[Backup] Add managed identity support for Azure Files backup

[Bharat Purwar (bharatpurwar)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️backup

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	backup container register	cmd backup container register added parameter access_type
⚠️ 1006 - ParaAdd	backup container register	cmd backup container register added parameter mi_system_assigned
⚠️ 1006 - ParaAdd	backup container register	cmd backup container register added parameter mi_user_assigned
⚠️ 1006 - ParaAdd	backup container register	cmd backup container register added parameter storage_account
⚠️ 1006 - ParaAdd	backup container register	cmd backup container register added parameter yes
⚠️ 1009 - ParaPropRemove	backup container register	cmd backup container register update parameter resource_id: removed property required=True
⚠️ 1010 - ParaPropUpdate	backup container register	cmd backup container register update parameter workload_type: updated property choices from ['MSSQL', 'SAPASE', 'SAPAseDatabase', 'SAPHANA', 'SAPHanaDBInstance', 'SAPHanaDatabase', 'SQLDataBase'] to ['AzureFileShare', 'MSSQL', 'SAPASE', 'SAPAseDatabase', 'SAPHANA', 'SAPHanaDBInstance', 'SAPHanaDatabase', 'SQLDataBase']
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd backup protection enable-for-azurefileshare added parameter access_type
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd backup protection enable-for-azurefileshare added parameter mi_system_assigned
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd backup protection enable-for-azurefileshare added parameter mi_user_assigned
⚠️ 1006 - ParaAdd	backup protection enable-for-azurefileshare	cmd backup protection enable-for-azurefileshare added parameter yes
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd backup restore restore-azurefiles added parameter mi_system_assigned
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd backup restore restore-azurefiles added parameter mi_user_assigned
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd backup restore restore-azurefiles added parameter target_resource_group_name
⚠️ 1006 - ParaAdd	backup restore restore-azurefiles	cmd backup restore restore-azurefiles added parameter target_subscription_id
⚠️ 1006 - ParaAdd	backup restore restore-azurefileshare	cmd backup restore restore-azurefileshare added parameter mi_system_assigned
⚠️ 1006 - ParaAdd	backup restore restore-azurefileshare	cmd backup restore restore-azurefileshare added parameter mi_user_assigned
⚠️ 1006 - ParaAdd	backup restore restore-azurefileshare	cmd backup restore restore-azurefileshare added parameter target_subscription_id

Summary

• add explicit KeyBased, system-assigned identity, and user-assigned identity registration and re-registration for Azure Files backup containers
• preserve or select storage-account authentication during protection and include managed identity information in primary-region restores
• support cross-subscription Azure Files restore targets while preserving KeyBased full-share cross-region restore behavior
• update command help/table output and add focused unit and recorded scenario coverage

Validation

• 10 focused test_custom_afs tests passed
• test_afs_msi_reregistration_protection_restore recording playback passed
• changed Python files compiled successfully
• git diff --cached --check passed before commit
• live UAMI cross-subscription restore completed and restored the seeded file
• live KeyBased CRR+CSR completed against the paired-region target; an identity-only target was rejected by the service as expected

[azure-client-tools-bot-prd]

Hi Bharat Purwar (@bharatpurwar),
Since the current milestone time is less than 7 days, this pr will be reviewed in the next milestone.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unresolved moderate findings affect Azure Files registration handling and source-subscription scoping.

Review effort: Lite
Findings: None

What changed in this PR

Adds managed identity support and cross-subscription restore capabilities for Azure Files backup.

Changes:

• Adds KeyBased, system-assigned, and user-assigned identity registration, protection, and restore flows.
• Supports subscription-aware restore targeting.
• Updates CLI routing, parameters, help, formatting, and test coverage.

File	Summary
src/​azure-cli/​azure/​cli/​command_modules/​backup/​tests/​latest/​test_custom_afs.py	Adds focused Azure Files identity and restore unit tests.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​tests/​latest/​test_afs_commands.py	Adds recorded scenario coverage; Moderate (1 vote): source commands should explicitly use source_subscription.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​custom_base.py	Routes Azure Files commands; Moderate (1 vote): reject Azure Files through the AzureWorkload path. Nit (1 vote): broaden the related diagnostic wording.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​custom_afs.py	Implements identity registration and restore behavior; Moderate (1 vote): derive registration resource groups from the source resource or omit them.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​commands.py	Registers the new container handler.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​_params.py	Adds identity, subscription, and restore parameters.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​_help.py	Documents the new command scenarios.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​_format.py	Displays authentication details.
src/​azure-cli/​azure/​cli/​command_modules/​backup/​_client_factory.py	Enables subscription-specific resource clients.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

backup

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[x-engineering-agent]

Live test results — azdev test --live --series (changed test files only)

❌ FAIL (exit 1)

Selectors: backup.test_afs_commands backup.test_custom_afs (module)
PR head ref: users/bharatpurwar/afsmsi
PR head sha: f923ae8bb75a03144b526e7d4cae437c906f376a
PR base ref: dev
New test files in PR: true

Changed test files run

src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_afs_commands.py
src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_custom_afs.py

New test files

src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_custom_afs.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/35712966370

Last 80 lines of azdev output

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.12/site-packages/azure/core/tracing/decorator.py:119: in wrapper_use_tracer
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <azure.mgmt.resource.resources.v2024_11_01.operations._operations.ResourceGroupsOperations object at 0x7f84d4499d90>
resource_group_name = 'AzureBackupRG_clitest_vumj7sftei'
parameters = <azure.mgmt.resource.resources.v2024_11_01.models._models_py3.ResourceGroup object at 0x7f84d43b1730>
kwargs = {}

    @distributed_trace
    def create_or_update(
        self, resource_group_name: str, parameters: Union[_models.ResourceGroup, IO[bytes]], **kwargs: Any
    ) -> _models.ResourceGroup:
        """Creates or updates a resource group.
    
        :param resource_group_name: The name of the resource group to create or update. Can include
         alphanumeric, underscore, parentheses, hyphen, period (except at end), and Unicode characters
         that match the allowed characters. Required.
        :type resource_group_name: str
        :param parameters: Parameters supplied to the create or update a resource group. Is either a
         ResourceGroup type or a IO[bytes] type. Required.
        :type parameters: ~azure.mgmt.resource.resources.v2024_11_01.models.ResourceGroup or IO[bytes]
        :return: ResourceGroup or the result of cls(response)
        :rtype: ~azure.mgmt.resource.resources.v2024_11_01.models.ResourceGroup
        :raises ~azure.core.exceptions.HttpResponseError:
        """
        error_map: MutableMapping = {
            401: ClientAuthenticationError,
            404: ResourceNotFoundError,
            409: ResourceExistsError,
            304: ResourceNotModifiedError,
        }
        error_map.update(kwargs.pop("error_map", {}) or {})
    
        _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {})
        _params = case_insensitive_dict(kwargs.pop("params", {}) or {})
    
        api_version: str = kwargs.pop("api_version", _params.pop("api-version", self._api_version or "2024-11-01"))
        content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None))
        cls: ClsType[_models.ResourceGroup] = kwargs.pop("cls", None)
    
        content_type = content_type or "application/json"
        _json = None
        _content = None
        if isinstance(parameters, (IOBase, bytes)):
            _content = parameters
        else:
            _json = self._serialize.body(parameters, "ResourceGroup")
    
        _request = build_resource_groups_create_or_update_request(
            resource_group_name=resource_group_name,
            subscription_id=self._config.subscription_id,
            api_version=api_version,
            content_type=content_type,
            json=_json,
            content=_content,
            headers=_headers,
            params=_params,
        )
        _request.url = self._client.format_url(_request.url)
    
        _stream = False
        pipeline_response: PipelineResponse = self._client._pipeline.run(  # pylint: disable=protected-access
            _request, stream=_stream, **kwargs
        )
    
        response = pipeline_response.http_response
    
        if response.status_code not in [200, 201]:
            map_error(status_code=response.status_code, response=response, error_map=error_map)
>           raise HttpResponseError(response=response, error_format=ARMErrorFormat)
E           azure.core.exceptions.HttpResponseError: (LocationNotAvailableForResourceGroup) The provided location 'eastus2euap' is not available for resource group. List of available regions is 'eastasia,southeastasia,austriaeast,australiaeast,australiacentral,australiacentral2,australiasoutheast,belgiumcentral,brazilsouth,canadacentral,canadaeast,switzerlandnorth,chilecentral,denmarkeast,germanywestcentral,eastus2,eastus,centralus,northcentralus,francecentral,uksouth,ukwest,indonesiacentral,israelcentral,centralindia,southindia,jioindiawest,indiasouthcentral,italynorth,japaneast,japanwest,koreacentral,koreasouth,malaysiawest,mexicocentral,northeurope,norwayeast,newzealandnorth,polandcentral,qatarcentral,spaincentral,swedencentral,uaenorth,westcentralus,westeurope,westus2,westus,southcentralus,westus3,southafricanorth,westindia,jioindiacentral'.
E           Code: LocationNotAvailableForResourceGroup
E           Message: The provided location 'eastus2euap' is not available for resource group. List of available regions is 'eastasia,southeastasia,austriaeast,australiaeast,australiacentral,australiacentral2,australiasoutheast,belgiumcentral,brazilsouth,canadacentral,canadaeast,switzerlandnorth,chilecentral,denmarkeast,germanywestcentral,eastus2,eastus,centralus,northcentralus,francecentral,uksouth,ukwest,indonesiacentral,israelcentral,centralindia,southindia,jioindiawest,indiasouthcentral,italynorth,japaneast,japanwest,koreacentral,koreasouth,malaysiawest,mexicocentral,northeurope,norwayeast,newzealandnorth,polandcentral,qatarcentral,spaincentral,swedencentral,uaenorth,westcentralus,westeurope,westus2,westus,southcentralus,westus3,southafricanorth,westindia,jioindiacentral'.

.venv/lib/python3.12/site-packages/azure/mgmt/resource/resources/v2024_11_01/operations/_operations.py:5922: HttpResponseError
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
============================== 1 failed in 2.36s ===============================

Posted by the X Engineering Agent live-test workflow.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[Yong Zhang (yonzhan)]

Please fix CI issues

[x-engineering-agent]

Bharat Purwar (@bharatpurwar)

X Engineering Agent review — validation failures and evidence required

Reviewed the bounded diff at head 4b085c8a3382f2f26b087f6daad4ab5be6434652, targeting dev. This is a COMMENT, not an approval. I am not marking this ready for human review.

Completed validation

The Tester's same-head snapshot reports 51 completed CI checks: 50 passed, block-merge failed, none pending. The reused live-test workflow is completed / failure. These are completed failures, not pending work or passing validation. No validation was dispatched, rerun, or polled during this review.

• block-merge — relevance: uncertain; possible merge-policy gate. Evidence: the Tester reports this check failed, and the current PR has do-not-merge. The check's failure output was not supplied, so the label is not proof of the precise failure condition, nor is there evidence of a title-gate failure. Correction: the owning maintainer should inspect the check output and resolve the underlying hold deliberately; do not remove the label or rewrite metadata merely to bypass it. Verification: confirm the actual gate condition and its successful result in a later round after authorized resolution.
• Live-test failure — relevance: uncertain. Evidence: the linked workflow failed for this same head; no failed-job, test-name, or traceback excerpt is available in the delegated result. A production defect versus a fixture, permission, or infrastructure failure cannot be distinguished from that result alone. Correction: provide the failed step/test diagnostics from this existing run, then address the evidenced cause. Verification: validate the affected Backup tests and the relevant managed-identity/restore integration at the corrected head in a later round. The PR description's reported successful runs do not resolve this failed workflow.

Regression coverage and test-strength evidence

The diff contains seven Backup production-file changes, focused tests in tests/latest/test_custom_afs.py, an added scenario in tests/latest/test_afs_commands.py, and its recording. Visible unit cases cover identity-argument errors, identity construction/comparison, and preserving AzureWorkload registration delegation. The scenario asserts registration identity fields and completed restore-job status. Their presence is useful evidence, not evidence that the failed live validation passed.

The regression-coverage skill returned applicable=false with empty file lists, despite these visible changes. I have not treated that result as a coverage pass.

Confirmed scenario limitation: in test_afs_commands.py:359–366, both source and target subscriptions use self.get_subscription_id() during playback. Consequently, that scenario alone cannot distinguish correct cross-subscription client selection from accidentally using the source subscription. Please preserve distinct sanitized source/target IDs in playback, or demonstrate focused assertions that the requested target subscription reaches both resource lookup and file-share validation while vault operations retain their source scope. Those assertions should fail if target-subscription forwarding is removed.

The bounded output truncated the unit-test tail and omitted the recording payload, so I cannot establish whether complementary assertions already cover this limitation. This is an unresolved validation gap, not a claim that a production subscription-routing defect has been demonstrated.

Repository review findings and conventions

The seven-skill summary reported zero deterministic findings; its semantic review targets are not an automatic pass. The visible diff adds help examples, forwards identity/target-subscription options through the Backup wrappers, and explicitly rejects managed-identity restore with --use-secondary-region.

Generated ownership is not applicable: no AAZ-generated surface is changed, so no generation-source PR requirement was triggered. The component-prefixed [Backup] title is present. Please ensure the release-note title or History Notes also explicitly represents the new cross-subscription Azure Files restore behavior, not just managed-identity support; a direct HISTORY.rst edit is not requested. No linked issue was supplied, so no Fixes #N reference should be invented—use it if an actual issue is identified.

Risk and human ownership

High risk (repository assessment: 59): re-registration can change authentication for all protected shares in a storage account, and restores gain destination-subscription selection. Backup/identity owning-team review is required; it was not verified by these bounded inputs. No outstanding human change-request review was returned. Preserve the existing merge hold and Agent request state while the failed-validation diagnostics and coverage evidence remain unresolved. This review neither approves nor merges the PR.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[Yong Zhang (yonzhan)]

Please fix CI issues