fix: automatic device code fallback when Conditional Access Policy blocks browser/WAM auth (#294)#323
Merged
sellakumaran merged 3 commits intomainfrom Mar 25, 2026
Merged
Conversation
…ocks browser/WAM auth (#294) When AADSTS53003 (Conditional Access Policy) or AADSTS53000 (device compliance policy) blocks interactive browser or WAM authentication, the CLI now automatically falls back to device code flow instead of failing with no recovery path. Covers all 6 browser auth locations: - MsalBrowserCredential (primary fix, covers AuthenticationService, InteractiveGraphAuthService, MicrosoftGraphTokenProvider MSAL path, and BlueprintSubcommand) - MicrosoftGraphTokenProvider PowerShell path (retries Connect-MgGraph with -UseDeviceCode) - AuthenticationService belt-and-suspenders catch for future custom credential implementations Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves CLI resiliency in enterprise tenants by automatically falling back to device code authentication when interactive browser/WAM auth is blocked by Conditional Access (AADSTS53003) or device compliance policy (AADSTS53000), addressing the login dead-end reported in #294.
Changes:
- Add CAP/device-compliance detection constants and use them to trigger automatic device code fallback.
- Implement fallback logic in MSAL browser/WAM path and in the PowerShell
Connect-MgGraphpath (retry with-UseDeviceCode). - Extend AuthenticationService tests to cover CAP/device-compliance fallback behavior and logging.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Microsoft.Agents.A365.DevTools.Cli/Services/MsalBrowserCredential.cs | Adds CAP/device-compliance detection and automatic device code fallback for interactive auth. |
| src/Microsoft.Agents.A365.DevTools.Cli/Services/Internal/MicrosoftGraphTokenProvider.cs | Retries PowerShell Graph auth with device code when CAP/device compliance blocks browser auth. |
| src/Microsoft.Agents.A365.DevTools.Cli/Services/AuthenticationService.cs | Adds a defensive CAP/device-compliance catch to initiate device code flow. |
| src/Microsoft.Agents.A365.DevTools.Cli/Constants/AuthenticationConstants.cs | Introduces constants for AADSTS53003/AADSTS53000 detection. |
| src/Tests/Microsoft.Agents.A365.DevTools.Cli.Tests/Services/AuthenticationServiceTests.cs | Adds regression tests ensuring fallback happens only for the intended CAP/device-compliance errors. |
| CHANGELOG.md | Documents the new automatic fallback behavior under Unreleased. |
src/Microsoft.Agents.A365.DevTools.Cli/Services/AuthenticationService.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Services/AuthenticationService.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Constants/AuthenticationConstants.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Services/Internal/MicrosoftGraphTokenProvider.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Services/MsalBrowserCredential.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Agents.A365.DevTools.Cli/Services/MsalBrowserCredential.cs
Outdated
Show resolved
Hide resolved
gwharris7
previously approved these changes
Mar 24, 2026
- Remove belt-and-suspenders CAP catch from AuthenticationService (C1/C2): unreachable in production and risked double device code attempt - Fix doc comment in AuthenticationConstants: device code flow may still be affected by CAP policies, not "bypasses" them (C3) - Fix log message in MicrosoftGraphTokenProvider to cover both AADSTS53003 and AADSTS53000 (Conditional Access and device compliance) (C4) - Fix ErrorCode placeholder in MsalBrowserCredential to log the AADSTS code (extracted from message) instead of the OAuth "access_denied" code (C5) - Fix comment in MsalBrowserCredential: "may still be affected" instead of "not subject to these policies" (C6) - Remove 3 tests that covered the removed belt-and-suspenders catch; keep the device code error surface test (still valid) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Anti-pattern #19: Unreachable catch clause — when the inner method already handles the exception before propagating, the outer catch is dead code and risks a double-attempt on the same fallback (the AuthenticationService belt-and-suspenders catch that slipped through review-staged). Anti-pattern #20: MsalServiceException.ErrorCode used when AADSTS code expected — ErrorCode is the OAuth code ("access_denied"), the AADSTS code (e.g. AADSTS53003) is only in ex.Message; using ErrorCode in log messages produces misleading diagnostics. Anti-pattern #21: Log message / comment covers fewer cases than the code handles — when a when-clause matches two error codes but the log only names one, operators are misled during triage; also catches "bypasses" / "not subject to" claims in comments that are not universally true. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
gwharris7
approved these changes
Mar 24, 2026
ajmfehr
approved these changes
Mar 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When AADSTS53003 (Conditional Access Policy) or AADSTS53000 (device compliance policy) blocks interactive browser or WAM authentication, the CLI now automatically falls back to device code flow instead of failing with no recovery path. Covers all 6 browser auth locations:
Closes #294