Quantum: Update user create/delete operation by pavelbraginskiy · Pull Request #10282 · Azure/azure-cli-extensions

Pavel Braginskiy (pavelbraginskiy) · 2026-08-31T20:35:31Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️quantum

rule cmd_name rule_message suggest_message

⚠️ 1015 - SubgroupPropUpdate quantum workspace user sub group quantum workspace user updated property commands from {'quantum workspace user create': {'name': 'quantum workspace user create', 'is_aaz': False, 'parameters': [{'name': '_change_reference', 'options': ['--change-reference']}, {'name': '_acquire_policy_token', 'options': ['--acquire-policy-token']}, {'name': 'resource_group_name', 'options': ['--resource-group', '-g'], 'id_part': 'resource_group', 'has_completer': True}, {'name': 'workspace_name', 'options': ['--workspace-name', '-w']}, {'name': 'assignee', 'options': ['--assignee']}, {'name': 'assignee_object_id', 'options': ['--assignee-object-id']}, {'name': 'assignee_principal_type', 'options': ['--assignee-principal-type'], 'choices': ['ForeignGroup', 'Group', 'ServicePrincipal', 'User']}, {'name': 'role', 'options': ['--role']}]}, 'quantum workspace user delete': {'name': 'quantum workspace user delete', 'is_aaz': False, 'confirmation': True, 'parameters': [{'name': '_change_reference', 'options': ['--change-reference']}, {'name': '_acquire_policy_token', 'options': ['--acquire-policy-token']}, {'name': 'resource_group_name', 'options': ['--resource-group', '-g'], 'id_part': 'resource_group', 'has_completer': True}, {'name': 'workspace_name', 'options': ['--workspace-name', '-w']}, {'name': 'assignee', 'options': ['--assignee']}, {'name': 'assignee_object_id', 'options': ['--assignee-object-id']}, {'name': 'role', 'options': ['--role']}, {'name': 'yes', 'options': ['--yes', '-y']}]}, 'quantum workspace user list': {'name': 'quantum workspace user list', 'is_aaz': False, 'parameters': [{'name': 'resource_group_name', 'options': ['--resource-group', '-g'], 'id_part': 'resource_group', 'has_completer': True}, {'name': 'workspace_name', 'options': ['--workspace-name', '-w']}, {'name': 'include_inherited', 'options': ['--include-inherited'], 'choices': ['false', 'true'], 'nargs': '?', 'default': True}]}} to {'quantum workspace user add': {'name': 'quantum workspace user add', 'is_aaz': False, 'parameters': [{'name': '_change_reference', 'options': ['--change-reference']}, {'name': '_acquire_policy_token', 'options': ['--acquire-policy-token']}, {'name': 'resource_group_name', 'options': ['--resource-group', '-g'], 'id_part': 'resource_group', 'has_completer': True}, {'name': 'workspace_name', 'options': ['--workspace-name', '-w']}, {'name': 'user', 'options': ['--user']}]}, 'quantum workspace user remove': {'name': 'quantum workspace user remove', 'is_aaz': False, 'confirmation': True, 'parameters': [{'name': '_change_reference', 'options': ['--change-reference']}, {'name': '_acquire_policy_token', 'options': ['--acquire-policy-token']}, {'name': 'resource_group_name', 'options': ['--resource-group', '-g'], 'id_part': 'resource_group', 'has_completer': True}, {'name': 'workspace_name', 'options': ['--workspace-name', '-w']}, {'name': 'user', 'options': ['--user']}, {'name': 'yes', 'options': ['--yes', '-y']}]}, 'quantum workspace user list': {'name': 'quantum workspace user list', 'is_aaz': False, 'parameters': [{'name': 'resource_group_name', 'options': ['--resource-group', '-g'], 'id_part': 'resource_group', 'has_completer': True}, {'name': 'workspace_name', 'options': ['--workspace-name', '-w']}, {'name': 'include_inherited', 'options': ['--include-inherited'], 'choices': ['false', 'true'], 'nargs': '?', 'default': True}]}}

Continuation of the work in #10226.
Replaces az quantum workspace user create/delete with add/remove, and makes these commands support only Users and not other principal types.

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az quantum workspace user add

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
My extension version conforms to the Extension version schema

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

…ser list` command

…help documentation

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…-Update-user-create-delete # Conflicts: # src/quantum/azext_quantum/_params.py

…signee

… 1.0.0b22

…kaverkiev/azure-cli-extensions into v-kaverkiev/workspace-user-list

…-Update-user-create-delete

…D; update related tests

…-add-remove # Conflicts: # src/quantum/HISTORY.rst # src/quantum/azext_quantum/_help.py # src/quantum/azext_quantum/_params.py # src/quantum/azext_quantum/commands.py # src/quantum/azext_quantum/operations/workspace.py # src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py # src/quantum/setup.py

azure-client-tools-bot-prd · 2026-08-31T20:35:35Z

Hi Pavel Braginskiy (@pavelbraginskiy),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

azure-pipelines · 2026-08-31T20:35:42Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

microsoft-github-policy-service · 2026-08-31T20:36:50Z

Thank you for your contribution Pavel Braginskiy (@pavelbraginskiy)! We will review the pull request and get back to you soon.

Aditya Pujara (a0x1ab) · 2026-08-31T20:43:06Z

/azp run

azure-pipelines · 2026-08-31T20:43:23Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Pavel Braginskiy (pavelbraginskiy) · 2026-08-31T20:47:37Z

@microsoft-github-policy-service agree company="Akvelon Inc"

azure-pipelines · 2026-08-31T20:58:25Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

Updates the Quantum extension’s workspace user access commands by renaming az quantum workspace user create/delete to add/remove and tightening the implementation/UX around user-only access management, along with the accompanying version bump, help text, and tests.

Changes:

Renamed CLI commands quantum workspace user create/delete to add/remove and updated argument surface to --user.
Updated workspace user role-assignment logic to always grant/remove the built-in “Quantum Workspace Data Contributor” role for users.
Updated help + tests and bumped extension version/history for the new release.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/quantum/setup.py	Bumps extension version to `1.0.0b25`.
src/quantum/HISTORY.rst	Adds release note for the rename + user-only behavior.
src/quantum/azext_quantum/operations/workspace.py	Implements new `add_user/remove_user` behavior and user resolution.
src/quantum/azext_quantum/commands.py	Rewires command table from `create/delete` to `add/remove`.
src/quantum/azext_quantum/_params.py	Replaces assignee/role params with `--user` for workspace user commands.
src/quantum/azext_quantum/_help.py	Updates help entries and examples to `add/remove` and `--user`.
src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py	Updates live scenario test and adds unit coverage for new user-access functions.

Suppressed comments (1)

src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py:906

If _resolve_user_id is updated to accept object IDs without a Graph call, this unit test should stop asserting that Graph is used for GUID inputs and add a dedicated assertion that GUIDs pass through without invoking graph_client_factory.

    def test_resolve_user_id_uses_graph_user_endpoint(self):
        identifiers = ("user@contoso.com", "00000000-0000-0000-0000-000000000000")
        for identifier in identifiers:

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

azure-client-tools-agent · 2026-08-31T21:09:50Z

Automated sensitive-information remediation ran on this pull request.

Detected categories: email address
Replaced with typed [REDACTED:category] placeholders in: no PR metadata fields
Comment/review owners notified because Azure Client Tools Agent cannot edit another user's text: copilot-pull-request-reviewer[bot]

Azure Client Tools Agent does not modify source files. The PR creator must remove or replace each suspected value at the linked line:

No changed-file findings

If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

Zulfat Nutfullin (rigidit) · 2026-08-31T23:59:31Z

 # Built-in "Quantum Workspace Owner" role.
 QUANTUM_WORKSPACE_OWNER_ROLE_ID = "30b3bcf2-670a-4bdc-8669-7e0ae0c0dfda"

+EMAIL_PATTERN = re.compile(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$")


Email regex seems rejects valid sign-in names — B2B guest UPNs (user_contoso.com#EXT#@fabrikam.onmicrosoft.com) and apostrophes (o'brien@contoso.com). Since the only real goal is rejecting object IDs, can we relax to a permissive [^@\s]+@[^@\s]+.[^@\s]+ ? and drop the redundant ^/$ anchors if already using fullmatch.

Zulfat Nutfullin (rigidit) · 2026-09-01T00:01:14Z

-    assignee_type = CLIArgumentType(options_list=['--assignee'], help='Represents a user, group, or service principal. Supported formats: object id, user sign-in name, or service principal name.')
-    assignee_object_id_type = CLIArgumentType(options_list=['--assignee-object-id'], help="Use this parameter instead of '--assignee' to bypass Graph API invocation in case of insufficient privileges. This parameter only works with object ids for users, groups, service principals, and managed identities. For managed identities use the principal id. For service principals, use the object id and not the app id.")
-    role_type = CLIArgumentType(options_list=['--role'], help="Role name or id. For 'create', the role granted to the user; for 'delete', the role assignment to remove. Defaults to the 'Quantum Workspace Data Contributor' role.")
-    assignee_principal_type_type = CLIArgumentType(options_list=['--assignee-principal-type'], arg_type=get_enum_type(['User', 'Group', 'ServicePrincipal', 'ForeignGroup']), help="Use with '--assignee-object-id' to avoid errors caused by propagation latency in Microsoft Graph.")


could you remove stale linter exclusion (linter_exclusions.yml in repo's root) - still has a quantum workspace user create / assignee_principal_type entry for a command and parameter that no longer exist

Zulfat Nutfullin (rigidit) · 2026-09-01T00:03:54Z

+    from azure.cli.command_modules.role import graph_client_factory
+
+    _validate_email_arg(email)
+    return graph_client_factory(cmd.cli_ctx).user_get(email)["id"]


can we return friendly error to the user if Graph returns 404 here?
raise ResourceNotFoundError(f"No user with the email address '{email}' was found in the directory.") from ex

Zulfat Nutfullin (rigidit) · 2026-09-01T00:11:17Z

-
-    with self.argument_context('quantum workspace user create') as c:
-        c.argument('assignee_principal_type', assignee_principal_type_type)
+        c.argument('email', email_type)


should we make email argument required for user add and user remove commands?

azure-client-tools-agent · 2026-09-01T00:13:42Z

Automated sensitive-information remediation ran on this pull request.

Detected categories: email address
Replaced with typed [REDACTED:category] placeholders in: no PR metadata fields
Comment/review owners notified because Azure Client Tools Agent cannot edit another user's text: copilot-pull-request-reviewer[bot], Zulfat Nutfullin (@rigidit)

Azure Client Tools Agent does not modify source files. The PR creator must remove or replace each suspected value at the linked line:

No changed-file findings

If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

Zulfat Nutfullin (rigidit) · 2026-09-01T00:14:13Z

+helps['quantum workspace user remove'] = """
    type: command
-    short-summary: Remove a user, group, or service principal's access to an Azure Quantum workspace.
+    short-summary: Remove a user's access to an Azure Quantum workspace.


let's also mention what exactly role we are removing in long-summary similar to what we have in user add

Konstantin and others added 28 commits August 12, 2026 11:30

Add az quantum workspace user list command to manage user access

ad32f7c

Add support for --include-inherited flag in `az quantum workspace u…

0d61226

…ser list` command

update 'role' implementation

874c812

exclude groups and service principals

f8d6d7a

Restrict user management commands to user principals only and update …

a709193

…help documentation

Potential fix for pull request finding

06fb090

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Add action flag to --include-inherited parameter

aca2e71

Merge branch 'main' into v-kaverkiev/53910-Update-user-create-delete

f5da100

Merge branch 'v-kaverkiev/workspace-user-list' into v-kaverkiev/53910…

634d85a

…-Update-user-create-delete # Conflicts: # src/quantum/azext_quantum/_params.py

deprecate --assignee-principal-type parameter

7d099a1

refactor test_workspace_user to use signed-in user's object id for as…

8b4ca76

…signee

Refactoring. Removed role, assignee,assignee_object_id params

3834ec1

Remove comment

b0ae63d

add name and email

661bf7e

Update release history for version 1.0.0b22 and add new command details

470196d

Merge branch 'main' into v-kaverkiev/workspace-user-list

d8df847

Merge branch 'main' into v-kaverkiev/workspace-user-list

e2aa1c8

Add 'Time Created' field to user transformation and update version to…

0b931b5

… 1.0.0b22

Merge branch 'v-kaverkiev/workspace-user-list' of https://github.com/…

811044a

…kaverkiev/azure-cli-extensions into v-kaverkiev/workspace-user-list

Remove 'Role' field from user transformation and update related tests

c900ca6

Merge branch 'main' into v-kaverkiev/53910-Update-user-create-delete

0439100

Update user role handling in workspace commands

939612f

Merge branch 'v-kaverkiev/workspace-user-list' into v-kaverkiev/53910…

7e4dc7d

…-Update-user-create-delete

Refactor user access commands to use sign-in name instead of object I…

f7cc3ae

…D; update related tests

Update user commands to use '--email' instead of '--assignee'

0456487

Simplify docstring for user display name enrichment function

860a47c

Enforce principal type = user on workspace add

d029fcc

azure-client-tools-bot-prd Bot added this to the September 2026 (2026-09-01) milestone Aug 31, 2026

microsoft-github-policy-service Bot requested a review from Ethan Yang (necusjz) August 31, 2026 20:36

Pavel Braginskiy (pavelbraginskiy) changed the title ~~V pavelbra/53910 user add remove~~ Quantum: Update user create/delete operation by v-pavelbra Aug 31, 2026

microsoft-github-policy-service Bot requested review from ZelinWang (wangzelin007) and Yong Zhang (yonzhan) August 31, 2026 20:36

Pavel Braginskiy (pavelbraginskiy) changed the title ~~Quantum: Update user create/delete operation by v-pavelbra~~ Quantum: Update user create/delete operation Aug 31, 2026

microsoft-github-policy-service Bot added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Aug 31, 2026

microsoft-github-policy-service Bot added the Auto-Assign Auto assign by bot label Aug 31, 2026

microsoft-github-policy-service Bot assigned Ethan Yang (necusjz) Aug 31, 2026

microsoft-github-policy-service Bot added Quantum az quantum act-codegen-extensibility-squad labels Aug 31, 2026

Pavel Braginskiy (pavelbraginskiy) marked this pull request as ready for review August 31, 2026 20:58

Copilot AI lite review requested due to automatic review settings August 31, 2026 20:58

Copilot started reviewing on behalf of Pavel Braginskiy (pavelbraginskiy) August 31, 2026 20:59 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread src/quantum/azext_quantum/operations/workspace.py Outdated

Comment thread src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py Outdated

Fix test

8013dd5

Pavel Braginskiy (pavelbraginskiy) marked this pull request as draft August 31, 2026 21:22

Enforce parameter must be email address

83a20a6

Zulfat Nutfullin (rigidit) reviewed Aug 31, 2026

View reviewed changes

Zulfat Nutfullin (rigidit) reviewed Sep 1, 2026

View reviewed changes

Uh oh!

Conversation

Pavel Braginskiy (pavelbraginskiy) commented Aug 31, 2026 • edited by azure-client-tools-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd Bot commented Aug 31, 2026

Uh oh!

azure-pipelines Bot commented Aug 31, 2026

Uh oh!

microsoft-github-policy-service Bot commented Aug 31, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 31, 2026

Uh oh!

azure-pipelines Bot commented Aug 31, 2026

Uh oh!

Pavel Braginskiy (pavelbraginskiy) commented Aug 31, 2026

Uh oh!

azure-pipelines Bot commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

azure-client-tools-agent Bot commented Aug 31, 2026

Uh oh!

Zulfat Nutfullin (rigidit) Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Zulfat Nutfullin (rigidit) Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

Zulfat Nutfullin (rigidit) Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

Zulfat Nutfullin (rigidit) Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

azure-client-tools-agent Bot commented Sep 1, 2026

Uh oh!

Zulfat Nutfullin (rigidit) Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Pavel Braginskiy (pavelbraginskiy) commented Aug 31, 2026 •

edited by azure-client-tools-agent Bot

Loading