Repository navigation
Add a365 network vnet for linking an Azure VNet to Agent 365
#494
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Lala Sushant Srivastava (lasrivas)
wants to merge
11
commits into
main
Choose a base branch
from
feature/network-vnet-link
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+3,163
−2
Open
Changes from all commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
1318bd5
Add `a365 network vnet` for linking an Azure VNet to Agent 365
lasrivas 5132585
fix: address review feedback on a365 network vnet
lasrivas 2e6d896
fix: bound the wait ceiling, propagate cancellation, correct the az l…
lasrivas fcfa121
Do not rethrow HttpClient's own timeout as cancellation
lasrivas 419e2f3
Do not let a per-request client dispose a shared handler
lasrivas c6d9f7b
fix(cli): make enterprise policy ARM id validation case-insensitive a…
lasrivas b0a71d7
fix(vnet): reject enterprise policies that are not NetworkInjection
lasrivas 9f6fd17
feat(vnet): resolve and send policySystemId on unlink
lasrivas 6e4844a
Merge origin/main into feature/network-vnet-link
lasrivas 4c0f502
Address review round 3 on the vnet link CLI
lasrivas 0f40bfa
Treat a missing operation status as Unknown
lasrivas File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| # `a365 network vnet` | ||
|
|
||
| Links an Azure virtual network to Agent 365 via a Power Platform **NetworkInjection enterprise | ||
| policy**, without needing the id of the Power Platform environment. | ||
|
|
||
| ## Why this command exists | ||
|
|
||
| The documented subnet-injection flow | ||
| ([Set up virtual network support](https://learn.microsoft.com/power-platform/admin/vnet-support-setup-configure)) | ||
| ends with `Enable-SubnetInjection` from the `Microsoft.PowerPlatform.EnterprisePolicies` module, | ||
| which takes an `-environmentId`. Agent 365 provisions a managed Power Platform environment for the | ||
| tenant and does not publish its id, so that final step cannot be run. | ||
|
|
||
| `a365 network vnet` replaces only that last step. The CLI reads the policy's `systemId` from Azure | ||
| Resource Manager with your own sign-in, then asks the Agent 365 platform to perform the link | ||
| against the environment it resolves for your tenant. | ||
|
|
||
| Everything before the final step is unchanged — keep using the PowerShell module to create the | ||
| subnets, delegate them to `Microsoft.PowerPlatform/enterprisePolicies`, and create the policy with | ||
| `New-SubnetInjectionEnterprisePolicy`. | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - **Global Administrator** or **Power Platform Administrator** in the tenant. The platform rejects | ||
| anyone else. | ||
| - An active `az login` session. It supplies two defaults: the tenant to operate on, and the | ||
| signed-in account used as a login hint for the Agent 365 call. `--tenant-id` overrides the | ||
| first. Tokens are not borrowed from Azure CLI -- both the ARM policy read and the Agent 365 call | ||
| acquire their own tokens through the CLI's sign-in. The ARM read is not given the login hint, so | ||
| with several cached accounts in the same tenant it may sign in as a different one; sign out of | ||
| the accounts you do not want the CLI to use. | ||
| - A NetworkInjection enterprise policy already created by `New-SubnetInjectionEnterprisePolicy`, | ||
| with subnets delegated to `Microsoft.PowerPlatform/enterprisePolicies`. | ||
| - Public cloud only. Sovereign clouds are not supported. | ||
|
|
||
| ## Subcommands | ||
|
|
||
| | Command | Description | | ||
| | --- | --- | | ||
| | `a365 network vnet link` | Link a NetworkInjection enterprise policy to the tenant's Agent 365 environment. | | ||
| | `a365 network vnet unlink` | Remove the virtual network link. | | ||
| | `a365 network vnet status` | Show the current link, or check a running operation. | | ||
|
|
||
| ### `link` | ||
|
|
||
| ```bash | ||
| a365 network vnet link --policy-arm-id <arm-id> [--swap] [--tenant-id <guid>] [--wait] [--yes] | ||
| ``` | ||
|
|
||
| | Option | Description | | ||
| | --- | --- | | ||
| | `--policy-arm-id`, `-p` | **Required.** ARM resource id of the policy, as returned by `New-SubnetInjectionEnterprisePolicy`. | | ||
| | `--swap` | Replace an existing link to a *different* policy. Without it, a different existing link is reported as a conflict instead of being silently replaced. | | ||
| | `--tenant-id` | Tenant to authenticate against, for both the Azure policy read and the Agent 365 call. Defaults to the tenant of your current `az login`. | | ||
| | `--wait` | Poll until the operation settles instead of returning an operation id. | | ||
| | `--yes`, `-y` | Skip the confirmation prompt. | | ||
|
|
||
| Every `link` prompts for confirmation: Power Platform documents that enabling subnet delegation can | ||
| leave the environment unstable for up to 30 minutes while connections re-initialize, and the change | ||
| applies to every Agent 365 agent in the tenant. Pass `--yes` in automation. | ||
|
|
||
| Linking the policy that is already linked is a no-op and succeeds without `--swap`. | ||
|
|
||
| ### `unlink` | ||
|
|
||
| ```bash | ||
| a365 network vnet unlink [--tenant-id <guid>] [--wait] [--yes] | ||
| ``` | ||
|
|
||
| Unlink needs no policy id from you, but it does need your Azure session: it reads which policy is | ||
| linked, resolves that policy in Azure to get the identifier the platform requires, then unlinks. If | ||
| the policy has been deleted from Azure, unlink fails and names it — use the PowerShell | ||
| `Disable-SubnetInjection` module instead. It prompts before removing the link; pass `--yes` in | ||
| automation. | ||
|
|
||
| ### `status` | ||
|
|
||
| ```bash | ||
| a365 network vnet status [--operation-id <id>] [--tenant-id <guid>] | ||
| ``` | ||
|
|
||
| Without `--operation-id`, reports the environment's current link. With one, reports that specific | ||
| operation. | ||
|
|
||
| ## Statuses and exit codes | ||
|
|
||
| | Status | Meaning | | ||
| | --- | --- | | ||
| | `Linked` | A policy is linked; `Policy` names it. | | ||
| | `NotLinked` | No policy is linked. | | ||
| | `Running` | The operation is still in flight; `Operation` is the handle to poll. | | ||
| | `Failed` | The operation failed; `Reason` explains why. | | ||
| | `Unknown` | The operation id is not recognised — mistyped, expired, or from another tenant. Operation ids are tenant-scoped, so check `--tenant-id`; to read the current link instead, run `status` with no `--operation-id`. | | ||
|
|
||
| Exit code is `1` on `Failed`, on `Unknown`, and on any request error; `0` otherwise — including a | ||
| still-running operation, which is a legitimate outcome when `--wait` is not passed. | ||
|
|
||
| ## Typical flow | ||
|
|
||
| ```bash | ||
| # 1. Create the policy with the PowerShell module (unchanged). | ||
| New-SubnetInjectionEnterprisePolicy ` | ||
| -SubscriptionId <sub> -ResourceGroupName <rg> -PolicyName <name> ` | ||
| -PolicyLocation <geography> -VirtualNetworkId <vnetId> -SubnetName <subnet> | ||
|
|
||
| # 2. Link it — this replaces Enable-SubnetInjection. | ||
| a365 network vnet link --policy-arm-id /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.PowerPlatform/enterprisePolicies/<name> --wait | ||
|
|
||
| # 3. Confirm. | ||
| a365 network vnet status | ||
| ``` | ||
|
|
||
| Two things the Learn walkthrough covers that are easy to miss: | ||
|
|
||
| - Geographies with two supported regions (`unitedstates`, for example) need a second virtual | ||
| network: pass `-VirtualNetworkId2` and `-SubnetName2` as well. | ||
| - The CLI reads the policy with *your* identity, so whoever runs `link` needs read access on the | ||
| policy even if someone else created it. | ||
|
|
||
| ## Troubleshooting | ||
|
|
||
| | Symptom | Cause | | ||
| | --- | --- | | ||
| | `Could not determine your Azure tenant` | No `az login` session. Run `az login`, or pass `--tenant-id`. | | ||
| | `--tenant-id was supplied but is empty` | `--tenant-id` was passed with a blank value. Pass a tenant id, or omit the option entirely. | | ||
| | `403` from the platform | Caller is not a Global or Power Platform Administrator, or the CLI app lacks consent for the `AgentTools.VNet.*` scopes. | | ||
| | Conflict reported on `link` | A *different* policy is already linked. Re-run with `--swap`, or `unlink` first. | | ||
| | Policy read fails | The policy ARM id is wrong, or your `az login` identity cannot read it. | | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor: Document the ten-minute ceiling of
--waitThe help and command documentation promise to poll until the operation settles, but
--waitis a bounded, best-effort wait that can return a still-running operation with exit code 0 after ten minutes. Automation can therefore proceed under the mistaken assumption that the requested networking change completed.Evidence
NetworkCommand.cs:23fixes the wait budget at ten minutes.VNetLinkService.cs:217-225returns the last status when that budget is exhausted, even if it remains Running, andNetworkCommand.cs:353-377prints the resume hint and returns 0. Nevertheless,docs/commands/network.md:55says "Poll until the operation settles", both option descriptions say "Keep polling until ... settles", and lines 95-96 describe a still-running success as an outcome when--waitis not passed. A link taking more than ten minutes therefore violates the advertised behavior.Suggested fix: State in both option help strings and this page that
--waitpolls for up to ten minutes, then prints a resumable operation handle and exits 0 if the operation is still running. Alternatively, return a nonzero timeout result if the existing "until settled" contract is intended.