feature: Feature/azure compute/enablemachinemanagement by rakal-dyh · Pull Request #2069 · microsoft/GitHub-Copilot-for-Azure

rakal-dyh · 2026-04-27T22:17:07Z

Description

Checklist

Tests pass locally (cd tests && npm test)
If modifying skill descriptions: verified routing correctness with integration tests (npm run test:skills:integration -- <skill>)
If modifying skill USE FOR / DO NOT USE FOR / PREFER OVER clauses: confirmed no routing regressions for competing skills
Version bumped in skill frontmatter (if skill files changed)

Related Issues

- Add 'Should Trigger - Essential Machine Management' section with 7 EMM prompts - Add 'Essential Machine Management Workflow' unit tests (sections, routing, API, errors) - Add 'EMM Reference Files' unit tests (all 4 refs exist, content assertions) - Update router test to verify EMM description keywords and routing - Add 2 EMM integration test cases (enable flow, enrollment status) - Update snapshot with new EMM keywords Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…r-Azure into feature/azure-compute/enablemachinemanagement

rakal-dyh · 2026-04-27T22:28:14Z

verify the integration test now

tmeschter · 2026-04-27T22:53:55Z

Update the PR title to start with "feature:" to have this automatically included in the CHANGELOG.md.

jongio

Two things to address in this EMM sub-workflow addition:

1. Contradictory "Portal-only" statement (emm-overview.md, Key Characteristics section)

The overview states:

Portal-only during preview: No CLI/API-only enrollment flow is officially supported yet

But emm-enable-flow.md documents a complete 8-step Copilot-guided flow using REST API calls (PUT to Microsoft.ManagedOps/managedOps/default). If the agent reads the overview first, it'll tell users EMM is portal-only and skip the API flow - which is the whole point of this skill.

Suggestion: rephrase to clarify that the REST API exists and the Copilot-guided flow uses it, even if Microsoft's official docs focus on the portal experience.

2. Offboard instructions split with different approaches

essential-machine-management.md says offboard via portal UI (navigate, select, click Offboard). emm-enable-flow.md documents a DELETE API call for the same action. The parent workflow's routing doesn't point to the API-based offboard path. Consider consolidating - either add the API path to the parent routing tree, or remove the duplicate from the enable-flow reference.

jongio · 2026-04-27T23:28:33Z

+- **Subscription-level scope:** Enables for all VMs in a subscription at once
+- **No VM exclusion:** Currently no ability to exclude individual VMs
+- **Existing services preserved:** If a VM already has Update Manager with a maintenance schedule, it keeps that schedule
+- **Portal-only during preview:** No CLI/API-only enrollment flow is officially supported yet


This contradicts emm-enable-flow.md which documents a full REST API enrollment flow. The agent might read this first and tell users EMM is portal-only, refusing to guide them through the Copilot flow.

Consider rephrasing to something like: "Official docs focus on the portal experience, but a REST API (Microsoft.ManagedOps) is available and used by the Copilot-guided flow."

for 1, update based on the suggestion, saying 'a REST API (Microsoft.ManagedOps) is available and used by the Copilot-guided flow'

for 2, update the essential-machine-management.md, saying unless customer explicitly mention portal, the emm-enable-flow-portal-guidance.md (renamed from emm-enable-flow-portal.md) will be used. Otherwise in other place no portal related info is mentioned

…lability The 'portal-only' statement contradicted emm-enable-flow.md which documents a full Copilot-guided REST API enrollment flow via Microsoft.ManagedOps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Remove 'Via Portal' sub-section from Browse (keep Copilot-guided API approach) - Point Offboard to emm-enable-flow.md#disable-emm-offboard instead of portal steps - Keep portal routing entry for users who explicitly mention portal Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update all references in SKILL.md, essential-machine-management.md, and unit tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The #disable-emm-offboard anchor doesn't work when the agent reads files. Reference the file directly and mention the section name in text. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

jongio

Addresses my previous feedback - the "portal-only" contradiction is fixed and offboard instructions are consolidated. Clean changes.

Two new issues in the latest commits:

integration.test.ts: The describe block was renamed from "skill-invocation" to "11skill-invocation11". This looks like accidental debug characters left in. It'll affect test output/filtering.
.playwright-mcp/page-2026-04-20T21-13-59-247Z.yml was committed - looks like an accidental Playwright MCP artifact. Should be removed and probably added to .gitignore.

jongio · 2026-04-28T14:48:27Z

  }

-  describe("skill-invocation", () => {
+  describe("11skill-invocation11", () => {


This renames the test suite from "skill-invocation" to "11skill-invocation11" - looks like accidental debug characters. Should be reverted to "skill-invocation".

revert the change

jongio · 2026-04-28T14:48:43Z

.playwright-mcp/page-2026-04-20T21-13-59-247Z.yml was committed - looks like an accidental Playwright MCP artifact. Should be removed and .playwright-mcp/ added to .gitignore.

rakal-dyh · 2026-04-28T22:34:12Z

adress the latest comment, remove the mistakenly committed file

jongio

Addresses my previous feedback. Both items fixed:

"11skill-invocation11" reverted to "skill-invocation"
.playwright-mcp/ artifact removed

No new issues found in the incremental diff. All CI green.

…r-Azure into feature/azure-compute/enablemachinemanagement

Copilot

Pull request overview

Adds Essential Machine Management (EMM) coverage to the azure-compute skill by introducing a new EMM workflow + reference docs and extending unit/trigger/integration tests to validate routing and keyword matching.

Changes:

Added an EMM workflow (essential-machine-management.md) with routing, browse/offboard guidance, and error handling.
Added EMM reference docs (overview, prerequisites, enable flow, portal enable flow).
Updated azure-compute skill metadata/routing and extended tests + snapshots to cover EMM prompts and routing.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/azure-compute/unit.test.ts	Adds unit assertions for EMM description keywords, routing link presence, and validates new workflow/reference file content.
tests/azure-compute/triggers.test.ts	Adds trigger prompts ensuring EMM queries trigger the `azure-compute` skill.
tests/azure-compute/integration.test.ts	Adds integration prompts to verify EMM queries route to the new workflow at/above the invocation threshold.
tests/azure-compute/snapshots/triggers.test.ts.snap	Updates snapshot to include EMM in description and extracted keywords.
plugin/skills/azure-compute/workflows/essential-machine-management/essential-machine-management.md	New workflow router for EMM intents (enable/portal/overview/prereqs/browse/offboard/troubleshoot).
plugin/skills/azure-compute/workflows/essential-machine-management/references/emm-enable-flow.md	New Copilot-guided enablement flow and API/CLI guidance for enrolling/offboarding EMM.
plugin/skills/azure-compute/workflows/essential-machine-management/references/emm-enable-flow-portal-guidance.md	New portal-specific enablement walkthrough for users explicitly requesting portal steps.
plugin/skills/azure-compute/workflows/essential-machine-management/references/emm-overview.md	New EMM feature/tier/pricing overview reference.
plugin/skills/azure-compute/workflows/essential-machine-management/references/emm-prerequisites.md	New prerequisites (resources, roles, RPs) reference.
plugin/skills/azure-compute/SKILL.md	Extends skill description + routing to include EMM and link to the new workflow and references.

Copilot · 2026-04-30T05:12:38Z

+- **Workspaces** — Log Analytics and Azure Monitor workspace resource IDs
+- **Created by / date** — who enrolled and when (in `systemData`)
+
+To scan multiple subscriptions, use `azure-subscription_list` to list available subscriptions, then query each one. Report results as a table:


azure-subscription_list here doesn’t match the repo’s established Azure MCP tool naming pattern (e.g., mcp_azure_mcp_subscription_list). Please update to the correct tool name for consistency and to keep the workflow executable.

Suggested change

To scan multiple subscriptions, use `azure-subscription_list` to list available subscriptions, then query each one. Report results as a table:

To scan multiple subscriptions, use `mcp_azure_mcp_subscription_list` to list available subscriptions, then query each one. Report results as a table:

Copilot · 2026-04-30T05:12:39Z

+
+| MCP Tool | Purpose |
+| -------- | ------- |
+| `azure-subscription_list` | List available subscriptions |


The MCP tool name azure-subscription_list doesn’t match the repo’s established Azure MCP naming pattern (e.g., mcp_azure_mcp_subscription_list used in other skills like plugin/skills/azure-deploy/SKILL.md). Please align this to the correct Azure MCP tool name so agents can actually invoke it.

Suggested change

| `azure-subscription_list` | List available subscriptions |

| `mcp_azure_mcp_subscription_list` | List available subscriptions |

Copilot · 2026-04-30T05:12:39Z

+| Log Analytics workspace | `azure-monitor` | List existing workspaces or create new |
+| Azure Monitor workspace | `azure-monitor` | List existing workspaces or create new |
+


azure-monitor is referenced here as an MCP tool, but this tool name doesn’t appear elsewhere in the repo’s Azure MCP usage (which generally uses mcp_azure_mcp_<service> tools or explicit CLI generation). Please update this to the correct Azure MCP tool(s) for listing/creating Log Analytics + Azure Monitor workspaces (or document the CLI fallback) to avoid non-runnable guidance.

Suggested change

| Log Analytics workspace | `azure-monitor` | List existing workspaces or create new |

| Azure Monitor workspace | `azure-monitor` | List existing workspaces or create new |

| Log Analytics workspace | `N/A - use Azure CLI fallback` | List with `az monitor log-analytics workspace list` or create with `az monitor log-analytics workspace create` |

| Azure Monitor workspace | `N/A - use Azure CLI fallback` | List with `az monitor account list` or create with `az monitor account create` |

> 💡 **Tip:** Do not invoke `azure-monitor` as an MCP tool here unless a verified repo-supported Azure MCP command is available. For this workflow, prefer Azure CLI generation/execution for workspace discovery and creation.

update and remove the mcp and using cli now

Copilot · 2026-04-30T05:12:39Z

+GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=assignedTo('{objectId}')
+```
+
+> 💡 **Tip:** The `assignedTo` filter scopes results to the current user's assignments — this works even without `Microsoft.Authorization/roleAssignments/read` permission at subscription level.


There’s an internal inconsistency about role-assignment read permissions: the Tip says the assignedTo filter works even without Microsoft.Authorization/roleAssignments/read, but the Error Handling table says a 403 can occur because the user can’t read role assignments. Please reconcile these statements (either adjust the tip, or clarify exactly when 403 can still happen).

Suggested change

> 💡 **Tip:** The `assignedTo` filter scopes results to the current user's assignments — this works even without `Microsoft.Authorization/roleAssignments/read` permission at subscription level.

> 💡 **Tip:** The `assignedTo` filter scopes results to the current user's assignments and may work in cases where the caller does not have broad permission to list all role assignments. However, it does **not** guarantee access: a `403 Forbidden` can still occur if the caller is not allowed to read role assignments at the requested scope, or if the API enforces `Microsoft.Authorization/roleAssignments/read` for that request.

update the error handling

jongio

Latest commits address the Copilot bot findings:

MCP tool names fixed to mcp_azure_mcp_subscription_list (both router and enable-flow)
azure-monitor MCP tool refs replaced with explicit CLI commands for Log Analytics and Azure Monitor workspaces
Role check tip and 403 error handling now consistent - both correctly explain that assignedTo is self-scoped but requires at least one role on the subscription

All prior review items resolved. CI green. No new issues.

…r-Azure into feature/azure-compute/enablemachinemanagement

Yinghui Dong and others added 3 commits April 21, 2026 13:57

emm subskill

e1ee149

Merge branch 'main' of https://github.com/microsoft/GitHub-Copilot-fo…

8e1d90e

…r-Azure into feature/azure-compute/enablemachinemanagement

rakal-dyh requested review from alex-thompson, jongio and joybb as code owners April 27, 2026 22:17

update

d07b990

tmeschter previously approved these changes Apr 27, 2026

View reviewed changes

rakal-dyh changed the title ~~Feature/azure compute/enablemachinemanagement~~ feature: Feature/azure compute/enablemachinemanagement Apr 27, 2026

jongio reviewed Apr 27, 2026

View reviewed changes

Yinghui Dong and others added 3 commits April 27, 2026 17:07

rename: emm-enable-flow-portal.md → emm-enable-flow-portal-guidance.md

526977d

Update all references in SKILL.md, essential-machine-management.md, and unit tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rakal-dyh dismissed tmeschter’s stale review via 526977d April 28, 2026 00:23

fix(azure-compute): remove invalid anchor from offboard reference

4e2e759

The #disable-emm-offboard anchor doesn't work when the agent reads files. Reference the file directly and mention the section name in text. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

jongio reviewed Apr 28, 2026

View reviewed changes

Yinghui Dong added 2 commits April 28, 2026 15:30

remove unrelated change

95e9e93

revert local change

90591a3

jongio reviewed Apr 28, 2026

View reviewed changes

Merge branch 'main' of https://github.com/microsoft/GitHub-Copilot-fo…

7a07d7e

…r-Azure into feature/azure-compute/enablemachinemanagement

Copilot AI review requested due to automatic review settings April 30, 2026 05:08

Copilot started reviewing on behalf of rakal-dyh April 30, 2026 05:08 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

Yinghui Dong added 3 commits April 29, 2026 22:21

update emm mcp tool name mapping

1fa2c64

update mcp to clo guide

5f57873

update error handling for user role check

d719a0b

update tips for user roll query

82a7dba

jongio reviewed Apr 30, 2026

View reviewed changes

Merge branch 'main' of https://github.com/microsoft/GitHub-Copilot-fo…

40db451

…r-Azure into feature/azure-compute/enablemachinemanagement

	To scan multiple subscriptions, use `azure-subscription_list` to list available subscriptions, then query each one. Report results as a table:
	To scan multiple subscriptions, use `mcp_azure_mcp_subscription_list` to list available subscriptions, then query each one. Report results as a table:

	\| `azure-subscription_list` \| List available subscriptions \|
	\| `mcp_azure_mcp_subscription_list` \| List available subscriptions \|

		\| Log Analytics workspace \| `azure-monitor` \| List existing workspaces or create new \|
		\| Azure Monitor workspace \| `azure-monitor` \| List existing workspaces or create new \|

-| Log Analytics workspace | `azure-monitor` | List existing workspaces or create new |
-| Azure Monitor workspace | `azure-monitor` | List existing workspaces or create new |
+| Log Analytics workspace | `N/A - use Azure CLI fallback` | List with `az monitor log-analytics workspace list` or create with `az monitor log-analytics workspace create` |
+| Azure Monitor workspace | `N/A - use Azure CLI fallback` | List with `az monitor account list` or create with `az monitor account create` |
+> 💡 **Tip:** Do not invoke `azure-monitor` as an MCP tool here unless a verified repo-supported Azure MCP command is available. For this workflow, prefer Azure CLI generation/execution for workspace discovery and creation.

Conversation

rakal-dyh commented Apr 27, 2026

Description

Checklist

Related Issues

Uh oh!

rakal-dyh commented Apr 27, 2026

Uh oh!

tmeschter commented Apr 27, 2026

Uh oh!

jongio left a comment

Choose a reason for hiding this comment

Uh oh!

jongio Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

rakal-dyh Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jongio left a comment

Choose a reason for hiding this comment

Uh oh!

jongio Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

rakal-dyh Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

jongio commented Apr 28, 2026

Uh oh!

rakal-dyh commented Apr 28, 2026

Uh oh!

jongio left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

rakal-dyh Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

rakal-dyh Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

rakal-dyh Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

rakal-dyh Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

jongio left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rakal-dyh Apr 28, 2026 •

edited

Loading