From ea079c0dfcc7707c47cba9769986452eb418856d Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Tue, 14 Jul 2026 10:32:25 -0700 Subject: [PATCH 1/9] fix(identity): use beta tag for integration tests to fix broken alpha deps The 'dev' dist-tag resolves to a nightly alpha build that depends on @azure/logger@>=1.4.0-alpha, but no such alpha versions exist since @azure/logger@1.4.0 was released as stable. The 'beta' tag uses standard dependency ranges that resolve from public npm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- sdk/identity/identity/integration/AzureKubernetes/package.json | 2 +- sdk/identity/identity/integration/AzureWebApps/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sdk/identity/identity/integration/AzureKubernetes/package.json b/sdk/identity/identity/integration/AzureKubernetes/package.json index e817d3c7abb7..1991ac1cb528 100644 --- a/sdk/identity/identity/integration/AzureKubernetes/package.json +++ b/sdk/identity/identity/integration/AzureKubernetes/package.json @@ -11,7 +11,7 @@ "author": "", "license": "ISC", "dependencies": { - "@azure/identity": "dev", + "@azure/identity": "beta", "@azure/storage-blob": "^12.17.0", "express": "^5.2.1", "dotenv": "^16.0.0" diff --git a/sdk/identity/identity/integration/AzureWebApps/package.json b/sdk/identity/identity/integration/AzureWebApps/package.json index 511905204fd6..2225b0cb13c9 100644 --- a/sdk/identity/identity/integration/AzureWebApps/package.json +++ b/sdk/identity/identity/integration/AzureWebApps/package.json @@ -13,7 +13,7 @@ "type": "module", "license": "ISC", "dependencies": { - "@azure/identity": "dev", + "@azure/identity": "beta", "@azure/storage-blob": "^12.17.0", "express": "^5.2.1", "tslib": "^1.10.0" From 962a51508bd65049d2cfb0a1da92788497dd869c Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Tue, 7 Jul 2026 14:06:15 -0700 Subject: [PATCH 2/9] [identity] update App Service SKU & change AKS region Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../test-resources-managed-identity.bicep | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/sdk/identity/test-resources-managed-identity.bicep b/sdk/identity/test-resources-managed-identity.bicep index 05f5f90a2a21..4864b24044bd 100644 --- a/sdk/identity/test-resources-managed-identity.bicep +++ b/sdk/identity/test-resources-managed-identity.bicep @@ -6,6 +6,9 @@ param baseName string = resourceGroup().name @description('The location of the resource. By default, this is the same as the resource group.') param location string = resourceGroup().location +@description('The location for the AKS cluster. Defaults to a region with available capacity, decoupled from \'location\', because the resource group\'s region can be constrained (AKSCapacityHeavyUsage). Override to target a different region.') +param aksLocation string = 'eastus2' + @description('The client OID to grant access to test resources.') param testApplicationOid string @@ -140,14 +143,14 @@ resource storageAccountUserAssigned 'Microsoft.Storage/storageAccounts@2021-08-0 } } -resource farm 'Microsoft.Web/serverfarms@2021-03-01' = { +resource farm 'Microsoft.Web/serverfarms@2022-09-01' = { name: '${baseName}_farm' location: location sku: { - name: 'B1' - tier: 'Basic' - size: 'B1' - family: 'B' + name: 'P1v3' + tier: 'PremiumV3' + size: 'P1v3' + family: 'Pv3' capacity: 1 } properties: { @@ -293,7 +296,7 @@ resource acrResource 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' resource kubernetesCluster 'Microsoft.ContainerService/managedClusters@2023-06-01' = { name: baseName - location: location + location: aksLocation identity: { type: 'SystemAssigned' } From 33d337e3fd4962172259a010bb46467315ff2daf Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Tue, 7 Jul 2026 14:24:35 -0700 Subject: [PATCH 3/9] [identity] use D2s_v5 node size available in eastus2 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- sdk/identity/test-resources-managed-identity.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk/identity/test-resources-managed-identity.bicep b/sdk/identity/test-resources-managed-identity.bicep index 4864b24044bd..ba0234890b4a 100644 --- a/sdk/identity/test-resources-managed-identity.bicep +++ b/sdk/identity/test-resources-managed-identity.bicep @@ -308,7 +308,7 @@ resource kubernetesCluster 'Microsoft.ContainerService/managedClusters@2023-06-0 { name: 'agentpool' count: 1 - vmSize: 'Standard_D2s_v3' + vmSize: 'Standard_D2s_v5' osDiskSizeGB: 128 osDiskType: 'Managed' kubeletDiskType: 'OS' From bb8ec491de9aba31acba689f24d153e8d39a78b2 Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Tue, 14 Jul 2026 14:41:20 -0700 Subject: [PATCH 4/9] revert App Service plan SKU back to B1/Basic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- sdk/identity/test-resources-managed-identity.bicep | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sdk/identity/test-resources-managed-identity.bicep b/sdk/identity/test-resources-managed-identity.bicep index ba0234890b4a..446dea3931f4 100644 --- a/sdk/identity/test-resources-managed-identity.bicep +++ b/sdk/identity/test-resources-managed-identity.bicep @@ -143,14 +143,14 @@ resource storageAccountUserAssigned 'Microsoft.Storage/storageAccounts@2021-08-0 } } -resource farm 'Microsoft.Web/serverfarms@2022-09-01' = { +resource farm 'Microsoft.Web/serverfarms@2021-03-01' = { name: '${baseName}_farm' location: location sku: { - name: 'P1v3' - tier: 'PremiumV3' - size: 'P1v3' - family: 'Pv3' + name: 'B1' + tier: 'Basic' + size: 'B1' + family: 'B' capacity: 1 } properties: { From e48df2f6fd96c0d1da36abaf13aef1e1fc45a9dc Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Tue, 14 Jul 2026 14:43:30 -0700 Subject: [PATCH 5/9] shorten aksLocation parameter description Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- sdk/identity/test-resources-managed-identity.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk/identity/test-resources-managed-identity.bicep b/sdk/identity/test-resources-managed-identity.bicep index 446dea3931f4..e0e97323b641 100644 --- a/sdk/identity/test-resources-managed-identity.bicep +++ b/sdk/identity/test-resources-managed-identity.bicep @@ -6,7 +6,7 @@ param baseName string = resourceGroup().name @description('The location of the resource. By default, this is the same as the resource group.') param location string = resourceGroup().location -@description('The location for the AKS cluster. Defaults to a region with available capacity, decoupled from \'location\', because the resource group\'s region can be constrained (AKSCapacityHeavyUsage). Override to target a different region.') +@description('The AKS cluster location. Defaults to eastus2 to avoid capacity constraints in the resource group region.') param aksLocation string = 'eastus2' @description('The client OID to grant access to test resources.') From a462a33cf784fef14e9ee991c2d6631e1b3af838 Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Wed, 15 Jul 2026 10:42:57 -0700 Subject: [PATCH 6/9] add diagnostic logging to VM user-assigned integration test Log the target IP, response status/body on success, and error code/message on failure to help diagnose connectivity issues. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- .../azureVMUserAssignedTest.spec.ts | 23 ++++++++++++++----- 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts b/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts index b8ab6ed06d29..4189a7ac5de7 100644 --- a/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts +++ b/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts @@ -10,19 +10,30 @@ describe("AzureVM UserAssigned Integration test", function () { if (!identityVMIP) { throw new Error("IDENTITY_VM_PUBLIC_IP is not set"); } + console.log(`Connecting to VM at ${identityVMIP}...`); const client = createDefaultHttpClient(); const request = createPipelineRequest({ url: `http://${identityVMIP}`, method: "GET", + timeout: 30000, }); request.allowInsecureConnection = true; - const response = await client.sendRequest(request); + try { + const response = await client.sendRequest(request); + console.log(`Response status: ${response.status}`); + console.log(`Response body: ${response.bodyAsText}`); - assert.strictEqual( - response.status, - 200, - `Expected status code 200, got ${response.status}. Response body: ${response.bodyAsText}`, - ); + assert.strictEqual( + response.status, + 200, + `Expected status code 200, got ${response.status}. Response body: ${response.bodyAsText}`, + ); + } catch (e: any) { + console.error(`Request to VM failed: ${e.message}`); + console.error(`Error code: ${e.code}`); + console.error(`Target URL: http://${identityVMIP}`); + throw e; + } }); }); From 5071100b6c38ad4550c0f32f0219476c1c317b06 Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Wed, 15 Jul 2026 14:26:13 -0700 Subject: [PATCH 7/9] skip VM test, re-enable Azure Functions deployment and test - Skip azureVMUserAssignedTest (VM consistently unreachable) - Uncomment Azure Functions deployment in test-resources-post.ps1 - Unskip azureFunctionsTest to validate Functions MI credential - Revert diagnostic logging from VM test Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- .../integration/azureFunctionsTest.spec.ts | 3 +-- .../azureVMUserAssignedTest.spec.ts | 26 ++++++------------- sdk/identity/test-resources-post.ps1 | 23 ++++++++-------- 3 files changed, 21 insertions(+), 31 deletions(-) diff --git a/sdk/identity/identity/test/integration/azureFunctionsTest.spec.ts b/sdk/identity/identity/test/integration/azureFunctionsTest.spec.ts index 7d0ce8f5cebe..18018e6ca511 100644 --- a/sdk/identity/identity/test/integration/azureFunctionsTest.spec.ts +++ b/sdk/identity/identity/test/integration/azureFunctionsTest.spec.ts @@ -7,8 +7,7 @@ import { describe, it, assert } from "vitest"; import { requireEnvVar } from "../authTestUtils.js"; describe("AzureFunctions Integration test", function () { - // TODO: Reenable the test https://github.com/Azure/azure-sdk-for-js/issues/35416 - it.skip("test the Azure Functions endpoint where the sync MI credential is used.", async function () { + it("test the Azure Functions endpoint where the sync MI credential is used.", async function () { const baseUri = baseUrl(); const client = new ServiceClient({ baseUri: baseUri }); const pipelineRequest = createPipelineRequest({ diff --git a/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts b/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts index 4189a7ac5de7..4f986c90cdd9 100644 --- a/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts +++ b/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts @@ -5,35 +5,25 @@ import { describe, it, assert } from "vitest"; import { createDefaultHttpClient, createPipelineRequest } from "@azure/core-rest-pipeline"; describe("AzureVM UserAssigned Integration test", function () { - it.skipIf(!isLiveMode())("live IMDS test", async function () { + // TODO: VM is consistently unreachable — investigate networking/container health + it.skip("live IMDS test", async function () { const identityVMIP = process.env.IDENTITY_VM_PUBLIC_IP; if (!identityVMIP) { throw new Error("IDENTITY_VM_PUBLIC_IP is not set"); } - console.log(`Connecting to VM at ${identityVMIP}...`); const client = createDefaultHttpClient(); const request = createPipelineRequest({ url: `http://${identityVMIP}`, method: "GET", - timeout: 30000, }); request.allowInsecureConnection = true; - try { - const response = await client.sendRequest(request); - console.log(`Response status: ${response.status}`); - console.log(`Response body: ${response.bodyAsText}`); + const response = await client.sendRequest(request); - assert.strictEqual( - response.status, - 200, - `Expected status code 200, got ${response.status}. Response body: ${response.bodyAsText}`, - ); - } catch (e: any) { - console.error(`Request to VM failed: ${e.message}`); - console.error(`Error code: ${e.code}`); - console.error(`Target URL: http://${identityVMIP}`); - throw e; - } + assert.strictEqual( + response.status, + 200, + `Expected status code 200, got ${response.status}. Response body: ${response.bodyAsText}`, + ); }); }); diff --git a/sdk/identity/test-resources-post.ps1 b/sdk/identity/test-resources-post.ps1 index 5b35158c4ac3..75185df19cb8 100644 --- a/sdk/identity/test-resources-post.ps1 +++ b/sdk/identity/test-resources-post.ps1 @@ -61,17 +61,18 @@ if ($CI) { } # Azure Functions app deployment -# TODO: Skip Azure Functions deployment for timeout error -# Write-Host "Building the code for functions app" -# Push-Location "$webappRoot/AzureFunctions/RunTest" -# npm install -# npm run build -# Pop-Location -# Write-Host "starting azure functions deployment" -# Compress-Archive -Path "$workingFolder/AzureFunctions/RunTest/*" -DestinationPath "$workingFolder/AzureFunctions/app.zip" -Force -# az functionapp deployment source config-zip -g $identityResourceGroup -n $DeploymentOutputs['IDENTITY_FUNCTION_NAME'] --src "$workingFolder/AzureFunctions/app.zip" -# Remove-Item -Force "$workingFolder/AzureFunctions/app.zip" -# Write-Host "Deployed function app" +Write-Host "##[group]Deploying Azure Functions App" +Write-Host "Building the code for functions app" +Push-Location "$webappRoot/AzureFunctions/RunTest" +npm install +npm run build +Pop-Location +Write-Host "starting azure functions deployment" +Compress-Archive -Path "$workingFolder/AzureFunctions/RunTest/*" -DestinationPath "$workingFolder/AzureFunctions/app.zip" -Force +az functionapp deployment source config-zip -g $identityResourceGroup -n $DeploymentOutputs['IDENTITY_FUNCTION_NAME'] --src "$workingFolder/AzureFunctions/app.zip" +Remove-Item -Force "$workingFolder/AzureFunctions/app.zip" +Write-Host "Deployed function app" +Write-Host "##[endgroup]" Write-Host "##[group]Deploying Identity Web App" Push-Location "$webappRoot/AzureWebApps" From 0aade01b3875e47c28e1d2e999bbd61bf03a0462 Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Thu, 16 Jul 2026 11:57:47 -0700 Subject: [PATCH 8/9] fix Azure Functions config: add linuxFxVersion, remove Docker image The function app had DOCKER_CUSTOM_IMAGE_NAME set which conflicts with zip code deployment. Replace with linuxFxVersion: Node|22 so Azure detects the runtime correctly for zip deploy. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- sdk/identity/test-resources-managed-identity.bicep | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/sdk/identity/test-resources-managed-identity.bicep b/sdk/identity/test-resources-managed-identity.bicep index e0e97323b641..579ffdf5328e 100644 --- a/sdk/identity/test-resources-managed-identity.bicep +++ b/sdk/identity/test-resources-managed-identity.bicep @@ -223,6 +223,7 @@ resource azureFunction 'Microsoft.Web/sites@2022-09-01' = { alwaysOn: true http20Enabled: true minTlsVersion: '1.2' + linuxFxVersion: 'Node|22' appSettings: [ { name: 'IDENTITY_STORAGE_NAME_1' @@ -256,10 +257,6 @@ resource azureFunction 'Microsoft.Web/sites@2022-09-01' = { name: 'FUNCTIONS_WORKER_RUNTIME' value: 'node' } - { - name: 'DOCKER_CUSTOM_IMAGE_NAME' - value: 'mcr.microsoft.com/azure-functions/node:4-node24-appservice' - } ] } } From 3dba72bc68b81ef31ccbeb67811cd052bfa35f26 Mon Sep 17 00:00:00 2001 From: Minh-Anh Phan Date: Thu, 16 Jul 2026 13:31:32 -0700 Subject: [PATCH 9/9] unskip VM user-assigned integration test Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4150651a-1fa3-4772-8ed5-3389e7b978ab --- .../identity/test/integration/azureVMUserAssignedTest.spec.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts b/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts index 4f986c90cdd9..b8ab6ed06d29 100644 --- a/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts +++ b/sdk/identity/identity/test/integration/azureVMUserAssignedTest.spec.ts @@ -5,8 +5,7 @@ import { describe, it, assert } from "vitest"; import { createDefaultHttpClient, createPipelineRequest } from "@azure/core-rest-pipeline"; describe("AzureVM UserAssigned Integration test", function () { - // TODO: VM is consistently unreachable — investigate networking/container health - it.skip("live IMDS test", async function () { + it.skipIf(!isLiveMode())("live IMDS test", async function () { const identityVMIP = process.env.IDENTITY_VM_PUBLIC_IP; if (!identityVMIP) { throw new Error("IDENTITY_VM_PUBLIC_IP is not set");