[RecoveryServices.Backup] Add Azure Files managed identity support by bharatpurwar · Pull Request #30116 · Azure/azure-powershell

Bharat Purwar (bharatpurwar) · 2026-09-07T13:59:57Z

🤖 PR Validation — ⚠️ Review suggested

Tests
⚠️ 24/24

️✔️Az.Accounts

️✔️Build

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Az.Compute

️✔️Build

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Az.Network

️✔️Build

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

⚠️Az.RecoveryServices

️✔️Build

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Breaking Change Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Signature Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

⚠️Help Example Check

⚠️PowerShell Core - Windows

Type Cmdlet Example Line RuleName Description Extent Remediation

⚠️ Enable-AzRecoveryServicesBackupProtection 2 1 Unassigned_Variable Enable-AzRecoveryServicesBackupProtection -Item $Item is a null-valued parameter value. -Item Assign value for $Item.

⚠️ Enable-AzRecoveryServicesBackupProtection 2 1 Unassigned_Variable Enable-AzRecoveryServicesBackupProtection -Policy $Pol is a null-valued parameter value. -Policy Assign value for $Pol.

⚠️ Enable-AzRecoveryServicesBackupProtection 2 1 Unassigned_Variable Enable-AzRecoveryServicesBackupProtection -VaultId $vault is a null-valued parameter value. -VaultId Assign value for $vault.

⚠️ Restore-AzRecoveryServicesBackupItem 7 8 Unassigned_Variable Restore-AzRecoveryServicesBackupItem -WLRecoveryConfig $AnotherInstanceWithLogConfig is a null-valued parameter value. -WLRecoveryConfig Assign value for $AnotherInstanceWithLogConfig.

⚠️ Restore-AzRecoveryServicesBackupItem 9 4 Unassigned_Variable Restore-AzRecoveryServicesBackupItem -RestoreDiskList $restoreDiskLUNs is a null-valued parameter value. -RestoreDiskList Assign value for $restoreDiskLUNs.

⚠️ Restore-AzRecoveryServicesBackupItem 13 3 Unassigned_Variable Get-AzRecoveryServicesBackupRecoveryPoint -Item $item is a null-valued parameter value. -Item Assign value for $item.

⚠️Windows PowerShell - Windows

Type Cmdlet Example Line RuleName Description Extent Remediation

⚠️ Enable-AzRecoveryServicesBackupProtection 2 1 Unassigned_Variable Enable-AzRecoveryServicesBackupProtection -Item $Item is a null-valued parameter value. -Item Assign value for $Item.

⚠️ Enable-AzRecoveryServicesBackupProtection 2 1 Unassigned_Variable Enable-AzRecoveryServicesBackupProtection -Policy $Pol is a null-valued parameter value. -Policy Assign value for $Pol.

⚠️ Enable-AzRecoveryServicesBackupProtection 2 1 Unassigned_Variable Enable-AzRecoveryServicesBackupProtection -VaultId $vault is a null-valued parameter value. -VaultId Assign value for $vault.

⚠️ Restore-AzRecoveryServicesBackupItem 7 8 Unassigned_Variable Restore-AzRecoveryServicesBackupItem -WLRecoveryConfig $AnotherInstanceWithLogConfig is a null-valued parameter value. -WLRecoveryConfig Assign value for $AnotherInstanceWithLogConfig.

⚠️ Restore-AzRecoveryServicesBackupItem 9 4 Unassigned_Variable Restore-AzRecoveryServicesBackupItem -RestoreDiskList $restoreDiskLUNs is a null-valued parameter value. -RestoreDiskList Assign value for $restoreDiskLUNs.

⚠️ Restore-AzRecoveryServicesBackupItem 13 3 Unassigned_Variable Get-AzRecoveryServicesBackupRecoveryPoint -Item $item is a null-valued parameter value. -Item Assign value for $item.

️✔️Help File Existence Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️File Change Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️UX Metadata Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Test

️✔️PowerShell Core - Linux

️✔️PowerShell Core - MacOS

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

Summary

Add managed identity authentication support for Azure Files backup storage-account registration and protection.
Support both system-assigned managed identity (SAMI) and user-assigned managed identity (UAMI), while preserving the existing key-based flow.
Add identity selection to Azure Files restore and allow alternate-location target storage-account lookup through -TargetSubscriptionId.

What changed

Register and enable protection

Extend Register-AzRecoveryServicesBackupContainer -BackupManagementType AzureStorage with:
- -StorageAccountName
- -AccessType KeyBased|IdentityBased
- -IsSystemAssignedIdentity
- -UserAssignedIdentityArmUrl
- -Force
Extend Enable-AzRecoveryServicesBackupProtection with the same access and identity parameters.
Register an unregistered storage account before protection is configured.
Re-register an existing storage account when its access type or selected identity changes, with confirmation unless -Force is supplied.
Use server-side storage-account name filters in the explicit registration flow and preserve the existing enable-protection discovery behavior.

Restore

Extend Restore-AzRecoveryServicesBackupItem for Azure Files with:
- -IsSystemAssignedIdentity
- -UserAssignedIdentityArmUrl
- -TargetSubscriptionId
Put the selected identity directly on AzureFileShareRestoreRequest.IdentityInfo; restore does not register or re-register the storage account.
Preserve key-based restore when no identity parameter is supplied.

Models and validation

Expose AccessType and IdentityInfo on the PowerShell AzureFileShareContainer model.
Reject conflicting or incomplete access/identity parameter combinations before sending a request.
Preserve the API 2026-07-01 SDK already merged into main; retain the explicit RecoveryServicesBackupClient title safeguard in the generation configuration.

Validation

Built the current merged RecoveryServices module from this branch and imported the local artifact for live tests.
Fresh UAMI bhar11-afs-uami-09151013:
- New registration succeeded and persisted the requested UAMI.
- Enable protection completed.
- On-demand backup completed and produced recovery point 1847539278673753602.
- UAMI restore completed; the restored destination was verified through Az.Storage.
UAMI re-registration on a second account succeeded; protection and backup completed.
- Restore on that second account failed with service error 520159 because the file-share snapshot for the recovery point could not be found. A retry returned the same snapshot error. The clean UAMI restore on the first account confirms identity authorization and request serialization.
SAMI:
- Same-identity registration succeeded.
- On-demand backup and restore completed; the restored destination was verified through Az.Storage.
UAMI-to-SAMI-to-UAMI re-registration round trip succeeded, and each identity was verified from the returned container.
PR build, generated SDK, signature, breaking-change, and help-file existence checks pass.

Notes

Azure Files PowerShell workload value is AzureFiles.
The storage account requires the Storage File Backup Contributor role for identity-based registration/backup.
Restore targets require the Storage Account Restore Contributor role.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

azure-pipelines · 2026-09-07T14:00:06Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

🟡 Changes recommended

There are correctness/diagnostic regressions in key call paths (unawaited async SDK calls and loss of request-id visibility in failure exceptions) that should be fixed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request updates the Recovery Services Backup management SDK to the 2026-07-01 API version by regenerating the AutoRest client and adapting the RecoveryServices Backup adapter/models to the new generated method signatures and types.

Changes:

Updated SDK generation configuration (spec commit + input swagger path) and regenerated the Backup management SDK for 2026-07-01.
Adjusted client adapter call sites to new parameter names/order (e.g., filter strings, reordered resourceGroupName/vaultName).
Updated cmdlet model types/mappings to align with regenerated SDK model changes (e.g., new header/result models and error detail shape).

File summaries

File	Description
src/RecoveryServices/RecoveryServices/Common/PSRecoveryServicesVaultClient.cs	Updates backup client calls to regenerated parameter names/order.
src/RecoveryServices/RecoveryServices.Backup.ServiceClientAdapter/BMSAPIs/ProtectableItemAPI.cs	Adapts protectable-item listing to regenerated `filter`/paging signature.
src/RecoveryServices/RecoveryServices.Backup.Models/AzureVmWorkloadModels/AzureWorkloadSQLDatabaseProtectedItem.cs	Aligns workload protected-item model with regenerated error-detail type.
src/RecoveryServices/RecoveryServices.Backup.Models/AzureVmWorkloadModels/AzureWorkloadSAPHanaDatabaseProtectedItem.cs	Aligns workload protected-item model with regenerated error-detail type.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/README.md	Updates AutoRest generation inputs to `2026-07-01` spec location/commit.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/ValidateOperationStatusesOperationsExtensions.cs	Regenerated SDK extensions for validate operation statuses.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/ValidateOperationResultsOperationsExtensions.cs	Regenerated SDK extensions for validate operation results.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/TieringCostOperationStatusOperationsExtensions.cs	Regenerated SDK extensions for tiering cost operation status.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/SecurityPINsOperationsExtensions.cs	Regenerated SDK extensions for Security PIN operations.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/ResourceGuardProxiesOperationsExtensions.cs	Regenerated SDK extensions reflecting reordered RG/vault parameters.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/ProtectionContainerRefreshOperationResultsOperationsExtensions.cs	Regenerated SDK extensions for protection container refresh results.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/OperationsExtensions.cs	Regenerated SDK extensions for provider operations listing.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/OperationOperationsExtensions.cs	Regenerated SDK extensions for validate/operation group.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/VaultResource.cs	New regenerated model for vault resource schema.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ValidateOperationTriggerHeaders.cs	New regenerated headers model for validate-operation trigger.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ValidateOperationResponse.cs	Regenerated model now using `ErrorDetailAutoGenerated` list.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ThreatStatus.cs	New regenerated string-constant “enum” for threat status.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ThreatState.cs	New regenerated string-constant “enum” for threat state.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ThreatSeverity.cs	New regenerated string-constant “enum” for threat severity.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/SubProtectionPolicy.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/SourceSideScanSummary.cs	New regenerated string-constant “enum” for scan summary.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/SourceSideScanStatus.cs	New regenerated string-constant “enum” for scan status.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/SourceSideScanInfo.cs	New regenerated model for source-side scan info.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/SourceScanAction.cs	New regenerated string-constant “enum” for source scan action.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/Settings.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/SecuredVMDetails.cs	Regenerated model adds data-disk encryption settings.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RetentionDuration.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RestoresTriggerHeaders.cs	New regenerated headers model for restore trigger.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPointTierStatus.cs	Regenerated tier-status changed from enum to string constants.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPointTierInformationV2.cs	Regenerated model changes tier status type to string.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPointTierInformation.cs	Regenerated model changes tier status type to string.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPointRehydrationInfo.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPointProperties.cs	Regenerated model adds immutability properties + validation hook.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPointImmutabilityProperties.cs	New regenerated model for recovery point immutability.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/RecoveryPoint.cs	Regenerated model adds threat status/info fields.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ProxyResource.cs	New regenerated base model for proxy resources.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ProtectionPoliciesDeleteHeaders.cs	New regenerated headers model for policy delete.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ProtectionContainersRegisterHeaders.cs	New regenerated headers model for container register.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ProtectionContainer.cs	Regenerated container model adds `sourceLocation`.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ProtectedItemsCreateOrUpdateHeaders.cs	New regenerated headers model for protected-item create/update.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ProtectedItemConfigureSourceScanRequest.cs	New regenerated request model for configuring source scan.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/PrivateEndpointConnectionPutHeaders.cs	New regenerated headers model for private endpoint PUT.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/PrivateEndpointConnectionDeleteHeaders.cs	New regenerated headers model for private endpoint DELETE.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/PreValidateEnableBackupResponse.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/PreValidateEnableBackupRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/PrepareDataMoveRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/PerDiskEncryptionSetId.cs	New regenerated model for per-disk DES identifiers.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/Page1.cs	Removes obsolete generated paging wrapper type.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/MoveRecoveryPointHeaders.cs	New regenerated headers model for move recovery point.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/MabContainer.cs	Regenerated container model adds `sourceLocation` and updates base ctor.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/KeyAndSecretDetails.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/InquiryValidation.cs	Regenerated model uses `ErrorDetailAutoGenerated`.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/InquiryInfo.cs	Regenerated model uses `ErrorDetailAutoGenerated`.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/IdentityInfo.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/IaaSVMContainer.cs	Regenerated container model adds `sourceLocation` and updates base ctor.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/HourlySchedule.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/GenericRecoveryPoint.cs	Regenerated recovery point model adds threat status/info + validation.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/GenericContainer.cs	Regenerated container model adds `sourceLocation` and updates base ctor.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/FetchTieringCostPostHeaders.cs	Regenerated headers model adds Retry-After.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/FetchTieringCostInfoRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ErrorResponseException.cs	Regenerated exception type for error responses.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ErrorResponse.cs	New regenerated ARM-style error response model.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ErrorDetailAutoGenerated.cs	New regenerated error-detail model (code/message/recommendations).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/DpmContainer.cs	Regenerated container model adds `sourceLocation` and updates base ctor.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/DistributedNodesInfo.cs	Regenerated model uses `ErrorDetailAutoGenerated`.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/DiskDetails.cs	New regenerated model for disk details.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/DataDiskDetails.cs	New regenerated model for encrypted data disk details.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/CreatedByType.cs	New regenerated string-constant “enum” for created-by type.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ConfigureSourceScanExecuteHeaders.cs	New regenerated headers model for source-scan operation.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/CloudError.cs	Regenerated error model naming/shape; updated summary text.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/ClientScriptForConnect.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/BmsTriggerDataMoveHeaders.cs	New regenerated headers model for data move trigger.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/BmsPrepareDataMoveHeaders.cs	New regenerated headers model for prepare data move.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/BackupFabricResource.cs	New regenerated model for backup fabric resource schema.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSQLRestoreWithRehydrateRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSQLRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSQLPointInTimeRestoreWithRehydrateRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSQLPointInTimeRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPHanaRestoreWithRehydrateRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPHanaRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPHanaRecoveryPoint.cs	Regenerated model adds threat status/info and validate override.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPHanaPointInTimeRestoreWithRehydrateRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPHanaPointInTimeRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPAseRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPAseRecoveryPoint.cs	Regenerated model adds threat status/info and validate override.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadSAPAsePointInTimeRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadRecoveryPoint.cs	Regenerated model adds threat status/info + validation.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadPointInTimeRestoreRequest.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureWorkloadContainer.cs	Regenerated container model adds `sourceLocation` and updates base ctor.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSQLInstanceProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSQLDatabaseProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSQLAvailabilityGroupProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSAPHanaSystemProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSAPHanaHSRProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSAPHanaDBInstance.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSAPHanaDatabaseProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSAPAseSystemProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadSAPAseDatabaseProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVmWorkloadProtectableItem.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureVMAppContainerProtectionContainer.cs	Regenerated container model adds `sourceLocation` in ctor chain.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureSqlContainer.cs	Regenerated container model adds `sourceLocation` and updates base ctor.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureSQLAGWorkloadContainerProtectionContainer.cs	Regenerated container model adds `sourceLocation` in ctor chain.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureIaaSVMProtectionPolicy.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureIaaSVMJobTaskDetails.cs	Regenerated model doc/formatting updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureIaaSComputeVMContainer.cs	Regenerated container model adds `sourceLocation` in ctor chain.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureIaaSClassicComputeVMContainer.cs	Regenerated container model adds `sourceLocation` in ctor chain.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureFileShareRestoreRequest.cs	Regenerated model adds managed identity info for restore.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureFileShareRecoveryPoint.cs	Regenerated model adds threat status/info + validation.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AzureBackupServerContainer.cs	Regenerated container model adds `sourceLocation` in ctor chain.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/Models/AccessType.cs	New regenerated string-constant “enum” for access type.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/JobsOperationsExtensions.cs	Regenerated jobs export extension now takes `filter` string.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IValidateOperationStatusesOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IValidateOperationResultsOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IValidateOperationOperations.cs	Regenerated interface now returns header response for trigger operations.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/ITieringCostOperationStatusOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/ISecurityPINsOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IResourceGuardProxiesOperations.cs	Regenerated interface parameter order updated (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IRecoveryPointsRecommendedForMoveOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IProtectionPolicyOperationResultsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IProtectionContainerRefreshOperationResultsOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IProtectionContainerOperationResultsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IProtectedItemOperationResultsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IProtectableContainersOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IPrivateEndpointOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IOperations.cs	Regenerated interface doc updates for provider operations.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IOperationOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IJobsOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IJobOperationResultsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IJobDetailsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IJobCancellationsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IGetTieringCostOperationResultOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IFetchTieringCostOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IExportJobsOperationResultsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IDeletedProtectionContainersOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBMSPrepareDataMoveOperationResultOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupUsageSummariesOperations.cs	Regenerated interface now returns IPage + supports ListNext.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupResourceEncryptionConfigsOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupProtectionIntentOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupProtectionContainersOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupProtectedItemsOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupProtectableItemsOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupPoliciesOperations.cs	Regenerated interface parameter order/doc updates (RG first).
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupOperationStatusesOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupOperationResultsOperations.cs	Regenerated interface signature/doc updates.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/IBackupJobsOperations.cs	Regenerated interface now takes `filter` string instead of ODataQuery.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/GetTieringCostOperationResultOperationsExtensions.cs	Regenerated SDK extensions for tiering cost results.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/FeatureSupportOperations.cs	Regenerated operation implementation for feature validation endpoint.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/BackupStatusOperations.cs	Regenerated operation implementation for backup status endpoint.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/BackupOperationStatusesOperationsExtensions.cs	Regenerated SDK extensions for backup operation statuses.
src/RecoveryServices/RecoveryServices.Backup.Management.Sdk/Generated/BackupOperationResultsOperationsExtensions.cs	Regenerated SDK extensions for backup operation results.
src/RecoveryServices/RecoveryServices.Backup.Helpers/HelperUtils.cs	Broadens paging helper to support non-Resource page item types.

Review details

Files reviewed: 1/319 changed files
Comments generated: 7
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

The Recovery Services Backup management SDK was regenerated from API 2026-07-01. The regenerated contracts reorder vault and resource-group parameters that share the same string type, replace OData query objects with raw filter parameters, add typed response-header wrappers, change usage summaries to a paged response, and move the Backup-specific error detail shape. Existing consumers therefore either failed to compile or could silently construct incorrect requests and lose response metadata. Update generated-operation calls to use named arguments so vault and resource-group values remain bound correctly. Preserve the existing adapter surface by extracting Filter values from OData query objects and mapping typed SDK responses back to the response types consumed by the PowerShell layer. Copy Body where applicable, Request, Response, and RequestId so status codes, raw HTTP headers, and request identifiers are retained. Follow continuation links returned by BackupUsageSummaries and broaden the shared paging helper constraint from generated Resource to class; the helper only enumerates pages and does not depend on Resource members. Map SQL and SAP HANA last-backup errors to ErrorDetailAutoGenerated, which retains the Backup-specific code, message, and recommendations contract. Use Begin responses for operations whose completion remains tracked by the existing PowerShell helpers so the initial tracking response is not consumed by generated polling. Add a user-facing ChangeLog entry for the API migration. The affected Backup module and test projects compile with zero warnings and errors. Historical playback recordings still target API 2025-02-01 and require separate API 2026-07-01 refresh and behavioral validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Aditya Pujara (a0x1ab) · 2026-09-07T14:10:04Z

/azp run

azure-pipelines · 2026-09-07T14:10:21Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🟡 Changes recommended

There are verified correctness/diagnostics issues in updated call sites and generated error handling (discarded async tasks and loss of service error messages) that should be fixed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 1/320 changed files
Comments generated: 4
Review effort level: Lite

Bharat Purwar (bharatpurwar) · 2026-09-07T14:26:53Z

/azp run

azure-pipelines · 2026-09-07T14:27:00Z

Commenter does not have sufficient privileges for PR 30116 in repo Azure/azure-powershell

github-actions · 2026-09-09T01:36:15Z

‼️ DO NOT MERGE THIS PR ‼️
This PR was labeled "Do Not Merge" because it contains code change that cannot be merged. Please contact the reviewer for more information.

Adapt the hand-written Recovery Services exception boundaries to the ErrorResponseException contract emitted by the regenerated Backup management SDK. Preserve policy-name availability checks by treating an aggregate ErrorResponseException with HTTP 404 the same way as the previous aggregate CloudException 404. Map generated error code, message, details, and existing PowerShell error categories without changing unrelated exception handling. This change intentionally excludes LRO polling, header parsing, data-move routing, retry behavior, and unrelated cleanup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Copilot

🔵 Needs a closer look

Confirmed functional issues were found in updated call sites (unobserved async tasks and missing skipToken propagation) and the PR’s CI indicates failing Az.RecoveryServices tests.

Review details

Files reviewed: 1/323 changed files
Comments generated: 0 new
Review effort level: Lite

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Use the API 2026-07-01 SDK already merged in main while preserving Azure Files managed identity support. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Aditya Pujara (a0x1ab) · 2026-09-15T03:44:32Z

/azp run

azure-pipelines · 2026-09-15T03:44:56Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🟡 Changes recommended

Unresolved identity propagation and parameter-validation issues affect Azure Files restore and registration behavior.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Suppressed comments (4)

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Restore/RestoreAzureRMRecoveryServicesBackupItem.cs:337

Adding TargetSubscriptionId to the Azure Files parameter set allows it to be supplied without TargetStorageAccountName. In that case the provider only uses the subscription when a target storage account is present (AzureFilesPsBackupProvider.cs:302-305), so the command silently performs an original-location restore and ignores the requested target subscription. Require this parameter to be paired with the alternate-location target fields, or otherwise reject the unsupported combination.

        [Parameter(Mandatory = false, ParameterSetName = AzureFileShareParameterSet,
            HelpMessage = ParamHelpMsgs.RestoreFS.TargetSubscriptionId)]
        public string TargetSubscriptionId { get; set; }

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Restore/RestoreAzureRMRecoveryServicesBackupItem.cs:337

The new Azure Files TargetSubscriptionId parameter is accepted together with -RestoreToSecondaryRegion, but the provider still enters the CRR path and only uses the subscription while resolving the target account. The resource bundle already states that cross-region and cross-subscription restore are mutually exclusive (CRRNotSupportedWIthCSR), so this combination should be rejected before sending an unsupported request.

        [Parameter(Mandatory = false, ParameterSetName = AzureFileShareParameterSet,
            HelpMessage = ParamHelpMsgs.RestoreFS.TargetSubscriptionId)]
        public string TargetSubscriptionId { get; set; }

src/RecoveryServices/RecoveryServices.Backup/ParamHelpMsgs.cs:129

These new public parameters are not reflected in the checked-in cmdlet help: the Register and Enable help files have no Azure Files access/identity entries, and Restore help has no IsSystemAssignedIdentity or UserAssignedIdentityArmUrl entry and lists TargetSubscriptionId only for the VM parameter set. Regenerate the shipped help under src/RecoveryServices/RecoveryServices/help so users can discover the new syntax and parameter-set behavior.

            public const string AccessType = "Specifies how backup accesses the storage account for Azure Files backup. Allowed values: 'KeyBased' (shared key, default) or 'IdentityBased' (vault managed identity via RBAC). When 'IdentityBased', an identity must be provided via -IsSystemAssignedIdentity or -UserAssignedIdentityArmUrl.";
            public const string IsSystemAssignedIdentity = "Switch to use the vault's system-assigned managed identity to access the storage account for identity-based Azure Files backup.";
            public const string UserAssignedIdentityArmUrl = "The ARM resource id (ARM URL) of the user-assigned managed identity used to access the storage account for identity-based Azure Files backup.";
            public const string ForceReregister = "Forces re-registration of the storage account when the access type or identity changes (prevents the confirmation prompt).";

src/RecoveryServices/RecoveryServices/ChangeLog.md:30

The new Upcoming Release entry is appended after the existing entries, but this module's changelog convention requires new entries at the top of that section so release notes remain newest-first. Move this entry and its sub-bullets before the current line 22 entry.

* Added Managed Identity (MI) based authentication support for Azure File Share backup:
    - `Enable-AzRecoveryServicesBackupProtection` and `Register-AzRecoveryServicesBackupContainer` (extended to `-BackupManagementType AzureStorage`) now accept `-AccessType` (`KeyBased`/`IdentityBased`), `-IsSystemAssignedIdentity`, and `-UserAssignedIdentityArmUrl` to register/re-register a storage account with a vault managed identity; `-Force` re-registers when the access type or identity changes.
    - `Restore-AzRecoveryServicesBackupItem` accepts `-IsSystemAssignedIdentity` and `-UserAssignedIdentityArmUrl` for identity-based Azure File Share restore, and `-TargetSubscriptionId` to enable Cross Subscription Restore (CSR).

Files reviewed: 10/11 changed files
Comments generated: 2
Review effort level: Lite

- validate Azure Files registration parameter combinations - reject managed identity parameters for cross-region restore - add sanitized register, reregister, backup, and restore recordings Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

azure-pipelines · 2026-09-15T11:18:34Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🔵 Needs a closer look

Three unresolved moderate findings remain.

Review details

Files not reviewed (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Suppressed comments (5)

Previously missed (1) — in code that hasn't changed since the last review.

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.resx:660

The second invalid combination (supplying -StorageAccountName with -BackupManagementType AzureWorkload/MSSQL) reaches this same resource string, but the message says registration requires -StorageAccountName even though the user already supplied it. That points users toward the wrong fix; use a separate message, or state that -StorageAccountName is only valid with AzureStorage/AzureFiles, for this branch.

src/RecoveryServices/RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs:1427

This registration call submits an asynchronous request (the service returns HTTP 202), but RegisterContainer does not poll because its tracking block is commented out. Setting isRegistered immediately afterward lets the cmdlet report success before the container exists, so the next protectable-item inquiry or protection request can race the registration and fail. Wait for GetRegisterContainerOperationResult and propagate a failed operation before marking the account registered.

                    AzureWorkloadProviderHelper.RegisterContainer(unregisteredStorageAccount.Name,
                        protectionContainerResource, vaultName, vaultResourceGroupName);
                    isRegistered = true;

src/RecoveryServices/RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs:274

TargetSubscriptionId is only used by GetStorageAccountResource when targetStorageAccountName is present. With only -TargetSubscriptionId, the location validation passes and the request is built as an original-location restore, so the supplied subscription is silently ignored. Reject this combination (or otherwise require TargetStorageAccountName) before constructing the restore request.

            string targetSubscriptionId = ProviderData.ContainsKey(RestoreFSBackupItemParams.TargetSubscriptionId) ?
                (string)ProviderData[RestoreFSBackupItemParams.TargetSubscriptionId] : null;

src/RecoveryServices/RecoveryServices.Backup.Test/ScenarioTests/AzureFiles/ItemTests.ps1:1175

This new cross-subscription test only asserts failures: one uses an intentionally invalid subscription and the other omits the target subscription and uses a missing account. It never exercises a successful target-account lookup or verifies that the restore request is sent to that subscription, so the advertised -TargetSubscriptionId behavior could regress while these assertions still pass. Add a playback/live case with a valid target subscription and storage account that completes the restore.

	Assert-Throws {
		Restore-AzRecoveryServicesBackupItem `
			-VaultId $vault.ID `
			-RecoveryPoint $recoveryPoint `
			-ResolveConflict Overwrite `
			-TargetStorageAccountName $storageAccountName `
			-TargetFileShareName $fileShareName `
			-TargetSubscriptionId $targetSubscriptionId `
			-Confirm:$false `
			-ErrorAction Stop
	} ""

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Container/RegisterAzureRmRecoveryServicesBackupContainer.cs:129

The validation only rejects mismatches when the dedicated parameter set is paired with the exact AzureStorage/AzureFiles combination. A call through the ResourceId or Container sets with -BackupManagementType AzureStorage -WorkloadType MSSQL (or AzureWorkload/AzureFiles) passes this check and then reaches provider selection with an unsupported pairing instead of producing the intended parameter error. Reject any AzureStorage or AzureFiles value outside AzureFileRegister before selecting the provider.

                if (isAzureFileRegistration != hasAzureFileTypes)

Files reviewed: 20/26 changed files
Comments generated: 0 new
Review effort level: Lite

Remove the incorrect CRR and CSR incompatibility guards, add a recorded end-to-end scenario, and document the supported command flow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Aditya Pujara (a0x1ab) · 2026-09-15T20:28:01Z

/azp run

azure-pipelines · 2026-09-15T20:28:18Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Suppressed comments (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.resx:659

This resource string is used for both a missing -StorageAccountName and the opposite combination where -StorageAccountName is supplied with AzureWorkload/MSSQL. In the latter case, saying Azure Files registration “requires -StorageAccountName” is misleading and does not identify the invalid management/workload values; use a separate message or make the validation report the mismatched combination.

  <data name="AFSRegisterParameterCombinationInvalid" xml:space="preserve">
    <value>Azure Files registration requires -StorageAccountName with -BackupManagementType AzureStorage and -WorkloadType AzureFiles. The -ResourceId and -Container parameter sets support AzureWorkload registration only.</value>

Files reviewed: 20/27 changed files
Comments generated: 1
Review effort level: Lite

Reject TargetSubscriptionId when no target storage account is supplied, at both the cmdlet and provider validation boundaries, and cover the case in playback tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Aditya Pujara (a0x1ab) · 2026-09-16T03:46:38Z

/azp run

azure-pipelines · 2026-09-16T03:46:55Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🔵 Needs a closer look

Unresolved moderate findings remain in validation, restore handling, test polling, and test coverage.

Review details

Files not reviewed (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Suppressed comments (8)

Previously missed (1) — in code that hasn't changed since the last review.

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.resx:662

This message is used for both a missing -StorageAccountName and an AzureFile parameter-set call that supplies a storage account with incompatible -BackupManagementType/-WorkloadType (the isAzureFileRegistration != hasAzureFileTypes check). In the latter case the user did provide -StorageAccountName, so the error points to the wrong fix; split these validation errors or use wording that accurately covers both cases, and update the matching test assertion.

src/RecoveryServices/RecoveryServices.Backup.ServiceClientAdapter/RMAPIs/ResourceAPIs.cs:61

The new Azure Files restore path passes TargetSubscriptionId straight through, and this parameter is not validated as non-empty. With -TargetSubscriptionId '', subscriptionId != null is true and the shared resource client is switched to an empty subscription instead of retaining the current context, so a valid target-account lookup can fail. Treat an empty subscription ID as omitted here (or reject it at the cmdlet boundary).

                RMAdapter.Client.SubscriptionId = (subscriptionId != null) ?
                    subscriptionId : RMAdapter.Client.SubscriptionId;

src/RecoveryServices/RecoveryServices.Backup.Test/ScenarioTests/AzureFiles/ItemTests.ps1:900

This polling loop has no deadline or attempt limit. If the service keeps a backup job in a non-terminal state, the CheckIn/recording test will spin indefinitely and block the test run instead of failing with a diagnostic; bound the wait and report the last job status.

	while ($Job.Status -notin $terminalStates)
	{
		if ($env:AZURE_TEST_MODE -eq "Record")
		{
			Start-Sleep -Seconds 15
		}

		$Job = Get-AzRecoveryServicesBackupJob `
			-VaultId $VaultId `
			-JobId $Job.JobId `
			-From $from `
			-To $to |
			Select-Object -First 1

src/RecoveryServices/RecoveryServices.Backup.Test/ScenarioTests/AzureFiles/ItemTests.ps1:1265

This cross-region restore polling loop also has no deadline or attempt limit. A permanently non-terminal service response will hang the CheckIn test indefinitely; add a bounded wait with a useful timeout failure.

	while ($restoreJob.Status -notin $terminalStates)
	{
		if ($env:AZURE_TEST_MODE -eq "Record")
		{
			Start-Sleep -Seconds 20
		}

		$restoreJob = Get-AzRecoveryServicesBackupJob `
			-VaultId $vault.ID `
			-VaultLocation $vault.Location `
			-Job $restoreJob `
			-From $jobQueryStart `
			-To $jobQueryEnd `
			-UseSecondaryRegion
	}

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Container/RegisterAzureRmRecoveryServicesBackupContainer.cs:268

The added scenarios cover successful UAMI/SAMI registration and enablement, but none exercise the validation branches introduced here: both identities supplied, an identity without -AccessType, IdentityBased without an identity, or KeyBased with an identity. Because this method gates both Register and Enable, add check-in playback assertions for these invalid combinations so future changes cannot send malformed registration requests.

        private void ValidateAfsIdentityParameters()
        {
            bool hasUami = !string.IsNullOrEmpty(UserAssignedIdentityArmUrl);
            bool hasSami = IsSystemAssignedIdentity.IsPresent;

            if (hasSami && hasUami)

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Item/EnableAzureRmRecoveryServicesBackupProtection.cs:409

The added scenarios cover successful UAMI/SAMI enablement, but none exercise the validation branches introduced here: both identities supplied, an identity without -AccessType, IdentityBased without an identity, or KeyBased with an identity. Add check-in playback assertions for these invalid combinations so this duplicate Enable path cannot regress independently of Register.

        private void ValidateAfsIdentityParameters()
        {
            bool hasUami = !string.IsNullOrEmpty(UserAssignedIdentityArmUrl);
            bool hasSami = IsSystemAssignedIdentity.IsPresent;

            if (hasSami && hasUami)

src/RecoveryServices/RecoveryServices/ChangeLog.md:31

The new Upcoming Release entry is appended after the existing entries, but this repository keeps new release-note bullets newest-first under that heading. Move this four-line entry before the vault immutability and Source Scan entries so the changelog remains ordered consistently.

* Added Managed Identity (MI) based authentication support for Azure File Share backup:
    - `Enable-AzRecoveryServicesBackupProtection` and `Register-AzRecoveryServicesBackupContainer` (extended to `-BackupManagementType AzureStorage`) now accept `-AccessType` (`KeyBased`/`IdentityBased`), `-IsSystemAssignedIdentity`, and `-UserAssignedIdentityArmUrl` to register/re-register a storage account with a vault managed identity; `-Force` re-registers when the access type or identity changes.
    - `Restore-AzRecoveryServicesBackupItem` accepts `-IsSystemAssignedIdentity` and `-UserAssignedIdentityArmUrl` for identity-based Azure File Share restore, and `-TargetSubscriptionId` to enable Cross Subscription Restore (CSR).
    - Azure File Share Cross Region Restore can target a storage account in another subscription by combining `-RestoreToSecondaryRegion` and `-TargetSubscriptionId`.

src/RecoveryServices/RecoveryServices/help/Register-AzRecoveryServicesBackupContainer.md:132

This help text is not backed by the cmdlet's parameter metadata: RegisterAzureRmRecoveryServicesBackupContainer still uses ParamHelpMsgs.Container.ForceOption for Force, whose source text remains the old registration-only message. Regenerating reference help will overwrite this manual description, so update the source HelpMessage (with an Azure Files-specific attribute if needed) and regenerate the file.

Skips the confirmation dialog when registering or re-registering a container.

Files reviewed: 20/27 changed files
Comments generated: 0 new
Review effort level: Lite

Clarify registration validation, reject empty target subscriptions, bound job polling, add identity validation coverage, and align changelog and Force help metadata. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Bharat Purwar (bharatpurwar) · 2026-09-16T04:28:59Z

Addressed the latest Azure Files review feedback in 00e7c389eb1:

split the misleading registration parameter-set validation message;
reject empty TargetSubscriptionId input and defensively preserve the current subscription context;
bound standard and CRR job polling loops with diagnostic timeout failures;
added Register and Enable assertions for all invalid identity parameter combinations;
moved the release note to the top of Upcoming Release;
updated the source Force help text for registration and re-registration.

The RecoveryServices production build succeeds with 0 warnings/errors, and all 6 affected playback scenarios pass.

Aditya Pujara (a0x1ab) · 2026-09-16T04:31:03Z

/azp run

azure-pipelines · 2026-09-16T04:31:18Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🔵 Needs a closer look

The new Azure Files registration path ignores the documented -Force behavior and must be corrected before approval.

Review details

Files not reviewed (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Suppressed comments (1)

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Container/RegisterAzureRmRecoveryServicesBackupContainer.cs:143

The new Azure Files branch returns directly without using ConfirmAction with Force, unlike the existing registration path. As a result, -Force is ignored for a new Azure Files registration and does not provide the documented confirmation-bypass behavior; wrap this branch in the same confirmation gate or adjust the parameter contract and help text.

                // Azure Files (AFS) storage-account registration path.
                if (isAzureFileRegistration)
                {
                    RegisterAzureFileStorageAccount();
                    return;

Files reviewed: 20/27 changed files
Comments generated: 0 new
Review effort level: Lite

Preserve empty TargetSubscriptionId validation without adding parameter metadata that static analysis classifies as a breaking change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Aditya Pujara (a0x1ab) · 2026-09-16T09:05:01Z

/azp run

azure-pipelines · 2026-09-16T09:05:20Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review details

Files not reviewed (1)

src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Suppressed comments (3)

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Container/RegisterAzureRmRecoveryServicesBackupContainer.cs:137

Because ValidateSet now accepts AzureStorage on every parameter set, this guard only rejects the Azure Files combination outside AzureFileRegister. For example, -ResourceId ... -BackupManagementType AzureStorage -WorkloadType MSSQL passes these checks and reaches the legacy path, where provider dispatch fails later instead of enforcing the public parameter contract here. Reject every AzureStorage value outside AzureFileRegister (or otherwise scope it to that parameter set).

                if (hasAzureFileTypes && !isAzureFileRegistration)
                {
                    throw new ArgumentException(Resources.AFSRegisterParameterCombinationInvalid);
                }

                if (isAzureFileRegistration && !hasAzureFileTypes)
                {
                    throw new ArgumentException(Resources.AFSRegisterStorageAccountRequiresAzureFileTypes);
                }

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Container/RegisterAzureRmRecoveryServicesBackupContainer.cs:143

This branch calls RegisterAzureFileStorageAccount directly, bypassing the ConfirmAction used by the existing registration path below. As a result, a new Azure Files registration runs without the cmdlet's normal confirmation prompt, even though Force is documented as suppressing the registration/re-registration confirmation. Route new registrations through the confirmation gate, while avoiding a second prompt when the provider handles an identity-change re-registration.

                if (isAzureFileRegistration)
                {
                    RegisterAzureFileStorageAccount();
                    return;

src/RecoveryServices/RecoveryServices.Backup/Cmdlets/Restore/RestoreAzureRMRecoveryServicesBackupItem.cs:336

The validation block at the top of the PR description still reports the RecoveryServices Breaking Change Check failing for Restore-AzRecoveryServicesBackupItem -TargetSubscriptionId, while the summary claims the breaking-change check passes. Please rerun the checks after the current declaration is built and update either the code or the validation summary before merging so this new parameter-set surface is verified.

        [Parameter(Mandatory = false, ParameterSetName = AzureFileShareParameterSet,
            HelpMessage = ParamHelpMsgs.RestoreFS.TargetSubscriptionId)]

Files reviewed: 20/27 changed files
Comments generated: 0 new
Review effort level: Lite

Bharat Purwar (bharatpurwar) · 2026-09-16T09:13:57Z

Hi Team, please review the pr

Bharat Purwar and others added 2 commits August 24, 2026 17:53

[RecoveryServices.Backup] Update SDK generation config to API 2026-07-01

6af8c1b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

[RecoveryServices.Backup] Regenerate management SDK for API 2026-07-01

f3c6958

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Copilot AI lite review requested due to automatic review settings September 7, 2026 13:59

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 7, 2026 14:00 View session

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 7, 2026 14:10

Bharat Purwar (bharatpurwar) force-pushed the users/bharatpurwar/msi_auth_afs2 branch from 13e8eb2 to 2f9b21c Compare September 7, 2026 14:10

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 7, 2026 14:11 View session

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Bharat Purwar (bharatpurwar) added the Do Not Merge 🚫 label Sep 9, 2026

Copilot AI review requested due to automatic review settings September 9, 2026 02:05

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 9, 2026 02:06 View session

Copilot AI reviewed Sep 9, 2026

View reviewed changes

Bharat Purwar added 2 commits September 15, 2026 08:25

[RecoveryServices.Backup] Add Azure Files managed identity support

25fa06d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Merge main into RecoveryServices Backup API update

5344e06

Use the API 2026-07-01 SDK already merged in main while preserving Azure Files managed identity support. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 98d71075-adf0-4b3a-82a1-ec2acd27366e

Copilot AI review requested due to automatic review settings September 15, 2026 03:37

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 15, 2026 03:37 View session

Bharat Purwar (bharatpurwar) changed the title ~~[RecoveryServices.Backup] Update management SDK to API 2026-07-01~~ [RecoveryServices.Backup] Add Azure Files managed identity support Sep 15, 2026

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Comment thread src/RecoveryServices/RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs

Comment thread .../RecoveryServices.Backup/Cmdlets/Container/RegisterAzureRmRecoveryServicesBackupContainer.cs Outdated

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 15, 2026 20:26

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 15, 2026 20:27 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Comment thread src/RecoveryServices/RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs

Copilot AI review requested due to automatic review settings September 16, 2026 03:41

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 16, 2026 03:42 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 16, 2026 04:28

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 16, 2026 04:28 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 16, 2026 09:02

Copilot started reviewing on behalf of Bharat Purwar (bharatpurwar) September 16, 2026 09:03 View session

Bharat Purwar (bharatpurwar) added the needs-review label Sep 16, 2026

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Bharat Purwar (bharatpurwar) added this to the Az 16.4.0 (2026-10-06) milestone Sep 16, 2026

Type	Cmdlet	Example	Line	RuleName	Description	Extent	Remediation
⚠️	Enable-AzRecoveryServicesBackupProtection	2	1	Unassigned_Variable	Enable-AzRecoveryServicesBackupProtection -Item $Item is a null-valued parameter value.	-Item	Assign value for $Item.
⚠️	Enable-AzRecoveryServicesBackupProtection	2	1	Unassigned_Variable	Enable-AzRecoveryServicesBackupProtection -Policy $Pol is a null-valued parameter value.	-Policy	Assign value for $Pol.
⚠️	Enable-AzRecoveryServicesBackupProtection	2	1	Unassigned_Variable	Enable-AzRecoveryServicesBackupProtection -VaultId $vault is a null-valued parameter value.	-VaultId	Assign value for $vault.
⚠️	Restore-AzRecoveryServicesBackupItem	7	8	Unassigned_Variable	Restore-AzRecoveryServicesBackupItem -WLRecoveryConfig $AnotherInstanceWithLogConfig is a null-valued parameter value.	-WLRecoveryConfig	Assign value for $AnotherInstanceWithLogConfig.
⚠️	Restore-AzRecoveryServicesBackupItem	9	4	Unassigned_Variable	Restore-AzRecoveryServicesBackupItem -RestoreDiskList $restoreDiskLUNs is a null-valued parameter value.	-RestoreDiskList	Assign value for $restoreDiskLUNs.
⚠️	Restore-AzRecoveryServicesBackupItem	13	3	Unassigned_Variable	Get-AzRecoveryServicesBackupRecoveryPoint -Item $item is a null-valued parameter value.	-Item	Assign value for $item.

Conversation

Bharat Purwar (bharatpurwar) commented Sep 7, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Summary

What changed

Register and enable protection

Restore

Models and validation

Validation

Notes

Uh oh!

azure-pipelines Bot commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 7, 2026

Uh oh!

azure-pipelines Bot commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Bharat Purwar (bharatpurwar) commented Sep 7, 2026

Uh oh!

azure-pipelines Bot commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 15, 2026

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Files not reviewed (1)

Suppressed comments (4)

Uh oh!

Uh oh!

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Files not reviewed (1)

Suppressed comments (5)

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 15, 2026

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Files not reviewed (1)

Suppressed comments (1)

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 16, 2026

Uh oh!

Bharat Purwar (bharatpurwar) commented Sep 7, 2026 •

edited by x-engineering-agent Bot

Loading