[PS] Migrate SecurityInsights module to autorest v4 by JoyerJin · Pull Request #28447 · Azure/azure-powershell

JoyerJin · 2025-08-25T02:24:04Z

Description

Preannouncement PR:

Mandatory Checklist

Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)
- General release
- Public preview
- Private preview
- Engineering build
- No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

SHOULD update ChangeLog.md file(s) appropriately
- Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
  - A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
- Should not change ChangeLog.md if no new release is required, such as fixing test case only.
SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
SHOULD have proper test coverage for changes in pull request.
SHOULD NOT adjust version of module manually in pull request

azure-client-tools-bot-prd · 2025-08-25T02:24:07Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

Copilot

Pull Request Overview

This PR migrates the SecurityInsights module from AutoRest v3 to v4, updating API models and cmdlet structure. The migration involves significant changes to parameter types, output types, and method signatures to align with the newer AutoRest framework.

Key Changes

Type simplification from strongly-typed enums to string parameters for improved flexibility
Output type namespace updates from versioned API models to unversioned ones
Addition of new parameter sets and JSON-based input methods for cmdlets

Reviewed Changes

Copilot reviewed 150 out of 151 changed files in this pull request and generated 3 comments.

File	Description
`tools/StaticAnalysis/Exceptions/Az.SecurityInsights/BreakingChangeIssues.csv`	Documents expected breaking changes from the AutoRest v4 migration
Multiple help markdown files	Updated parameter types, output types, and documentation to reflect API changes

tools/StaticAnalysis/Exceptions/Az.SecurityInsights/BreakingChangeIssues.csv

src/SecurityInsights/SecurityInsights/help/New-AzSentinelAlertRule.md

src/SecurityInsights/SecurityInsights/help/New-AzSentinelIncidentTeam.md

github-actions · 2025-09-02T03:50:36Z

To the author of the pull request,
This PR was labeled "Breaking Change Release" because it contains breaking changes.

According to our policy, breaking changes can only take place during major release and they must be preannounced.
Please follow our guide on the detailed steps.
Required: Please fill in the task below to facilitate our contact,you will receive notifications related to breaking changes.

Copilot

Pull request overview

Copilot reviewed 152 out of 153 changed files in this pull request and generated no new comments.

isra-fel · 2026-01-29T02:09:36Z

/azp run

azure-pipelines · 2026-01-29T02:09:49Z

Azure Pipelines successfully started running 3 pipeline(s).

NoriZC · 2026-03-16T05:39:28Z

/azp run

azure-pipelines · 2026-03-16T05:39:43Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 152 out of 153 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/SecurityInsights/SecurityInsights.Autorest/test/Update-AzSentinelOnboardingState.Tests.ps1:24

Both test cases are marked -skip and contain only a NotImplementedException placeholder, so there is currently no automated coverage for Update-AzSentinelOnboardingState despite the cmdlet being introduced/updated in this PR.

Suggested fix: replace these placeholders with real tests (record/playback or mocking) that execute the cmdlet for the supported parameter sets, and remove -skip once they pass reliably.

src/SecurityInsights/SecurityInsights.Autorest/custom/New-AzSentinelEntityQuery.ps1

+        [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("Activity","Expansion")]
        [Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')]


azure-pipelines · 2026-03-26T01:09:14Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 119 out of 231 changed files in this pull request and generated 4 comments.

Copilot · 2026-03-26T01:22:29Z

src/SecurityInsights/SecurityInsights.Autorest/docs/Az.SecurityInsights.md

 ---
 Module Name: Az.SecurityInsights
-Module Guid: a632df01-f50e-49fb-b2de-e91a0090c840
+Module Guid: af57d10d-6c73-4b37-8412-1fcd11cadd1b


The module GUID in this generated reference doc doesn’t match the module manifest GUID (Az.SecurityInsights.psd1 has GUID 453d4fb9-65ec-4cf1-8358-6a0fbd995d19). This will make the reference docs inconsistent with the actual module metadata; please regenerate/fix so the GUID matches the manifest.

Suggested change

Module Guid: af57d10d-6c73-4b37-8412-1fcd11cadd1b

Module Guid: 453d4fb9-65ec-4cf1-8358-6a0fbd995d19

Copilot · 2026-03-26T01:22:29Z

...SecurityInsights.Autorest/test/deployment-templates/alertRuleAction/template.parameters.json

    "logicAppResourceId": {
-      "value": "/subscriptions/51a36d38-3b14-471f-8dde-a5867f5e51eb/resourceGroups/aspstestt6jdws/providers/Microsoft.Logic/workflows/Block-AADUser-Alert"
+      "value": "/subscriptions/419581d6-4853-49bd-83b6-d94bb8a77887/resourceGroups/aspstest4pr7te/providers/Microsoft.Logic/workflows/Block-AADUser-Alert"
    },
    "triggerUrl": {
-      "value": "https://prod-26.centralus.logic.azure.com:443/workflows/e25a9538589f4273ac4b33c4251b7af4/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=Hj0XFCgxJZSvdepbdqqkhAyUOVNJNiGHf8Sbpdvny6k"
+      "value": "https://prod-18.centralus.logic.azure.com:443/workflows/fdce5d8d4e914b7b99bd10b290075cc2/triggers/When_a_response_to_an_Azure_Sentinel_alert_is_triggered/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2FWhen_a_response_to_an_Azure_Sentinel_alert_is_triggered%2Frun&sv=1.0&sig=OV1Z3sQTFbx35g3KA-kqWwdvdY2DLKcq1wcLPj5VjRU"
    }


triggerUrl contains a Logic App callback URL with a sig= token. This is effectively a secret and shouldn’t be committed in a test deployment template; consider parameterizing it (e.g., load from env/secure pipeline variables) and ensure recordings/templates filter or redact the signature.

Copilot · 2026-03-26T01:22:29Z

src/SecurityInsights/SecurityInsights.Autorest/test/Update-AzSentinelIncidentRelation.Tests.ps1

+        { Update-AzSentinelIncidentRelation -ResourceGroupName $env.resourceGroupName -WorkspaceName $env.workspaceName `
+            -IncidentId $env.UpdateincidentRelationIncidentId -RelationName $env.UpdateincidentRelationId -RelatedResourceId $bookmark.Id } | Should -Throw "already exists on incident"


This test asserts on a specific substring in the thrown error message ("already exists on incident"). Error message text can change (service wording, SDK, localization), making the test brittle; consider asserting on a more stable signal such as HTTP status code (409) / error code, or exception type.

Copilot · 2026-03-26T01:22:30Z

src/SecurityInsights/SecurityInsights.Autorest/test/Update-AzSentinelIncidentRelation.Tests.ps1

@@ -30,7 +31,6 @@ Describe 'Update-AzSentinelIncidentRelation' {
            -QueryStartTime (get-date).ToUniversalTime() -QueryEndTime (get-date).AddDays(-1).ToUniversalTime() -EventTime (get-date).ToUniversalTime()
        $incidentRelation = Get-AzSentinelIncidentRelation -ResourceGroupName $env.resourceGroupName -WorkspaceName $env.workspaceName `
            -IncidentId $env.UpdateViaIdincidentRelationIncidentId -RelationName $env.UpdateViaIdincidentRelationId 
-        $incidentRelationUpdate = Update-AzSentinelIncidentRelation -InputObject $IncidentRelation -RelatedResourceId $bookmark.Id
-        $incidentRelationUpdate.RelatedResourceId | should -be $bookmark.id
+        { Update-AzSentinelIncidentRelation -InputObject $IncidentRelation -RelatedResourceId $bookmark.Id } | Should -Throw "already exists on incident"


Same as above: matching the thrown exception by message text ("already exists on incident") is fragile. Prefer asserting on status code/error code/exception type so the test doesn’t break on minor wording changes.

NoriZC · 2026-03-26T04:09:01Z

/azp run

azure-pipelines · 2026-03-26T04:09:15Z

Azure Pipelines successfully started running 3 pipeline(s).

NoriZC · 2026-03-27T07:39:23Z

/azp run

Copilot

Pull request overview

Copilot reviewed 119 out of 231 changed files in this pull request and generated no new comments.

azure-pipelines · 2026-03-27T07:39:37Z

Azure Pipelines successfully started running 3 pipeline(s).

This reverts commit 555e2d4.

NoriZC · 2026-03-27T09:39:12Z

/azp run

azure-pipelines · 2026-03-27T09:39:27Z

Azure Pipelines successfully started running 3 pipeline(s).

…fix CredScan (#29336) Co-authored-by: hadasi6 <hadasi6@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 120 out of 232 changed files in this pull request and generated 2 comments.

Copilot · 2026-03-30T01:01:02Z

...sights/SecurityInsights.Autorest/test/deployment-templates/bookmark/template.parameters.json

    "queryStartTime": {
-      "Value": "2022-07-28T06:00:00.000Z"
+      "Value": "2026-03-24T07:00:00.000Z"
    },
    "queryEndTime": {
-      "Value": "2022-07-29T06:00:00.000Z"
+      "Value": "2026-03-25T07:00:00.000Z"
    }


This ARM deployment parameters file mixes value and Value for parameter values (e.g., queryStartTime/queryEndTime). The schema uses value (lowercase); using Value may cause deployments to ignore the parameter or fail validation. Normalize these to value for consistency and correctness.

Copilot · 2026-03-30T01:01:02Z

...ecurityInsights.Autorest/test/deployment-templates/bookmarkRelation/template.parameters.json

    "workspaceName": {
-      "Value": "asptest1qlb2s"
+      "Value": "asptest4yt0n3"
    }


workspaceName uses Value (capital V) instead of the standard value property in ARM deployment parameters. This is inconsistent with the rest of the file and may break template parameter binding; use value consistently.

NoriZC · 2026-03-30T01:08:44Z

/azp run

azure-pipelines · 2026-03-30T01:08:59Z

Azure Pipelines successfully started running 3 pipeline(s).

…Scan (#29339) Co-authored-by: hadasi6 <hadasi6@users.noreply.github.com>

NoriZC · 2026-03-31T02:42:39Z

/azp run

azure-pipelines · 2026-03-31T02:42:54Z

Azure Pipelines successfully started running 3 pipeline(s).

…m/Azure/azure-powershell into jiaseng/main/SecurityInsight-v4

Copilot

Pull request overview

Copilot reviewed 120 out of 232 changed files in this pull request and generated 1 comment.

Copilot · 2026-04-08T02:56:45Z

src/SecurityInsights/SecurityInsights.Autorest/test/Update-AzSentinelIncidentRelation.Tests.ps1

+    # The incidents/relations endpoint returns 409 when updating an existing relation's target.
+
    It 'UpdateExpanded' {
        $bookmark = New-AzSentinelBookmark -ResourceGroupName $env.resourceGroupName `
            -Id $env.UpdateincidentRelationBookmarkId2 -WorkspaceName $env.workspaceName -DisplayName $env.UpdateincidentRelationBookmarkName2 -Query "SecurityEvent\n| take 1" `
            -QueryStartTime (get-date).ToUniversalTime() -QueryEndTime (get-date).AddDays(-1).ToUniversalTime() -EventTime (get-date).ToUniversalTime()
-        $incidentRelation = Update-AzSentinelIncidentRelation -ResourceGroupName $env.resourceGroupName -WorkspaceName $env.workspaceName `
-            -IncidentId $env.UpdateincidentRelationIncidentId -RelationName $env.UpdateincidentRelationId -RelatedResourceId $bookmark.Id
-        $incidentRelation.RelatedResourceId | should -be $bookmark.id
+        { Update-AzSentinelIncidentRelation -ResourceGroupName $env.resourceGroupName -WorkspaceName $env.workspaceName `
+            -IncidentId $env.UpdateincidentRelationIncidentId -RelationName $env.UpdateincidentRelationId -RelatedResourceId $bookmark.Id } | Should -Throw "already exists on incident"
    }


The test now asserts Should -Throw "already exists on incident", which couples the test to an exact/partial error message that can change with service wording, localization, or SDK error formatting. Prefer asserting on a stable signal (e.g., HTTP status code 409, an error code, or exception type) while still documenting the expected conflict behavior in the comment.

VeryEarly · 2026-04-08T03:08:58Z

/azp run

azure-pipelines · 2026-04-08T03:09:05Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

JoyerJin added 2 commits August 21, 2025 10:33

migrate SecurityInsights module to autorest v4

f6c8ee6

update example

4e9517f

JoyerJin added 2 commits August 25, 2025 17:51

breaking change issues exceptions

83763b6

hide Update variant to customize

e98c4ee

JoyerJin marked this pull request as ready for review August 26, 2025 07:24

Copilot AI review requested due to automatic review settings August 26, 2025 07:24

Copilot AI reviewed Aug 26, 2025

View reviewed changes

update examples

d3f8439

VeryEarly added the Contains Breaking Change This PR contains breaking change label Sep 2, 2025

Merge branch 'main' into joyer/SecurityInsights-migrate-v4

7ccdeb2

isra-fel added the autorest v4 migration pr migrating module from generated by autorest.powershell v3 to v4 label Oct 2, 2025

Pan-Qi marked this pull request as draft January 8, 2026 07:19

Pan-Qi marked this pull request as ready for review January 9, 2026 05:13

Copilot AI review requested due to automatic review settings January 9, 2026 05:13

Copilot started reviewing on behalf of Pan-Qi January 9, 2026 05:16 View session

Copilot AI reviewed Jan 9, 2026

View reviewed changes

isra-fel assigned Pan-Qi Jan 28, 2026

isra-fel added this to the Az 16.0.0 (TBD) milestone Jan 28, 2026

JiaSeng-v added 2 commits January 29, 2026 09:39

rebuild with Autorest 4.0.752

08737e6

solve conflict

51a797c

fix merge conflict

bc4ddda

Copilot AI review requested due to automatic review settings March 16, 2026 05:35

Copilot started reviewing on behalf of JiaSeng-v March 16, 2026 05:37 View session

Copilot AI reviewed Mar 16, 2026

View reviewed changes

src/SecurityInsights/SecurityInsights.Autorest/custom/New-AzSentinelEntityQuery.ps1

Comment on lines +59 to 60

[Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("Activity","Expansion")]

[Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')]

Copilot AI reviewed Mar 26, 2026

View reviewed changes

replace secret

72a84ba

solve credentail scan

555e2d4

Copilot AI review requested due to automatic review settings March 27, 2026 07:32

Copilot started reviewing on behalf of JiaSeng-v March 27, 2026 07:35 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

Revert "solve credentail scan"

40e4888

This reverts commit 555e2d4.

[SecurityInsights] Redact credentials from test recording headers to …

2e4a62a

…fix CredScan (#29336) Co-authored-by: hadasi6 <hadasi6@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 30, 2026 00:55

Copilot started reviewing on behalf of JiaSeng-v March 30, 2026 00:57 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

Redact password patterns from AlertRuleTemplate recording to fix Cred…

895af88

…Scan (#29339) Co-authored-by: hadasi6 <hadasi6@users.noreply.github.com>

JiaSeng-v added 2 commits April 8, 2026 10:47

fix conflict

6ebb26a

Merge branch 'joyer/SecurityInsights-migrate-v4' of https://github.co…

12be642

…m/Azure/azure-powershell into jiaseng/main/SecurityInsight-v4

Copilot AI review requested due to automatic review settings April 8, 2026 02:49

Copilot started reviewing on behalf of JiaSeng-v April 8, 2026 02:51 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

		[Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.PSArgumentCompleterAttribute("Activity","Expansion")]
		[Microsoft.Azure.PowerShell.Cmdlets.SecurityInsights.Category('Body')]

	Module Guid: af57d10d-6c73-4b37-8412-1fcd11cadd1b
	Module Guid: 453d4fb9-65ec-4cf1-8358-6a0fbd995d19

		{ Update-AzSentinelIncidentRelation -ResourceGroupName $env.resourceGroupName -WorkspaceName $env.workspaceName `
		-IncidentId $env.UpdateincidentRelationIncidentId -RelationName $env.UpdateincidentRelationId -RelatedResourceId $bookmark.Id } \| Should -Throw "already exists on incident"

Conversation

JoyerJin commented Aug 25, 2025 • edited by JiaSeng-v Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd bot commented Aug 25, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Sep 2, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

isra-fel commented Jan 29, 2026

Uh oh!

azure-pipelines bot commented Jan 29, 2026

Uh oh!

NoriZC commented Mar 16, 2026

Uh oh!

azure-pipelines bot commented Mar 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

azure-pipelines bot commented Mar 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

NoriZC commented Mar 26, 2026

Uh oh!

azure-pipelines bot commented Mar 26, 2026

Uh oh!

NoriZC commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

azure-pipelines bot commented Mar 27, 2026

Uh oh!

NoriZC commented Mar 27, 2026

Uh oh!

azure-pipelines bot commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

NoriZC commented Mar 30, 2026

JoyerJin commented Aug 25, 2025 •

edited by JiaSeng-v

Loading