Replace hardcoded cloud-to-scope mappings with static SSH auth scope and deprecate SshAuthScope parameter by Copilot · Pull Request #29228 · Azure/azure-powershell

Copilot · 2026-03-03T01:06:45Z

Port of Azure CLI extensions PR #9465. Replaces per-cloud scope URL mappings with a single app ID-based scope that works across all clouds, and deprecates the SshAuthScope environment property.

Changes

SshCredentialFactory.cs: Remove CloudToScope dictionary (which only covered AzureCloud, AzureChinaCloud, AzureUSGovernment) and the AzureSshAuthScope environment property lookup. The SSH auth scope is now solely determined by the static value ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0/.default, which works across all clouds.
SetAzureRMEnvironment.cs and AddAzureRMEnvironment.cs: Updated the SshAuthScope parameter's HelpMessage metadata to indicate it is deprecated and will be removed in a future release.
Set-AzEnvironment.md and Add-AzEnvironment.md: Updated the -SshAuthScope parameter description to indicate it is deprecated and will be removed in a future release.
ChangeLog.md: Added entries for the static scope change and the deprecation of -SshAuthScope.

// Before: cloud-specific dictionary lookup, fails for unlisted clouds
return environment.GetProperty(AzureEnvironment.ExtendedEndpoint.AzureSshAuthScope)
    ?? CloudToScope.GetValueOrDefault(environment.Name.ToLower(), null);

// After: static scope works for all clouds, no environment property reference
return $"{AadSshLoginForLinuxServerAppId}/.default";

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

azure-client-tools-bot-prd · 2026-03-03T01:06:47Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

Replace the CloudToScope dictionary mapping specific cloud names to cloud-specific scope URLs with a single static scope using the AAD SSH Login for Linux server app ID (ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0). This enables SSH authentication across all clouds instead of only supporting AzureCloud, AzureChinaCloud, and AzureUSGovernment. The environment property AzureSshAuthScope still takes precedence when set, preserving backward compatibility. Similar to Azure CLI extensions PR #9465. Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

isra-fel · 2026-03-03T01:55:10Z

@copilot here are my comments:
Let's deprecate the AzureSshAuthScope property by (a) do not reference it at all in SshCredentialFactory.cs and rely solely on the static scope value (b) update the reference documents of Set-AzEnvironment or Add-AzEnvironment (potentially more docs) to state that do not use the AzureSshAuthScope parameter.

- Remove AzureSshAuthScope environment property lookup from SshCredentialFactory.cs, relying solely on static scope value - Remove unused using directives (AzPSKeyNotFoundException, etc.) - Update Set-AzEnvironment and Add-AzEnvironment help docs to mark -SshAuthScope parameter as deprecated - Update ChangeLog.md with deprecation notice Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

…64UrlHelper) Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot · 2026-03-03T02:01:31Z

@copilot here are my comments:
Let's deprecate the AzureSshAuthScope property by (a) do not reference it at all in SshCredentialFactory.cs and rely solely on the static scope value...

Done in a165a45. Changes made:

SshCredentialFactory.cs: Removed AzureSshAuthScope environment property lookup entirely — GetAuthScope() now returns only the static scope value (ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0/.default). Also removed the now-unnecessary null check and AzPSKeyNotFoundException throw.
Set-AzEnvironment.md and Add-AzEnvironment.md: Updated the -SshAuthScope parameter description to state it is deprecated and has no effect.
ChangeLog.md: Added deprecation notice for the -SshAuthScope parameter.

isra-fel · 2026-03-03T02:14:12Z

One last thing @copilot find the source code of the *-AzEnvironment cmdlets and update the paraemter metadata in it, because they are the source of truth of documents.

…zEnvironment cmdlet source Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot · 2026-03-03T02:18:00Z

One last thing @copilot find the source code of the *-AzEnvironment cmdlets and update the paraemter metadata in it, because they are the source of truth of documents.

Updated the HelpMessage in both SetAzureRMEnvironment.cs and AddAzureRMEnvironment.cs to indicate the -SshAuthScope parameter is deprecated and has no effect. See commit 0aee3e8.

Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

… copilot/refactor-cloud-scope-mappings

isra-fel · 2026-03-03T09:44:09Z

/azp run azure-powershell - security-tools

azure-pipelines · 2026-03-03T09:44:19Z

Azure Pipelines successfully started running 1 pipeline(s).

isra-fel

LGTM

Copilot

Pull request overview

This PR updates Azure PowerShell’s SSH certificate authentication to use a single, cross-cloud AAD app scope instead of per-cloud scope mappings, and deprecates the -SshAuthScope environment parameter accordingly.

Changes:

Simplified SshCredentialFactory to always use a static SSH auth scope (ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0/.default) and removed the cloud-to-scope mapping + environment property lookup.
Marked -SshAuthScope as deprecated in cmdlet parameter help metadata (Add-AzEnvironment, Set-AzEnvironment) and updated reference help markdown.
Added release notes entries describing the static scope change and the parameter deprecation.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/Accounts/Authentication/Factories/SshCredentialFactory.cs	Removes cloud/env-property scope resolution in favor of a single static `.default` scope.
src/Accounts/Accounts/Environment/SetAzureRMEnvironment.cs	Updates `-SshAuthScope` parameter help text to indicate deprecation.
src/Accounts/Accounts/Environment/AddAzureRMEnvironment.cs	Updates `-SshAuthScope` parameter help text to indicate deprecation.
src/Accounts/Accounts/help/Set-AzEnvironment.md	Updates `-SshAuthScope` reference help to indicate deprecation.
src/Accounts/Accounts/help/Add-AzEnvironment.md	Updates `-SshAuthScope` reference help to indicate deprecation.
src/Accounts/Accounts/ChangeLog.md	Adds Upcoming Release notes for the static scope behavior and deprecation.

Copilot · 2026-03-03T09:53:11Z

src/Accounts/Accounts/ChangeLog.md

+* Replaced hardcoded cloud-to-scope mappings in SSH credential factory with a static scope, enabling SSH authentication across all clouds.
+* Deprecated the `-SshAuthScope` parameter in `Set-AzEnvironment` and `Add-AzEnvironment`. The SSH authentication scope is now determined automatically.


These ChangeLog entries are fairly implementation-focused (e.g., “cloud-to-scope mappings in SSH credential factory”). Since the ChangeLog is user-facing, consider rephrasing in terms of user impact (e.g., SSH certificate auth now works across Azure clouds without configuring -SshAuthScope, and -SshAuthScope is deprecated).

Suggested change

* Replaced hardcoded cloud-to-scope mappings in SSH credential factory with a static scope, enabling SSH authentication across all clouds.

* Deprecated the `-SshAuthScope` parameter in `Set-AzEnvironment` and `Add-AzEnvironment`. The SSH authentication scope is now determined automatically.

* Improved SSH (Secure Shell) certificate authentication for Az SSH cmdlets across all Azure clouds.

- SSH certificate authentication now works across all Azure clouds without configuring the `-SshAuthScope` parameter.

- The `-SshAuthScope` parameter in `Set-AzEnvironment` and `Add-AzEnvironment` is deprecated, and the SSH authentication scope is now determined automatically.

src/Accounts/Authentication/Factories/SshCredentialFactory.cs

Copilot · 2026-03-03T09:53:12Z

src/Accounts/Accounts/Environment/SetAzureRMEnvironment.cs

        [Parameter(ParameterSetName = EnvironmentPropertiesParameterSet, Mandatory = false, ValueFromPipelineByPropertyName = true,
-            HelpMessage = "The scope for authentication when SSH to an Azure VM.")]
+            HelpMessage = "This parameter is deprecated and will be removed in a future release. The SSH authentication scope is now determined automatically and does not need to be configured.")]
        public string SshAuthScope { get; set; }


-SshAuthScope is now documented as deprecated, but the cmdlet still persists the value into the environment (AzureSshAuthScope). Since the SSH credential flow no longer reads this endpoint, consider emitting a warning when the parameter is supplied (and/or ignoring it) to avoid users thinking it will affect SSH auth.

Suggested change

public string SshAuthScope { get; set; }

[Obsolete("This parameter is deprecated and is ignored. SSH authentication scope is determined automatically.")]

public string SshAuthScope

{

get

{

// This parameter is deprecated and intentionally ignored.

// Returning null ensures that any existing code paths that read this

// property will not use a user supplied value.

return null;

}

set

{

if (!string.IsNullOrEmpty(value))

{

// Emit a warning so users know this parameter no longer affects SSH authentication.

WriteWarning("The SshAuthScope parameter is deprecated and is ignored. SSH authentication scope is now determined automatically and does not need to be configured.");

}

}

}

Copilot · 2026-03-03T09:53:13Z

src/Accounts/Accounts/Environment/AddAzureRMEnvironment.cs

        [Parameter(ParameterSetName = EnvironmentPropertiesParameterSet, Mandatory = false, ValueFromPipelineByPropertyName = true,
-            HelpMessage = "The scope for authentication when SSH to an Azure VM.")]
+            HelpMessage = "This parameter is deprecated and will be removed in a future release. The SSH authentication scope is now determined automatically and does not need to be configured.")]
        public string SshAuthScope { get; set; }


-SshAuthScope is now documented as deprecated, but the cmdlet still persists the value into the environment (AzureSshAuthScope). Since the SSH credential flow no longer reads this endpoint, consider emitting a warning when the parameter is supplied (and/or ignoring it) to avoid users thinking it will affect SSH auth.

Initial plan

f8e4057

Copilot AI assigned Copilot and isra-fel Mar 3, 2026

Copilot started work on behalf of isra-fel March 3, 2026 01:06 View session

Copilot AI and others added 2 commits March 3, 2026 01:17

Simplify changelog entry to remove unexpanded acronyms

031e850

Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Refactor cloud-to-scope mappings to use static value~~ Replace hardcoded cloud-to-scope mappings with static SSH auth scope Mar 3, 2026

Copilot finished work on behalf of isra-fel March 3, 2026 01:20

Copilot started work on behalf of isra-fel March 3, 2026 01:55 View session

Copilot AI and others added 2 commits March 3, 2026 01:59

Restore WindowsAzure.Commands.Utilities.Common using (needed for Base…

a165a45

…64UrlHelper) Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot AI changed the title ~~Replace hardcoded cloud-to-scope mappings with static SSH auth scope~~ Replace hardcoded cloud-to-scope mappings with static SSH auth scope and deprecate SshAuthScope parameter Mar 3, 2026

Copilot finished work on behalf of isra-fel March 3, 2026 02:02

Copilot started work on behalf of isra-fel March 3, 2026 02:14 View session

Update SshAuthScope parameter metadata in Set-AzEnvironment and Add-A…

0aee3e8

…zEnvironment cmdlet source Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Improve deprecation message wording to follow PowerShell conventions

7f1d4be

Co-authored-by: isra-fel <11371776+isra-fel@users.noreply.github.com>

Copilot finished work on behalf of isra-fel March 3, 2026 02:19

Merge branch 'main' of https://github.com/Azure/azure-powershell into…

8745549

… copilot/refactor-cloud-scope-mappings

isra-fel marked this pull request as ready for review March 3, 2026 09:43

Copilot AI review requested due to automatic review settings March 3, 2026 09:43

update changelog

9e0c724

isra-fel approved these changes Mar 3, 2026

View reviewed changes

Copilot started reviewing on behalf of isra-fel March 3, 2026 09:47 View session

isra-fel requested a review from vthiebaut10 March 3, 2026 09:47

isra-fel enabled auto-merge (squash) March 3, 2026 09:48

Copilot AI reviewed Mar 3, 2026

View reviewed changes

vthiebaut10 approved these changes Mar 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace hardcoded cloud-to-scope mappings with static SSH auth scope and deprecate SshAuthScope parameter#29228

Replace hardcoded cloud-to-scope mappings with static SSH auth scope and deprecate SshAuthScope parameter#29228
Copilot wants to merge 9 commits intomainfrom
copilot/refactor-cloud-scope-mappings

Copilot AI commented Mar 3, 2026 •

edited

Loading

Uh oh!

azure-client-tools-bot-prd bot commented Mar 3, 2026

Uh oh!

isra-fel commented Mar 3, 2026

Uh oh!

Copilot AI commented Mar 3, 2026

Uh oh!

isra-fel commented Mar 3, 2026

Uh oh!

Copilot AI commented Mar 3, 2026

Uh oh!

isra-fel commented Mar 3, 2026

Uh oh!

azure-pipelines bot commented Mar 3, 2026

Uh oh!

isra-fel left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		* Replaced hardcoded cloud-to-scope mappings in SSH credential factory with a static scope, enabling SSH authentication across all clouds.
		* Deprecated the `-SshAuthScope` parameter in `Set-AzEnvironment` and `Add-AzEnvironment`. The SSH authentication scope is now determined automatically.

-* Replaced hardcoded cloud-to-scope mappings in SSH credential factory with a static scope, enabling SSH authentication across all clouds.
-* Deprecated the `-SshAuthScope` parameter in `Set-AzEnvironment` and `Add-AzEnvironment`. The SSH authentication scope is now determined automatically.
+* Improved SSH (Secure Shell) certificate authentication for Az SSH cmdlets across all Azure clouds.
+    - SSH certificate authentication now works across all Azure clouds without configuring the `-SshAuthScope` parameter.
+    - The `-SshAuthScope` parameter in `Set-AzEnvironment` and `Add-AzEnvironment` is deprecated, and the SSH authentication scope is now determined automatically.

-        public string SshAuthScope { get; set; }
+        [Obsolete("This parameter is deprecated and is ignored. SSH authentication scope is determined automatically.")]
+        public string SshAuthScope
+        {
+            get
+            {
+                // This parameter is deprecated and intentionally ignored.
+                // Returning null ensures that any existing code paths that read this
+                // property will not use a user supplied value.
+                return null;
+            }
+            set
+            {
+                if (!string.IsNullOrEmpty(value))
+                {
+                    // Emit a warning so users know this parameter no longer affects SSH authentication.
+                    WriteWarning("The SshAuthScope parameter is deprecated and is ignored. SSH authentication scope is now determined automatically and does not need to be configured.");
+                }
+            }
+        }

Conversation

Copilot AI commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

azure-client-tools-bot-prd bot commented Mar 3, 2026

Uh oh!

isra-fel commented Mar 3, 2026

Uh oh!

Copilot AI commented Mar 3, 2026

Uh oh!

isra-fel commented Mar 3, 2026

Uh oh!

Copilot AI commented Mar 3, 2026

Uh oh!

isra-fel commented Mar 3, 2026

Uh oh!

azure-pipelines bot commented Mar 3, 2026

Uh oh!

isra-fel left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Mar 3, 2026 •

edited

Loading