Skip to content

[Backup] az backup container register: Add managed identity support for Azure Files backup - #34146

Open
Bharat Purwar (bharatpurwar) wants to merge 4 commits into
Azure:devfrom
bharatpurwar:users/bharatpurwar/afsmsi2
Open

[Backup] az backup container register: Add managed identity support for Azure Files backup#34146
Bharat Purwar (bharatpurwar) wants to merge 4 commits into
Azure:devfrom
bharatpurwar:users/bharatpurwar/afsmsi2

Conversation

@bharatpurwar

@bharatpurwar Bharat Purwar (bharatpurwar) commented Sep 29, 2026

Copy link
Copy Markdown
Member

Summary

  • add explicit KeyBased, system-assigned identity, and user-assigned identity registration and re-registration for Azure Files backup containers
  • preserve or select storage-account authentication during protection and include managed identity information in primary-region restores
  • support cross-subscription Azure Files restore targets while preserving KeyBased full-share cross-region restore behavior
  • update command help/table output and add focused unit and recorded scenario coverage

Replacement PR

Validation

  • changed Python files compile successfully with the installed Azure CLI Python
  • scenario recording parses successfully with 121 interactions
  • all 134 affected recorded requests use api-version=2026-08-01; no 2026-07-01 requests remain
  • git diff --check passes
  • the original implementation was live-validated for UAMI cross-subscription restore and KeyBased CRR+CSR

Bharat Purwar and others added 3 commits September 29, 2026 13:50
Bharat Purwar
Add managed identity support for Azure Files backup
c9e1f39 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bharat Purwar
Preserve backup container registration defaults
3f13bec 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bharat Purwar
Update Azure Files backup recording API version
b31f1a5 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings September 29, 2026 08:22
@azure-pipelines

azure-pipelines Bot commented Sep 29, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@a0x1ab

Aditya Pujara (a0x1ab) commented Sep 29, 2026

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

azure-pipelines Bot commented Sep 29, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).

Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Registration can misroute Azure Files and send incorrect storage-account resource-group metadata.

Review effort: Balanced
Findings: 3 Medium severity

Open (3)
What changed in this PR

Extends Azure Files Backup with managed-identity registration, protection, and cross-subscription restore support.

Changes:

  • Adds KeyBased, system-assigned, and user-assigned identity workflows.
  • Adds subscription-aware restore targeting and output/help updates.
  • Adds focused unit and recorded scenario coverage.
File Description
tests/​latest/​test_custom_afs.py Adds focused identity and restore tests.
tests/​latest/​test_afs_commands.py Adds an end-to-end backup scenario.
tests/​latest/​recordings/​test_afs_msi_reregistration_protection_restore.yaml Records scenario service interactions.
custom_base.py Routes and validates new options.
custom_afs.py Implements registration and restore behavior.
commands.py Registers the generalized container handler.
_params.py Defines new CLI arguments.
_help.py Adds usage examples.
_format.py Displays authentication details.
_client_factory.py Supports subscription-specific clients.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/azure-cli/azure/cli/command_modules/backup/custom_afs.py
Comment on lines +129 to +140
source_resource_id = helper.get_model_property(
properties, 'container_id', 'containerId') or helper.get_model_property(
properties, 'source_resource_id', 'sourceResourceId')

payload = AzureStorageContainer(
friendly_name=helper.get_model_property(properties, 'friendly_name', 'friendlyName'),
backup_management_type=backup_management_type,
source_resource_id=source_resource_id,
resource_group=resource_group_name,
operation_type=operation_type,
access_type=access_type,
identity_info=identity_info)

@bharatpurwar Bharat Purwar (bharatpurwar) Sep 30, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Had tested, it doesnt affect. There is sourceResourceId which is correctly populated

Comment thread src/azure-cli/azure/cli/command_modules/backup/custom_base.py
Comment on lines +512 to +517
if backup_management_type.lower() != "azureworkload":
raise InvalidArgumentValueError(
"Container registration supports AzureWorkload and AzureStorage backup management types.")
if workload_type is None:
raise RequiredArgumentMissingError(
"--workload-type is required with --backup-management-type AzureWorkload.")

@bharatpurwar Bharat Purwar (bharatpurwar) Sep 30, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

Comment thread src/azure-cli/azure/cli/command_modules/backup/custom_base.py
Comment on lines +521 to +524
if storage_account is not None or access_type is not None or mi_system_assigned or mi_user_assigned:
raise ArgumentUsageError(
"Azure Files managed identity arguments are only supported with "
"--backup-management-type AzureStorage.")

@bharatpurwar Bharat Purwar (bharatpurwar) Sep 30, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AzureWorkload registration has no confirmation prompt, so  --yes  has no functional effect. So no need to change

@yonzhan Yong Zhang (yonzhan) added this to the Backlog milestone Sep 29, 2026
@microsoft-github-policy-service

microsoft-github-policy-service Bot commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

🔔 Routing this PR to @Azure/act-observability-squad.

@yonzhan

Yong Zhang (yonzhan) commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator

Please fix CI issues

Bharat Purwar
fix(backup): validate Azure Files registration routing
e94e781 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@a0x1ab

Aditya Pujara (a0x1ab) commented Sep 29, 2026

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

azure-pipelines Bot commented Sep 29, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).

@bharatpurwar

Bharat Purwar (bharatpurwar) commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Hi team, Yong Zhang (@yonzhan) , can you please review if the CI issues are due to current pr changes. Based on copilot
"
The style environment automatically upgraded Pylint from 4.0.9 to 4.1.1. Pylint 4.1.1 started reporting pre-existing issues outside the Backup module:
"

@necusjz

Ethan Yang (necusjz) commented Oct 1, 2026

Copy link
Copy Markdown
Member

Hi team, Yong Zhang (Yong Zhang (@yonzhan)) , can you please review if the CI issues are due to current pr changes. Based on copilot " The style environment automatically upgraded Pylint from 4.0.9 to 4.1.1. Pylint 4.1.1 started reporting pre-existing issues outside the Backup module: "

code freeze until next Mon, will take a look during this period.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@yonzhan Yong Zhang (yonzhan) Awaiting requested review from yonzhan
@wangzelin007 ZelinWang (wangzelin007) Awaiting requested review from wangzelin007
@jsntcy Yu Chen (jsntcy) Awaiting requested review from jsntcy

At least 1 approving review is required to merge this pull request.

Assignees

@NoriZC NoriZC

Labels

act-observability-squad Auto-Assign Auto assign by bot Backup do-not-merge

Projects

None yet

Milestone

Backlog

Development

Successfully merging this pull request may close these issues.

6 participants

@bharatpurwar @a0x1ab @yonzhan @necusjz @NoriZC