[Change Safety] Az.Cdn: opt-in + fix dynamicparam forwarding for custom-fronted profile cmdlets by YangAn-microsoft · Pull Request #29999 · Azure/azure-powershell

YangAn-microsoft · 2026-08-12T14:39:33Z

Summary

Opts Az.Cdn into Change Safety (-AcquirePolicyToken / -ChangeReference) and fixes a generator gap that prevented these parameters from binding on the custom-fronted CDN/AFD profile cmdlets.

What's included

enable-change-safety: true opt-in for the Cdn AutoRest project (profiles + AFD endpoints).
Hand-added dynamicparam blocks on the 6 custom-fronted profile cmdlets (New/Remove/Update-Az{,FrontDoor}CdnProfile) forwarding the wrapped private cmdlet's dynamic parameters.
A generator-level fix (see companion PR Fix change-safety dynamicparam forwarding for custom-fronted cmdlets autorest.powershell#1555), applied here via full regeneration: the outer public proxy for custom-fronted cmdlets now actually emits its own dynamicparam forwarding block, so the inner block added in (2) is reachable. Previously the outer proxy rejected -AcquirePolicyToken before ever dispatching to the custom function.
Live test coverage (src/Cdn/LiveTests/Cdn.Autorest/TestLiveScenarios.ps1) for both custom-fronted cmdlets (New-AzCdnProfile, New-AzFrontDoorCdnProfile) and generated, non-custom-fronted cmdlets (New-AzFrontDoorCdnEndpoint, New-AzFrontDoorCdnRuleSet), so a regression in either code path is caught going forward.

Validation — live test evidence

Tested against a real Azure subscription (f758ac53-3e63-4317-a956-0997793808d7, tenant 4f00b3b6-2940-4f2c-b037-94637c180d30) — not mocked/recorded.

New-AzFrontDoorCdnEndpoint -AcquirePolicyToken (generated cmdlet) — passed before this fix.
New-AzFrontDoorCdnProfile -AcquirePolicyToken (custom-fronted cmdlet) — failed before this fix, passes after.

Before the fix:

PS> New-AzFrontDoorCdnProfile -ResourceGroupName rg-cs-cdn-e2e -Name fdp-cs-13865 -SkuName Standard_AzureFrontDoor -Location Global -AcquirePolicyToken -Confirm:$false
New-AzFrontDoorCdnProfile: A parameter cannot be found that matches parameter name 'AcquirePolicyToken'.

Confirmed root cause — the outer public proxy had no dynamicparam block at all:

PS> (Get-Command New-AzFrontDoorCdnProfile).ScriptBlock.Ast.Body.DynamicParamBlock -eq $null
True

After the fix (rebuilt Az.Cdn.private.dll with the generator change, regenerated exports/*.ps1):

PS> (Get-Command New-AzFrontDoorCdnProfile).ScriptBlock.Ast.Body.DynamicParamBlock -ne $null
True

PS> New-AzResourceGroup -Name rg-cs-cdn-e2e-v2 -Location 'West US' -Force
PS> New-AzFrontDoorCdnProfile -ResourceGroupName rg-cs-cdn-e2e-v2 -Name csv2profile -SkuName Standard_AzureFrontDoor -Location Global -AcquirePolicyToken -Confirm:$false
SUCCESS: csv2profile

The profile was created successfully end-to-end, confirming -AcquirePolicyToken now binds and the change-safety token acquisition path executes.

Deeper verification — proof the token acquisition pipeline actually fired

Binding the parameter and getting a successful create doesn't, by itself, prove ARM ever received the policy token — the write could succeed either way on a subscription that doesn't mandate it. For AutoRest-generated cmdlets this pipeline hook (ContextAdapter.AddChangeSafetyPolicyTokenHandler) has no built-in -Debug observability (unlike the SDK/RM cmdlet path), so a temporary, env-var-gated trace was added to PolicyTokenAcquirer.StampPolicyTokenAsync's call site (reverted afterward, verified via clean git status) to get definitive proof:

[PolicyTokenAcquirer] Intercept PUT https://management.azure.com/subscriptions/.../resourceGroups/rg-cs-cdn-debug-test/providers/Microsoft.Cdn/profiles/csdebugtest85182?api-version=2026-04-01-preview
[PolicyTokenAcquirer] Payload prepared.
[PolicyTokenAcquirer] POST acquirePolicyToken https://management.azure.com/subscriptions/.../providers/Microsoft.Authorization/acquirePolicyToken?api-version=2025-03-01
[PolicyTokenAcquirer] Response 200 OK
[PolicyTokenAcquirer] Token acquired and header added.
[PolicyTokenAcquirer] Intercept GET https://management.azure.com/subscriptions/.../operationresults/...  (async operation poll)
[PolicyTokenAcquirer] Skip: verb not allowed for token acquisition.

This confirms: the outgoing PUT was intercepted, a real POST to ARM's acquirePolicyToken endpoint was made and returned 200 OK, the token was stamped onto the request as the x-ms-policy-external-evaluations header, and the subsequent async-poll GET was correctly skipped by the write-verb gate.

Additional live test — generated (non-custom-fronted) cmdlet

The scenarios above cover the two custom-fronted profile cmdlets. To also verify the code path that was never broken (plain generated cmdlets, which already had working dynamicparam forwarding before this PR), added and live-tested a new scenario against New-AzFrontDoorCdnRuleSet — a fully generated cmdlet with no custom/*.ps1 front:

PS> New-AzFrontDoorCdnProfile -ResourceGroupName rg-cs-cdn-ruleset-test -Name fdp63143 -SkuName Standard_AzureFrontDoor -Location Global -Confirm:$false
PS> New-AzFrontDoorCdnRuleSet -ResourceGroupName rg-cs-cdn-ruleset-test -ProfileName fdp63143 -Name ruleset63143 -AcquirePolicyToken -Confirm:$false
RESULT: SUCCESS ruleset63143

This gives explicit regression coverage for both the custom-fronted path (fixed by this PR) and the plain-generated path (already correct), so a future change that breaks either one will be caught by TestLiveScenarios.ps1.

Generator fix: Azure/autorest.powershell#1555

…ile cmdlets Regenerated Az.Cdn with the autorest.powershell generator fix (see Azure/autorest.powershell#1555): the outer proxy for custom-fronted write cmdlets (New/Remove/Update-Az{,FrontDoor}CdnProfile) now forwards the wrapped custom function's dynamicparam block, so -AcquirePolicyToken and -ChangeReference actually bind on these commands. Previously they were rejected with 'A parameter cannot be found that matches parameter name AcquirePolicyToken', even though the module was already opted into enable-change-safety. Live-validated: New-AzFrontDoorCdnProfile -AcquirePolicyToken now successfully creates a profile in a real subscription.

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

azure-pipelines · 2026-08-12T14:39:49Z

Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run.

Aditya Pujara (a0x1ab) · 2026-08-12T14:41:21Z

/azp run

azure-pipelines · 2026-08-12T14:41:37Z

Azure Pipelines: Successfully started running 3 pipeline(s).

The manual regeneration used to apply the change-safety dynamicparam fix pointed -ExamplesFolder at generated/Cdn/Cdn.Autorest/examples, which does not exist (the real, hand-maintained example .md files live at src/Cdn/Cdn.Autorest/examples). Export-ProxyCmdlet found no matching example for any cmdlet and fell back to the '{{ Add code here }}' placeholder in every exported cmdlet's comment-based help. Re-ran the regeneration with the correct examples path to restore the real examples; the change-safety dynamicparam fix is unaffected.

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T02:53:03Z

/azp run

azure-pipelines · 2026-08-13T02:53:18Z

Azure Pipelines: Successfully started running 3 pipeline(s).

The bare autorest run in the earlier regeneration (68ff900) reset src/Cdn/Cdn.Autorest/Properties/AssemblyInfo.cs's AssemblyVersion/ AssemblyFileVersion from the real released 6.0.2 to AutoRest's default placeholder 0.1.0.0. The generated/ copy (the one actually compiled into the shipped Az.Cdn.private.dll) was unaffected and still correctly says 6.0.2; this only restores the stray src/ copy so it doesn't poison a future regeneration cycle.

Copilot

Copilot wasn't able to review any files in this pull request.

The regeneration used the local autorest.powershell generator (via a directory junction into the AutoRest extension cache) instead of the officially published @autorest/powershell@4.0.754 npm package that CI uses. The generator embeds its own source file path into a diagnostic comment (a limitation note about deserializeFromResponse and headers), so this comment picked up my local dev machine's absolute path instead of the original CI path. Purely cosmetic/non-functional; reverted to keep the diff free of unrelated, machine-specific noise.

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T03:52:59Z

/azp run

azure-pipelines · 2026-08-13T03:53:14Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…dlet New-AzFrontDoorCdnRuleSet has no custom/*.ps1 front, so its dynamicparam forwarding was already working before this PR's fix (only the custom-fronted profile cmdlets were broken). Adding this scenario alongside the existing custom-fronted ones gives explicit regression coverage for both code paths going forward. Live-validated: created a real Front Door rule set end-to-end with -AcquirePolicyToken in the BAMI tenant.

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T04:29:47Z

/azp run

azure-pipelines · 2026-08-13T04:30:03Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T05:36:58Z

/azp run

azure-pipelines · 2026-08-13T05:37:13Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-08-13T05:42:14Z

Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run.

… cmdlets, not just profile cmdlets

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T05:58:09Z

/azp run

azure-pipelines · 2026-08-13T05:58:25Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…(matches Aks/ContainerRegistry/EventHub/ServiceBus)

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T06:22:07Z

/azp run

azure-pipelines · 2026-08-13T06:22:25Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…dn migration/route/sku cmdlets

Copilot

Copilot wasn't able to review any files in this pull request.

Aditya Pujara (a0x1ab) · 2026-08-13T06:47:06Z

/azp run

azure-pipelines · 2026-08-13T06:47:22Z

Azure Pipelines: Successfully started running 3 pipeline(s).

YangAn-microsoft added 2 commits August 12, 2026 18:14

Change Safety: opt in Az.Cdn (profiles + AFD endpoints) and regenerate

68ff900

Copilot AI lite review requested due to automatic review settings August 12, 2026 14:39

Copilot AI reviewed Aug 12, 2026

View reviewed changes

YangAn-microsoft mentioned this pull request Aug 13, 2026

Fix change-safety dynamicparam forwarding for custom-fronted cmdlets Azure/autorest.powershell#1555

Merged

Microsoft Azure (Azure) deleted a comment from ayang008 Aug 13, 2026

Copilot AI review requested due to automatic review settings August 13, 2026 02:48

Copilot AI reviewed Aug 13, 2026

View reviewed changes

YangAn-microsoft marked this pull request as draft August 13, 2026 03:44

Copilot AI review requested due to automatic review settings August 13, 2026 03:45

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 13, 2026 03:49

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 13, 2026 04:28

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Restore trailing newline in AssemblyInfo.cs

4be82dc

Copilot AI review requested due to automatic review settings August 13, 2026 05:36

Copilot AI reviewed Aug 13, 2026

View reviewed changes

YangAn-microsoft marked this pull request as ready for review August 13, 2026 05:42

Correct ChangeLog.md scope: change safety opt-in applies to all write…

63e7baa

… cmdlets, not just profile cmdlets

Copilot AI review requested due to automatic review settings August 13, 2026 05:49

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Align Cdn ChangeLog wording with established ChangeSafety convention …

4bc10e1

…(matches Aks/ContainerRegistry/EventHub/ServiceBus)

Copilot AI review requested due to automatic review settings August 13, 2026 06:11

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Fix Change Safety dynamicparam forwarding for 7 more custom-fronted C…

6bac0a5

…dn migration/route/sku cmdlets

Copilot AI review requested due to automatic review settings August 13, 2026 06:40

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Yabo Hu (VeryEarly) self-assigned this Aug 13, 2026

Yabo Hu (VeryEarly) marked this pull request as draft August 13, 2026 09:34

Uh oh!

Conversation

YangAn-microsoft commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

Validation — live test evidence

Deeper verification — proof the token acquisition pipeline actually fired

Additional live test — generated (non-custom-fronted) cmdlet

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

azure-pipelines Bot commented Aug 12, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 12, 2026

Uh oh!

azure-pipelines Bot commented Aug 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 13, 2026

Uh oh!

azure-pipelines Bot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

YangAn-microsoft commented Aug 12, 2026 •

edited

Loading