux: MSAL fallback when PowerShell `Connect-MgGraph` fails in non-TTY environments (#309)
 - Admin consent polling no longer times out after 180s — blueprint service principal now resolved with correct MSAL token (#309)

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupCommand.cs

@@ -55,7 +55,7 @@ public static Command CreateCommand(
 
             // Add subcommands
             command.AddCommand(RequirementsSubcommand.CreateCommand(
-                logger, configService, authValidator, clientAppValidator));
+                logger, configService, authValidator, clientAppValidator, executor));
 
             command.AddCommand(InfrastructureSubcommand.CreateCommand(
                 logger, configService, authValidator, platformDetector, executor));

src/Microsoft.Agents.A365.DevTools.Cli/Commands/SetupSubcommands/AllSubcommand.cs

@@ -231,32 +231,18 @@ await RequirementsSubcommand.RunChecksOrExitAsync(
                         blueprintService,
                         blueprintLookupService,
                         federatedCredentialService,
-                        skipEndpointRegistration: false,
-                        correlationId: correlationId
-                        );
+                        skipEndpointRegistration: true,
+                        correlationId: correlationId,
+                        options: new BlueprintCreationOptions(DeferConsent: true));
 
                     setupResults.BlueprintCreated = result.BlueprintCreated;
                     setupResults.BlueprintAlreadyExisted = result.BlueprintAlreadyExisted;
-                    setupResults.MessagingEndpointRegistered = result.EndpointRegistered;
-                    setupResults.EndpointAlreadyExisted = result.EndpointAlreadyExisted;
-
-                    if (result.EndpointAlreadyExisted)
-                    {
-                        setupResults.Warnings.Add("Messaging endpoint already exists (not newly created)");
-                    }
-
-                    // If endpoint registration was attempted but failed, add to errors
-                    // Do NOT add error if registration was skipped (--no-endpoint or missing config)
-                    if (result.EndpointRegistrationAttempted && !result.EndpointRegistered)
-                    {
-                        setupResults.Errors.Add("Messaging endpoint registration failed");
-                    }
 
-                    // Track Graph permissions status - critical for agent token exchange
-                    setupResults.GraphPermissionsConfigured = result.GraphPermissionsConfigured;
+                    // Graph permissions and admin consent are deferred to the batch orchestrator
+                    // (DeferConsent: true above). Flags are updated in Step 4 after the orchestrator runs.
                     if (result.GraphInheritablePermissionsFailed)
                     {
-                        setupResults.GraphInheritablePermissionsError = result.GraphInheritablePermissionsError 
+                        setupResults.GraphInheritablePermissionsError = result.GraphInheritablePermissionsError
                             ?? "Microsoft Graph inheritable permissions failed to configure";
                         setupResults.Warnings.Add($"Microsoft Graph inheritable permissions: {setupResults.GraphInheritablePermissionsError}");
                     }
@@ -265,6 +251,14 @@ await RequirementsSubcommand.RunChecksOrExitAsync(
                         setupResults.GraphInheritablePermissionsConfigured = true;
                     }
 
+                    // Track Federated Identity Credential status
+                    setupResults.FederatedCredentialConfigured = result.FederatedCredentialConfigured;
+                    if (!result.FederatedCredentialConfigured && !string.IsNullOrWhiteSpace(result.FederatedCredentialError))
+                    {
+                        setupResults.FederatedCredentialError = result.FederatedCredentialError;
+                        setupResults.Warnings.Add($"Federated Identity Credential: {result.FederatedCredentialError}");
+                    }
+
                     if (!result.BlueprintCreated)
                     {
                         throw new GraphApiException(
@@ -275,8 +269,8 @@ await RequirementsSubcommand.RunChecksOrExitAsync(
 
                     // CRITICAL: Wait for file system to ensure config file is fully written
                     // Blueprint creation writes directly to disk and may not be immediately readable
-                    logger.LogInformation("Ensuring configuration file is synchronized...");
-                    await Task.Delay(2000); // 2 second delay to ensure file write is complete
+                    logger.LogDebug("Waiting for config file write to complete...");
+                    await Task.Delay(2000);
 
                     // Reload config to get blueprint ID
                     // Use full path to ensure we're reading from the correct location
@@ -308,85 +302,116 @@ await RequirementsSubcommand.RunChecksOrExitAsync(
                     throw;
                 }
 
-                // Step 3: MCP Permissions
+                // Step 3: Configure all permissions (Graph + MCP + Bot x3 + Custom) in a single batch.
+                // Phase 1 — update blueprint requiredResourceAccess + resolve SPs once (non-admin).
+                // Phase 2 — create OAuth2 grants and inheritable permissions (non-admin).
+                // Phase 3 — single admin consent browser or one consolidated URL for non-admins.
                 try
                 {
-                    bool mcpPermissionSetup = await PermissionsSubcommand.ConfigureMcpPermissionsAsync(
-                        config.FullName,
-                        logger,
-                        configService,
-                        executor,
-                        graphApiService,
-                        blueprintService,
-                        setupConfig,
-                        true,
-                        setupResults);
-
-                    setupResults.McpPermissionsConfigured = mcpPermissionSetup;
-                    if (mcpPermissionSetup)
+                    // Pre-step: remove stale custom permissions before building the spec list.
+                    var desiredCustomIds = new HashSet<string>(
+                        (setupConfig.CustomBlueprintPermissions ?? new List<CustomResourcePermission>())
+                            .Select(p => p.ResourceAppId),
+                        StringComparer.OrdinalIgnoreCase);
+                    await PermissionsSubcommand.RemoveStaleCustomPermissionsAsync(
+                        logger, graphApiService, blueprintService, setupConfig, desiredCustomIds, CancellationToken.None);
+
+                    // Build combined spec list.
+                    var mcpManifestPath = Path.Combine(
+                        setupConfig.DeploymentProjectPath ?? string.Empty,
+                        McpConstants.ToolingManifestFileName);
+                    var mcpScopes = await PermissionsSubcommand.ReadMcpScopesAsync(mcpManifestPath, logger);
+                    var mcpResourceAppId = ConfigConstants.GetAgent365ToolsResourceAppId(setupConfig.Environment);
+
+                    var specs = new List<ResourcePermissionSpec>
                     {
-                        setupResults.InheritablePermissionsConfigured = setupConfig.IsInheritanceConfigured();
+                        new ResourcePermissionSpec(
+                            AuthenticationConstants.MicrosoftGraphResourceAppId,
+                            "Microsoft Graph",
+                            setupConfig.AgentApplicationScopes.ToArray(),
+                            SetInheritable: true),
+                        new ResourcePermissionSpec(
+                            mcpResourceAppId,
+                            "Agent 365 Tools",
+                            mcpScopes,
+                            SetInheritable: true),
+                        new ResourcePermissionSpec(
+                            ConfigConstants.MessagingBotApiAppId,
+                            "Messaging Bot API",
+                            new[] { "Authorization.ReadWrite", "user_impersonation" },
+                            SetInheritable: true),
+                        new ResourcePermissionSpec(
+                            ConfigConstants.ObservabilityApiAppId,
+                            "Observability API",
+                            new[] { "user_impersonation" },
+                            SetInheritable: true),
+                        new ResourcePermissionSpec(
+                            PowerPlatformConstants.PowerPlatformApiResourceAppId,
+                            "Power Platform API",
+                            new[] { "Connectivity.Connections.Read" },
+                            SetInheritable: true),
+                    };
+
+                    foreach (var customPerm in setupConfig.CustomBlueprintPermissions ?? new List<CustomResourcePermission>())
+                    {
+                        var (isValid, _) = customPerm.Validate();
+                        if (isValid && !string.IsNullOrWhiteSpace(customPerm.ResourceAppId))
+                        {
+                            var resourceName = string.IsNullOrWhiteSpace(customPerm.ResourceName)
+                                ? customPerm.ResourceAppId
+                                : customPerm.ResourceName;
+                            specs.Add(new ResourcePermissionSpec(
+                                customPerm.ResourceAppId,
+                                resourceName,
+                                customPerm.Scopes.ToArray(),
+                                SetInheritable: true));
+                        }
                     }
-                }
-                catch (Exception mcpPermEx)
-                {
-                    setupResults.McpPermissionsConfigured = false;
-                    setupResults.Errors.Add($"MCP Permissions: {mcpPermEx.Message}");
-                    logger.LogWarning("MCP permissions failed: {Message}. Setup will continue, but MCP server permissions must be configured manually", mcpPermEx.Message);
-                }
 
-                // Step 4: Bot API Permissions
-                try
-                {
-                    bool botPermissionSetup = await PermissionsSubcommand.ConfigureBotPermissionsAsync(
-                        config.FullName,
-                        logger,
-                        configService,
-                        executor,
-                        setupConfig,
-                        graphApiService,
-                        blueprintService,
-                        true,
-                        setupResults);
+                    var (blueprintPermissionsUpdated, inheritedPermissionsConfigured, consentGranted, adminConsentUrl) =
+                        await BatchPermissionsOrchestrator.ConfigureAllPermissionsAsync(
+                            graphApiService, blueprintService, setupConfig,
+                            setupConfig.AgentBlueprintId!, setupConfig.TenantId,
+                            specs, logger, setupResults, CancellationToken.None,
+                            knownBlueprintSpObjectId: setupConfig.AgentBlueprintServicePrincipalObjectId);
 
-                    setupResults.BotApiPermissionsConfigured = botPermissionSetup;
-                    if (botPermissionSetup)
-                    {
-                        setupResults.BotInheritablePermissionsConfigured = setupConfig.IsBotInheritanceConfigured();
-                    }
+                    setupResults.BatchPermissionsPhase1Completed = blueprintPermissionsUpdated;
+                    setupResults.BatchPermissionsPhase2Completed = inheritedPermissionsConfigured;
+                    setupResults.AdminConsentGranted = consentGranted;
+                    setupResults.AdminConsentUrl = adminConsentUrl;
+
+                    await configService.SaveStateAsync(setupConfig);
                 }
-                catch (Exception botPermEx)
+                catch (Exception permEx)
                 {
-                    setupResults.BotApiPermissionsConfigured = false;
-                    setupResults.Errors.Add($"Bot API Permissions: {botPermEx.Message}");
-                    logger.LogWarning("Bot permissions failed: {Message}. Setup will continue, but Bot API permissions must be configured manually", botPermEx.Message);
+                    setupResults.BatchPermissionsPhase2Completed = false;
+                    setupResults.AdminConsentGranted = false;
+                    setupResults.Errors.Add($"Permissions: {permEx.Message}");
+                    logger.LogWarning("Permissions configuration failed: {Message}. Setup will continue, but permissions must be configured manually.", permEx.Message);
                 }
 
-                // Step 5: Reconcile custom blueprint permissions — apply desired and remove stale entries.
-                // Always run (even when config is empty) to clean up any permissions no longer in config.
+                // Step 4: Register messaging endpoint — runs after blueprint is fully configured with permissions.
+                logger.LogInformation("");
+                logger.LogInformation("Registering blueprint messaging endpoint...");
                 try
                 {
-                    bool customPermissionsSetup = await PermissionsSubcommand.ConfigureCustomPermissionsAsync(
-                        config.FullName,
-                        logger,
-                        configService,
-                        executor,
-                        graphApiService,
-                        blueprintService,
-                        setupConfig,
-                        true,
-                        setupResults);
+                    var (endpointSuccess, endpointAlreadyExisted) =
+                        await SetupHelpers.RegisterBlueprintMessagingEndpointAsync(
+                            setupConfig, logger, botConfigurator, correlationId: correlationId);
 
-                    setupResults.CustomPermissionsConfigured = customPermissionsSetup;
+                    setupResults.MessagingEndpointRegistered = endpointSuccess;
+                    setupResults.EndpointAlreadyExisted = endpointAlreadyExisted;
                 }
-                catch (Exception customPermEx)
+                catch (Exception endpointEx)
                 {
-                    setupResults.CustomPermissionsConfigured = false;
-                    setupResults.Errors.Add($"Custom Blueprint Permissions: {customPermEx.Message}");
-                    logger.LogWarning("Custom permissions failed: {Message}. Setup will continue, but custom permissions must be configured manually", customPermEx.Message);
+                    setupResults.MessagingEndpointRegistered = false;
+                    setupResults.Errors.Add($"Messaging endpoint registration failed: {endpointEx.Message}");
+                    logger.LogWarning("Endpoint registration failed: {Message}", endpointEx.Message);
+                    logger.LogWarning("To retry after resolving the issue: a365 setup blueprint --endpoint-only");
                 }
 
-                // Display setup summary
+                // Display verification URLs and setup summary
+                await SetupHelpers.DisplayVerificationInfoAsync(config, logger);
                 logger.LogInformation("");
                 SetupHelpers.DisplaySetupSummary(setupResults, logger);
             }