[dataprotection] Specify principal type for AKS backup roles

[FumingZhang]

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

---

Related command

az dataprotection enable-backup trigger

az aks create --enable-backup / az aks update --enable-backup

Description

AKS backup role-assignment helpers already receive managed-identity object IDs, but passed them through assignee. Azure CLI then queries Microsoft Graph to infer the principal type. In app-only environments without Graph directory permissions, the GUID fallback leaves the type unset and omits principalType from the role-assignment request.

This change:

• Uses assignee_object_id with an explicit ServicePrincipal type when checking and creating AKS backup role assignments.
• Makes the helper's object-ID-only contract explicit in its parameter name, documentation, callers, and unit tests.
• Updates manual remediation commands to use the same unambiguous arguments.
• Bumps the Data Protection extension to 1.11.4 and adds its release note.

Explicitly setting the type avoids Graph inference, reduces fresh-identity propagation failures, and keeps the requests compliant with PIM Only Mode enforcement.

The aks-preview live-test change originally included here was moved to #10263 so that the Data Protection product fix and AKS test fix can be reviewed independently.

CI follow-up

The initial CI run exposed two existing recorded Data Protection scenarios that unconditionally switched to a live persistent-resource subscription. Playback profiles contain only the sanitized CI subscription, so all Python versions failed before cassette replay with:

The subscription of '59e574f1-e278-4b66-875b-e3e4fe74ad88' doesn't exist in cloud 'AzureCloud'.

The tests now switch subscriptions only during live runs. Recorded runs continue against the playback profile's subscription.

Validation

• azdev style dataprotection --pep8 --pylint
• azdev test azext_dataprotection --series --no-exitfirst - 81 passed, 26 skipped
• python scripts/ci/test_index.py -q - 9 passed, 2 skipped
• azdev extension build dataprotection - built dataprotection-1.11.4-py3-none-any.whl
• git diff --check

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

Once merged, the normal release automation can publish Data Protection 1.11.4 and update src/index.json; this PR intentionally does not edit the generated index.

[azure-client-tools-bot-prd]

Hi FumingZhang,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Copilot]

Pull request overview

This PR hardens role-assignment helpers used by AKS backup enablement flows by explicitly using managed-identity object IDs and setting principalType=ServicePrincipal, avoiding Microsoft Graph inference (and related failures) in app-only / limited-directory-permissions environments.

Changes:

• Update AKS backup role-assignment checks/creates to use assignee_object_id and assignee_principal_type="ServicePrincipal", including aligned manual remediation commands.
• Strengthen unit and live-test coverage assertions around the new role-assignment invocation shape.
• Bump the Data Protection extension version to 1.11.4 and add release notes.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/dataprotection/setup.py	Bumps extension version to 1.11.4.
src/dataprotection/HISTORY.rst	Adds 1.11.4 release note describing the principal-type change.
src/dataprotection/azext_dataprotection/tests/latest/test_dataprotection_enable_backup.py	Updates unit tests to assert assignee_object_id + assignee_principal_type usage and improved error message matching.
src/dataprotection/azext_dataprotection/manual/aks/aks_helper.py	Uses assignee_object_id/ServicePrincipal when listing/creating role assignments; updates manual remediation command accordingly.
src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py	Hardens AKS web app routing live-test setup role assignment to use explicit object-id + principal-type flags.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

dataprotection

[Azure CLI Bot (azclibot)]

[Release] Update index.json for extension [ dataprotection-1.11.4 ] : https://dev.azure.com/msazure/One/_build/results?buildId=179101006&view=results