Repository navigation
Fix orchestrated web search and deep research in V2 chat - #1582
Merged
Paul Lizer (paullizer) merged 5 commits intoSep 30, 2026
Conversation
Orchestrated web search, linked-page, deep research, agent and action steps reread the user's app roles from Microsoft Graph with the application's own identity. Without the Directory.Read.All application permission Graph answers 403, which surfaced as "A required retained result is unavailable or changed." - Report application-side directory refusals with their own reasons and the directory_access_unavailable step code, telling users which source could not be verified and to contact their administrator. - Warn administrators in Admin Settings (Chat Orchestration and Web Search) and with a once-per-day admin notification, with an admin-only check route. - Request and consent to Directory.Read.All in the Bicep/azd, Azure CLI and Terraform deployers (deployer version 1.0.33). - Add tests, fix documentation, admin docs and release notes (0.261.204). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Render the real Chat Orchestration and Web Search panes and run the directory access module in Chromium against a simulated check endpoint. Cover each warning state, Check again (in progress, success and a failed retry), a failed first check, server values shown as text, the See how to fix it card link, and the warnings at desktop and 390px widths. 21 deliberate breakages of the module and the two templates were each caught. Document the UI test in the fix doc and release notes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Orchestrated web search, linked-page and deep research steps failed with "A required retained result is unavailable or changed." Two causes: - Orchestration read each user's app roles from Microsoft Graph on every call, which needs Directory.Read.All. Classic chat never does this. - Deep research refused to start whenever query or link planning was on, which is the default. Changes: - Revert the unreleased Directory.Read.All grant, deployer, admin warning and notification work (11a6dcb, 500639a). - Replace the Graph reader with SessionExternalIdentityReader, which trusts the signed-in session's roles like classic chat and still rechecks conversation ownership, settings and access restrictions on every call. - Remove the research planner profile gate; planners run after attestation and a planner setting change during a run stops the step. - Keep the refusal's stable code as authority_reason and map a missing signed-in session to the new external_session_required failure, which asks the user to send the request again. Failure events log the code as sc_authority_reason. - Update tests, feature docs, logging tags, admin docs, release notes and add ORCHESTRATION_SESSION_IDENTITY_FIX.md. Version 0.261.205. Refs microsoft#1509 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Resolve the two conflicts with the base branch. The base took 0.261.205 through 0.261.208 for other changes, so this fix moves above them: - config.py: VERSION 0.261.209 (base was 0.261.208). - release_notes.md: keep every base section and put this fix's entry on top as v0.261.209. Refs microsoft#1509 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The base branch used 0.261.205 for the workflow flow canvas fix, so this fix now ships in 0.261.209. Move its module version headers, implemented-in markers, test version assertions, fix doc, feature docs, admin troubleshooting row and logging tag note to 0.261.209. The base's own 0.261.205 references are unchanged. Refs microsoft#1509 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Paul Lizer (paullizer)
merged commit Sep 30, 2026
b0ed6ea
into
microsoft:paullizer-react-v2-ui
11 checks passed
This was referenced Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
In V2 chat, every orchestrated web search, linked-page read and deep research step failed with "A required retained result is unavailable or changed." This PR makes them work without any new permission, deployer change or setting.
Directory.Read.Allapplication permission, which deployments don't grant; classic chat never makes this call. The test deployment's Application Insights showed the GraphGET /users/{id}call returning 403 on every run. Separately, deep research refused to start whenever query or link planning was on, which is the default.external_session_requiredmessage asking the user to send the request again. Step, saved-wait, finalization and content-preparation failure events log the refusal code assc_authority_reason.Reviewer notes
11a6dcb1b,500639ab3) were an earlier approach: grantDirectory.Read.All, add it to the deployers, and warn admins when it is missing.8a804e45areverts them and adds the fix above. Please review the net diff; a squash merge is recommended. The net diff does not touchdeployers/or admin templates.Directory.Read.Allgrant made only for orchestration can be revoked.Linked issue
Refs #1509
Release Notes & Latest Features
Is this visible to end users?
Is this admin-facing (Admin Settings, governance, deployment, config)?
Should this become a Latest Feature card?
Screenshot needed for the card?
Version bump
application/single_app/config.pyVERSIONthird segment bumped, or not needed because this is docs-onlydeployers/version.txtbumped, or not needed becausedeployers/was not changedThis branch uses
0.261.205. The target branch is now at0.261.208, soconfig.pyanddocs/explanation/release_notes.mdconflict, and the version and its release notes section need renumbering (for example to0.261.209) before merge. All code and other doc files merge cleanly.Testing / validation
python -m pyteston the nine changed orchestration test files (external_identity,external_bootstrap,external_error_markers,external_preflight_adapter,research_capture,research_pre_effect,dependency_runtime,source_authority_runtime,image_references): 674 passed, 92 subtests passed.python .\functional_tests\test_docs_app_surface_coverage.py(7/7) andpython .\functional_tests\test_docs_site_quality.py(6/6).Documentation
New fix doc:
docs/explanation/fixes/ORCHESTRATION_SESSION_IDENTITY_FIX.md. Updated:ORCHESTRATION_EXTERNAL_SOURCE_ACCESS.md,ORCHESTRATION_CHECKPOINT_RECOVERY.md,ORCHESTRATION_GATHER_REASON_RENDER.md,ANALYZE_RESULTS.md,docs/admin/orchestration.mdanddocs/reference/logging-tags.md.Security checklist
@swagger_route(security=get_auth_security())(N/A: no new routes)sanitize_settings_for_user()(N/A: no settings sent to the browser)