[Backup] `az backup container register`: Add managed identity support for Azure Files backup by bharatpurwar · Pull Request #34146 · Azure/azure-cli

Bharat Purwar (bharatpurwar) · 2026-09-29T08:22:42Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️backup

rule cmd_name rule_message suggest_message

⚠️ 1006 - ParaAdd backup container register cmd backup container register added parameter access_type

⚠️ 1006 - ParaAdd backup container register cmd backup container register added parameter mi_system_assigned

⚠️ 1006 - ParaAdd backup container register cmd backup container register added parameter mi_user_assigned

⚠️ 1006 - ParaAdd backup container register cmd backup container register added parameter storage_account

⚠️ 1006 - ParaAdd backup container register cmd backup container register added parameter yes

⚠️ 1009 - ParaPropRemove backup container register cmd backup container register update parameter resource_id: removed property required=True

⚠️ 1010 - ParaPropUpdate backup container register cmd backup container register update parameter workload_type: updated property choices from ['MSSQL', 'SAPASE', 'SAPAseDatabase', 'SAPHANA', 'SAPHanaDBInstance', 'SAPHanaDatabase', 'SQLDataBase'] to ['AzureFileShare', 'MSSQL', 'SAPASE', 'SAPAseDatabase', 'SAPHANA', 'SAPHanaDBInstance', 'SAPHanaDatabase', 'SQLDataBase']

⚠️ 1006 - ParaAdd backup protection enable-for-azurefileshare cmd backup protection enable-for-azurefileshare added parameter access_type

⚠️ 1006 - ParaAdd backup protection enable-for-azurefileshare cmd backup protection enable-for-azurefileshare added parameter mi_system_assigned

⚠️ 1006 - ParaAdd backup protection enable-for-azurefileshare cmd backup protection enable-for-azurefileshare added parameter mi_user_assigned

⚠️ 1006 - ParaAdd backup protection enable-for-azurefileshare cmd backup protection enable-for-azurefileshare added parameter yes

⚠️ 1006 - ParaAdd backup restore restore-azurefiles cmd backup restore restore-azurefiles added parameter mi_system_assigned

⚠️ 1006 - ParaAdd backup restore restore-azurefiles cmd backup restore restore-azurefiles added parameter mi_user_assigned

⚠️ 1006 - ParaAdd backup restore restore-azurefiles cmd backup restore restore-azurefiles added parameter target_resource_group_name

⚠️ 1006 - ParaAdd backup restore restore-azurefiles cmd backup restore restore-azurefiles added parameter target_subscription_id

⚠️ 1006 - ParaAdd backup restore restore-azurefileshare cmd backup restore restore-azurefileshare added parameter mi_system_assigned

⚠️ 1006 - ParaAdd backup restore restore-azurefileshare cmd backup restore restore-azurefileshare added parameter mi_user_assigned

⚠️ 1006 - ParaAdd backup restore restore-azurefileshare cmd backup restore restore-azurefileshare added parameter target_subscription_id

Summary

add explicit KeyBased, system-assigned identity, and user-assigned identity registration and re-registration for Azure Files backup containers
preserve or select storage-account authentication during protection and include managed identity information in primary-region restores
support cross-subscription Azure Files restore targets while preserving KeyBased full-share cross-region restore behavior
update command help/table output and add focused unit and recorded scenario coverage

Replacement PR

replaces [Backup] az backup container register: Add managed identity support for Azure Files backup #34109 after its revert in [Backup] az backup container register: Revert managed identity support for Azure Files backup #34142
replays the feature commits onto the latest dev
updates the recorded Recovery Services Backup requests from API 2026-07-01 to the current SDK API 2026-08-01

Validation

changed Python files compile successfully with the installed Azure CLI Python
scenario recording parses successfully with 121 interactions
all 134 affected recorded requests use api-version=2026-08-01; no 2026-07-01 requests remain
git diff --check passes
the original implementation was live-validated for UAMI cross-subscription restore and KeyBased CRR+CSR

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-09-29T08:22:53Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Aditya Pujara (a0x1ab) · 2026-09-29T08:25:55Z

/azp run

azure-pipelines · 2026-09-29T08:26:14Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

Copilot review overview

🟡 Changes recommended

Registration can misroute Azure Files and send incorrect storage-account resource-group metadata.

Review effort: Balanced
Findings: 3

Open (3)

Use source storage account resource group in payload · New
Reject AzureFileShare without AzureStorage management type · New
Validate --yes for Azure Files re-registration · New

What changed in this PR

Extends Azure Files Backup with managed-identity registration, protection, and cross-subscription restore support.

Changes:

Adds KeyBased, system-assigned, and user-assigned identity workflows.
Adds subscription-aware restore targeting and output/help updates.
Adds focused unit and recorded scenario coverage.

File	Description
`tests/latest/test_custom_afs.py`	Adds focused identity and restore tests.
`tests/latest/test_afs_commands.py`	Adds an end-to-end backup scenario.
`tests/latest/recordings/test_afs_msi_reregistration_protection_restore.yaml`	Records scenario service interactions.
`custom_base.py`	Routes and validates new options.
`custom_afs.py`	Implements registration and restore behavior.
`commands.py`	Registers the generalized container handler.
`_params.py`	Defines new CLI arguments.
`_help.py`	Adds usage examples.
`_format.py`	Displays authentication details.
`_client_factory.py`	Supports subscription-specific clients.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Bharat Purwar (bharatpurwar) · 2026-09-30T09:05:17Z

+    source_resource_id = helper.get_model_property(
+        properties, 'container_id', 'containerId') or helper.get_model_property(
+            properties, 'source_resource_id', 'sourceResourceId')
+
+    payload = AzureStorageContainer(
+        friendly_name=helper.get_model_property(properties, 'friendly_name', 'friendlyName'),
+        backup_management_type=backup_management_type,
+        source_resource_id=source_resource_id,
+        resource_group=resource_group_name,
+        operation_type=operation_type,
+        access_type=access_type,
+        identity_info=identity_info)


Had tested, it doesnt affect. There is sourceResourceId which is correctly populated

Bharat Purwar (bharatpurwar) · 2026-09-30T09:04:44Z

+    if backup_management_type.lower() != "azureworkload":
+        raise InvalidArgumentValueError(
+            "Container registration supports AzureWorkload and AzureStorage backup management types.")
+    if workload_type is None:
+        raise RequiredArgumentMissingError(
+            "--workload-type is required with --backup-management-type AzureWorkload.")


Bharat Purwar (bharatpurwar) · 2026-09-30T09:05:51Z

+    if storage_account is not None or access_type is not None or mi_system_assigned or mi_user_assigned:
+        raise ArgumentUsageError(
+            "Azure Files managed identity arguments are only supported with "
+            "--backup-management-type AzureStorage.")


AzureWorkload registration has no confirmation prompt, so --yes has no functional effect. So no need to change

microsoft-github-policy-service · 2026-09-29T12:00:23Z

🔔 Routing this PR to @Azure/act-observability-squad.

Yong Zhang (yonzhan) · 2026-09-29T13:01:41Z

Please fix CI issues

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Aditya Pujara (a0x1ab) · 2026-09-29T21:48:35Z

/azp run

azure-pipelines · 2026-09-29T21:48:53Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Bharat Purwar (bharatpurwar) · 2026-09-30T09:01:12Z

Hi team, Yong Zhang (@yonzhan) , can you please review if the CI issues are due to current pr changes. Based on copilot
"
The style environment automatically upgraded Pylint from 4.0.9 to 4.1.1. Pylint 4.1.1 started reporting pre-existing issues outside the Backup module:
"

Ethan Yang (necusjz) · 2026-10-01T00:48:50Z

Hi team, Yong Zhang (Yong Zhang (@yonzhan)) , can you please review if the CI issues are due to current pr changes. Based on copilot " The style environment automatically upgraded Pylint from 4.0.9 to 4.1.1. Pylint 4.1.1 started reporting pre-existing issues outside the Backup module: "

code freeze until next Mon, will take a look during this period.

Bharat Purwar (bharatpurwar) · 2026-10-06T08:18:08Z

Hi Ethan Yang (@necusjz) , Yong Zhang (@yonzhan)
Please review my earlier query

Ethan Yang (necusjz) · 2026-10-06T23:47:38Z

/azp run

azure-pipelines · 2026-10-06T23:47:54Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Ethan Yang (necusjz) · 2026-10-06T23:48:39Z

Hi Ethan Yang (Ethan Yang (@necusjz)) , Yong Zhang (Yong Zhang (@yonzhan)) Please review my earlier query

it was fixed by d295b94.

…msi2

Aditya Pujara (a0x1ab) · 2026-10-07T09:13:20Z

/azp run

azure-pipelines · 2026-10-07T09:13:38Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Bharat Purwar (bharatpurwar) · 2026-10-09T15:46:01Z

Hi Ethan Yang (@necusjz)
All checks are passing . please review

Bharat Purwar (bharatpurwar) · 2026-10-13T05:22:47Z

Hi NoriZC
please review

microsoft-github-policy-service · 2026-10-14T08:56:53Z

🔔 Routing this PR to @Azure/act-observability-squad.

x-engineering-agent · 2026-10-14T11:45:15Z

X Engineering Agent Report

Review — Comments

Bharat Purwar (@bharatpurwar)

No confirmed semantic defects found in the inspected changes at c670fef43bb6c98fc3dfaa395384bff415268d80. Upstream CI passed (52/52); regression coverage for the required scenario is not verified. No Agent tests ran.

Current evidence (paths below are relative to src/azure-cli/azure/cli/command_modules/backup/):

tests/latest/test_custom_afs.py:17-270 checks argument rejection, legacy workload routing, identity comparison, registration payload attributes/no-op/re-registration, UAMI restore attributes and mocked cross-region/cross-subscription routing. It does not verify serialized SDK request bodies or real destination-subscription clients.
tests/latest/test_afs_commands.py:492-606 now exercises --mi-system-assigned on all three requested commands: protection enable, full-share restore and directory restore. It asserts ConfigureBackup completion, container identity and completed restore jobs. However, tests/latest/recordings/test_afs_sami_protection_restore.yaml starts with the selected account already registered as SAMI; it contains no registration PUT. This does not establish fresh registration or KeyBased-to-SAMI transition behavior, nor restored-content correctness.
tests/latest/test_afs_commands.py:358-488 and tests/latest/recordings/test_afs_msi_reregistration_protection_restore.yaml cover UAMI-to-SAMI-to-UAMI re-registration, protection without identity overrides and two completed UAMI full-share restores. Both subscription variables use get_subscription_id() (lines 359-360), and the recording's source/target subscriptions match: this is not evidence of an actual cross-subscription restore. Its full-share request bodies also contain target-folder specs absent from the current scenario calls.

Both scenarios remain record_only. The author explained the preconfigured vault identities, accounts, UAMI/target and RBAC prerequisites; the earlier request for all three SAMI commands has been addressed in test code. Each recording contains 121 interactions with Backup API URLs retargeted to 2026-08-01; these author recordings are not a fresh validation of current SDK/service behavior.

Focused follow-up: validate serialized accessType, identityInfo and destination resource IDs for custom_afs.py:126-194,425-457,693-717, extending and rerunning azdev test test_custom_afs. Provision the explained prerequisites and make the two scenarios live-runnable before running azdev test test_afs_sami_protection_restore test_afs_msi_reregistration_protection_restore --live (currently skipped). Include fresh/KeyBased-to-SAMI registration, SAMI/UAMI transitions and genuinely distinct subscriptions; assert resulting container identity, restore-job completion and restored content. These are outstanding validation needs, not established runtime defects.

Test validation

Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
Regression coverage: For backup: 2 focused test file(s) and 2 recording file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually. Human review feedback identifies a scenario to verify: (at)bharat can you add scenario tests for --mi-system-assigned for the commands: - az backup protection enable-for-azurefileshare - az backup restore restore-azurefileshare - az backup restore restore-azurefiles Check the required setup and actual command output for each cited path; setup-only assertions do not establish that output. This comment predates the current head; recheck the latest diff. Human review feedback identifies a scenario to verify: (at)bharatpurwar Yes the tests use the recorded yaml files. Scenario tests should be replicable across all environments / subs as they typically follow a lifecycle. But since this is marked record_only these tests will not be re-recorded in --live mode locally or run in our scheduled live test runs. Usually, there should be a reason as to why it uses this exemption Check the required setup and actual command output for each cited path; setup-only assertions do not establish that output. This comment predates the current head; recheck the latest diff.

Risk assessment — 59/100 · High

The High rating is driven by security-sensitive behavior, public CLI behavior.

Change scope: 11 changed files, 13373 changed lines (+13302 / -71), including 7 production files.
Affected components: backup
Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
Regression evidence: Changed regression tests are included, reducing risk.
Confidence: High because changed-line patches were available for every production file.
Required review: Owning-squad review is required for backup before merge.

Posted by x-engineering-agent (Reviewer)

microsoft-github-policy-service · 2026-10-14T12:57:20Z

🔔 Routing this PR to @Azure/act-observability-squad.

JaysonTaiMicrosoft · 2026-10-15T02:43:42Z

/azp run

azure-pipelines · 2026-10-15T02:44:00Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Aditya Pujara (a0x1ab) · 2026-10-18T15:17:15Z

/azp run

azure-pipelines · 2026-10-18T15:17:33Z

Azure Pipelines: Successfully started running 3 pipeline(s).

microsoft-github-policy-service · 2026-10-18T23:53:21Z

🔔 Routing this PR to @Azure/act-observability-squad.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This reverts commit 143fd5f.

Aditya Pujara (a0x1ab) · 2026-10-19T07:02:30Z

/azp run

azure-pipelines · 2026-10-19T07:02:48Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Bharat Purwar and others added 3 commits September 29, 2026 13:50

Add managed identity support for Azure Files backup

c9e1f39

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Preserve backup container registration defaults

3f13bec

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update Azure Files backup recording API version

b31f1a5

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bharat Purwar (bharatpurwar) requested a review from a team as a code owner September 29, 2026 08:22

Copilot AI balanced review requested due to automatic review settings September 29, 2026 08:22

microsoft-github-policy-service Bot requested review from Yu Chen (jsntcy), ZelinWang (wangzelin007) and Yong Zhang (yonzhan) September 29, 2026 08:22

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot Backup act-observability-squad labels Sep 29, 2026

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 29, 2026 08:23

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Yong Zhang (yonzhan) assigned NoriZC Sep 29, 2026

Yong Zhang (yonzhan) added this to the Backlog milestone Sep 29, 2026

Bharat Purwar (bharatpurwar) added the do-not-merge label Sep 29, 2026

fix(backup): validate Azure Files registration routing

e94e781

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bharat Purwar (bharatpurwar) removed the do-not-merge label Oct 7, 2026

Merge remote-tracking branch 'origin/dev' into users/bharatpurwar/afs…

eb0a33f

…msi2

Yong Zhang (yonzhan) requested a review from NoriZC October 9, 2026 21:47

Teresa Ritorto (teresaritorto) added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 14, 2026

x-engineering-agent Bot added the X Engineering Agent Reviewed Agent reviewed this PR label Oct 14, 2026

JaysonTaiMicrosoft reviewed Oct 15, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_afs_commands.py

Add SAMI Azure Files backup scenario test

e76e410

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

JaysonTaiMicrosoft removed the X Engineering Agent Reviewed Agent reviewed this PR label Oct 18, 2026

x-engineering-agent Bot added the X Engineering Agent Reviewed Agent reviewed this PR label Oct 18, 2026

Bharat Purwar and others added 2 commits October 19, 2026 11:18

Explain record-only managed identity tests

143fd5f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Revert "Explain record-only managed identity tests"

c670fef

This reverts commit 143fd5f.

JaysonTaiMicrosoft approved these changes Oct 20, 2026

View reviewed changes

JaysonTaiMicrosoft merged commit e127b8d into Azure:dev Oct 20, 2026
52 checks passed

JaysonTaiMicrosoft modified the milestones: Backlog, November 2026 (2026-11-03) Oct 20, 2026

rule	cmd_name	rule_message
⚠️ 1006 - ParaAdd	backup container register	cmd `backup container register` added parameter `access_type`
⚠️ 1006 - ParaAdd	backup container register	cmd `backup container register` added parameter `mi_system_assigned`
⚠️ 1006 - ParaAdd	backup container register	cmd `backup container register` added parameter `mi_user_assigned`
⚠️ 1006 - ParaAdd	backup container register	cmd `backup container register` added parameter `storage_account`
⚠️ 1006 - ParaAdd	backup container register	cmd `backup container register` added parameter `yes`
⚠️ 1009 - ParaPropRemove	backup container register	cmd `backup container register` update parameter `resource_id`: removed property `required=True`
⚠️ 1010 - ParaPropUpdate	backup container register	cmd `backup container register` update parameter `workload_type`: updated property `choices` from `['MSSQL', 'SAPASE', 'SAPAseDatabase', 'SAPHANA', 'SAPHanaDBInstance', 'SAPHanaDatabase', 'SQLDataBase']` to `['AzureFileShare', 'MSSQL', 'SAPASE', 'SAPAseDatabase', 'SAPHANA', 'SAPHanaDBInstance', 'SAPHanaDatabase', 'SQLDataBase']`
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd `backup protection enable-for-azurefileshare` added parameter `access_type`
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd `backup protection enable-for-azurefileshare` added parameter `mi_system_assigned`
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd `backup protection enable-for-azurefileshare` added parameter `mi_user_assigned`
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd `backup protection enable-for-azurefileshare` added parameter `yes`
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd `backup restore restore-azurefiles` added parameter `mi_system_assigned`
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd `backup restore restore-azurefiles` added parameter `mi_user_assigned`
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd `backup restore restore-azurefiles` added parameter `target_resource_group_name`
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd `backup restore restore-azurefiles` added parameter `target_subscription_id`
⚠️ 1006 - ParaAdd	backup restore restore-azurefileshare	cmd `backup restore restore-azurefileshare` added parameter `mi_system_assigned`
⚠️ 1006 - ParaAdd	backup restore restore-azurefileshare	cmd `backup restore restore-azurefileshare` added parameter `mi_user_assigned`
⚠️ 1006 - ParaAdd	backup restore restore-azurefileshare	cmd `backup restore restore-azurefileshare` added parameter `target_subscription_id`

Conversation

Bharat Purwar (bharatpurwar) commented Sep 29, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Summary

Replacement PR

Validation

Uh oh!

azure-pipelines Bot commented Sep 29, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 29, 2026

Uh oh!

azure-pipelines Bot commented Sep 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Bharat Purwar (bharatpurwar) Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

Bharat Purwar (bharatpurwar) Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

Bharat Purwar (bharatpurwar) Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

microsoft-github-policy-service Bot commented Sep 29, 2026

Uh oh!

Yong Zhang (yonzhan) commented Sep 29, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 29, 2026

Uh oh!

azure-pipelines Bot commented Sep 29, 2026

Uh oh!

Bharat Purwar (bharatpurwar) commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ethan Yang (necusjz) commented Oct 1, 2026

Uh oh!

Bharat Purwar (bharatpurwar) commented Oct 6, 2026

Uh oh!

Ethan Yang (necusjz) commented Oct 6, 2026

Uh oh!

azure-pipelines Bot commented Oct 6, 2026

Uh oh!

Ethan Yang (necusjz) commented Oct 6, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 7, 2026

Uh oh!

azure-pipelines Bot commented Oct 7, 2026

Uh oh!

Bharat Purwar (bharatpurwar) commented Oct 9, 2026

Uh oh!

Bharat Purwar (bharatpurwar) commented Oct 13, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 14, 2026

Uh oh!

x-engineering-agent Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

X Engineering Agent Report

Uh oh!

microsoft-github-policy-service Bot commented Oct 14, 2026

Uh oh!

JaysonTaiMicrosoft commented Oct 15, 2026

Uh oh!

azure-pipelines Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 18, 2026

Uh oh!

azure-pipelines Bot commented Oct 18, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 18, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 19, 2026

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

Bharat Purwar (bharatpurwar) commented Sep 29, 2026 •

edited by x-engineering-agent Bot

Loading

Bharat Purwar (bharatpurwar) commented Sep 30, 2026 •

edited

Loading

x-engineering-agent Bot commented Oct 14, 2026 •

edited

Loading