.NET/Python: Purview: prefer token principal for user identity

[taisirhassan]

Motivation & Context

Purview middleware needs consistent identity resolution across .NET and Python. User-token credentials should evaluate policy for the authenticated token principal, while app-token flows should continue to support supplied end-user IDs for policy scoping.

This also aligns the content activities route with the other Purview Graph user routes.

Description & Review Guide

• What are the major changes?

  • Resolve Purview user identity by inspecting token info first in both .NET and Python middleware.
  • Use supplied/message fallback user IDs only when the token has no user principal.
  • Require .NET message userId fallback values to parse as GUIDs, matching Python validation.
  • Fix .NET content activities URL to use /users/{userId}/....
  • Add/update regression tests for token precedence, invalid fallback IDs, scope location matching, and content activity route construction.

• What is the impact of these changes?

  • User-token flows consistently bind policy evaluation to the authenticated user.
  • App-token flows remain supported through validated supplied/message user IDs.
  • Content activity audit requests use the documented user route.

• What do you want reviewers to focus on?

  • Identity precedence in ScopedContentProcessor / _processor.py.
  • App-token fallback behavior remains supported.
  • Route assertion in PurviewClientTests.

Related Issue

No public issue. Security hardening and parity fix for Purview middleware.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/purview/agent_framework_purview
_processor.py	182	12	93%	175, 255–258, 285, 313–314, 325, 327, 333, 335
TOTAL	42148	4981	88%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8302	37 💤	0 ❌	0 🔥	2m 8s ⏱️

[Copilot]

Pull request overview

This PR updates the Purview middleware identity resolution to prefer the authenticated token’s user principal (when present), with validated fallbacks for app-token scenarios, and aligns the .NET content activities route with the documented /users/{userId}/... Graph endpoint.

Changes:

• Python: always inspect token info up front and use token user_id before considering provided/message fallbacks; update docs and tests accordingly.
• .NET: validate message-supplied userId fallbacks as GUIDs, prefer token UserId over message metadata, and add regression tests for precedence + scope-location matching.
• .NET: fix SendContentActivitiesAsync to call /users/{userId}/dataSecurityAndGovernance/activities/contentActivities and update the unit test.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/packages/purview/tests/purview/test_processor.py	Updates tests to account for unconditional token inspection and token-user precedence.
python/packages/purview/README.md	Updates guidance to clarify user-token vs app-token user identity behavior.
python/packages/purview/agent_framework_purview/_processor.py	Changes identity resolution order to prefer token principal, then validated fallbacks.
dotnet/tests/Microsoft.Agents.AI.Purview.UnitTests/ScopedContentProcessorTests.cs	Adds/updates tests for token precedence, GUID validation, and location matching.
dotnet/tests/Microsoft.Agents.AI.Purview.UnitTests/PurviewClientTests.cs	Updates expected content activities URL to the /users/{userId}/... route.
dotnet/src/Microsoft.Agents.AI.Purview/ScopedContentProcessor.cs	Implements token-first user identity resolution and GUID validation for message fallbacks.
dotnet/src/Microsoft.Agents.AI.Purview/README.md	Updates docs describing token-principal precedence and app-token expectations.
dotnet/src/Microsoft.Agents.AI.Purview/PurviewClient.cs	Fixes content activities endpoint construction to use /users/{userId}/....