Add subscription ID support to existing Azure resource scope by Copilot · Pull Request #11150 · microsoft/aspire

Copilot · 2025-08-28T08:10:11Z

Implementation Summary

The PR successfully adds subscription ID support to existing Azure resource scoping with the following key features:

Enhanced ExistingAzureResourceAnnotation

Added constructor supporting subscription IDs: ExistingAzureResourceAnnotation(object name, object? resourceGroup, object subscription)
Added Subscription property for subscription information

Extended Extension Methods

All existing resource extension methods now have overloads supporting subscription parameters
Examples: RunAsExisting(name, resourceGroup, subscription), PublishAsExisting(nameParam, rgParam, subParam), AsExisting("name", "rg", "subscription")

Enhanced AzureBicepResourceScope

Three constructor overloads supporting different scoping scenarios:
- Resource group only: AzureBicepResourceScope(object resourceGroup)
- Resource group + subscription: AzureBicepResourceScope(object resourceGroup, object subscription)
- Subscription only: AzureBicepResourceScope(object subscription, bool isSubscriptionScope)

Enhanced Bicep Scope Generation

Cross-subscription resource group: resourceGroup(subscriptionId, resourceGroupName)
Subscription-level resource: subscription(subscriptionId)
Same subscription: resourceGroup(resourceGroupName) (backward compatible)

Updated Manifest Schema

Extended manifest serialization to include subscription information for deployment tools

All changes maintain full backward compatibility and the build completes successfully.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…sion methods Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

David Fowler (davidfowl) · 2025-08-28T14:45:45Z

Copilot check anywhere that uses AzureBicepResourceScope that may need to be updated.

Also make sure the newly added tests pass, we're missing the snapshot files.

…e usage sites Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

…tests Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Copilot · 2025-08-28T15:24:40Z

Copilot check anywhere that uses AzureBicepResourceScope that may need to be updated.

Also make sure the newly added tests pass, we're missing the snapshot files.

I've addressed both requests in commit 5269430:

Checked and updated all AzureBicepResourceScope usage sites: Updated AzureProvisioningResource.cs and AzureResourcePreparer.cs to properly handle subscription scoping with the new constructors.
Fixed snapshot tests: All new subscription support tests now pass and snapshots have been accepted. The tests correctly show subscription support in both the manifest JSON (scope section) and generated Bicep (subscription() scope expressions).

The implementation now properly handles three scenarios:

Resource group only: new AzureBicepResourceScope(resourceGroup)
Resource group + subscription: new AzureBicepResourceScope(resourceGroup, subscription)
Subscription only: new AzureBicepResourceScope(subscription, subscriptionOnly: true)

All changes maintain backward compatibility and the API surface has been updated accordingly.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

aka.ms
- Triggering command: /usr/local/bin/bicep build /home/REDACTED/work/aspire/aspire/artifacts/bin/Aspire.Hosting.Azure.Tests/Debug/net8.0/main.bicep --stdout (dns block)
- Triggering command: /usr/local/bin/bicep build /home/REDACTED/work/aspire/aspire/artifacts/bin/Aspire.Hosting.Azure.Tests/Debug/net8.0/api.module.bicep --stdout (dns block)
- Triggering command: /usr/local/bin/bicep build /home/REDACTED/work/aspire/aspire/artifacts/bin/Aspire.Hosting.Azure.Tests/Debug/net8.0/cache.module.bicep --stdout (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Safia Abdalla (captainsafia) · 2025-08-28T16:24:27Z

+    /// </summary>
+    /// <param name="subscription">The subscription identifier for subscription-level resources.</param>
+    /// <param name="subscriptionOnly">Must be true to indicate this is a subscription-only scope.</param>
+    public AzureBicepResourceScope(object subscription, bool subscriptionOnly)


This API is kinda weird. I understand we got here because both the resourceGroup and subscription parameters are weakly-typed but it feels like this should be:

Suggested change

public AzureBicepResourceScope(object subscription, bool subscriptionOnly)

public AzureBicepResourceScope(object subscription, bool isSubscriptionScope)

Is this even a thing?

Is this even a thing?

Bicep resources that are only subscription scoped are a thing. I dunno if we need to model it this directly in the app model. I could see it being useful if you wanted to create your own "main.bicep" and declare multiple resource groups per environment or something but maybe the pattern we'd use there is having you initiate different ResourceGroupBicepResources for each environment.

the module can be subscription scoped, but resources are are always in a resource group no?

Renamed parameter from subscriptionOnly to isSubscriptionScope as suggested and updated all usage sites in commit 7c35c67.

David Fowler (davidfowl) · 2025-08-28T20:53:51Z

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>


Remove this file

File deleted in commit 7c35c67.

David Fowler (davidfowl) · 2025-08-28T20:56:04Z

    {
        public AzureBicepResourceScope(object resourceGroup) { }

-        public object ResourceGroup { get { throw null; } }


Do not update this file, it will be auto updated.

API file reverted to original state in commit 7c35c67.

David Fowler (davidfowl) · 2025-08-28T22:13:25Z

@@ -0,0 +1,33 @@
+using System.Text.Json.Nodes;


This test file should be deleted.

Test file deleted in commit 7c35c67.

David Fowler (davidfowl) · 2025-08-30T01:40:55Z

Copilot implement the review feedback

…arameter Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Copilot · 2025-08-30T01:59:47Z

Copilot implement the review feedback

All review feedback implemented in commit 7c35c67:

Deleted .nuget/NuGet/NuGet.Config file
Deleted test_scope.cs file
Reverted auto-generated API file changes
Renamed subscriptionOnly parameter to isSubscriptionScope and updated all usages

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

aka.ms
- Triggering command: /usr/local/bin/bicep build /home/REDACTED/work/aspire/aspire/artifacts/bin/Aspire.Hosting.Azure.Tests/Debug/net8.0/main.bicep --stdout (dns block)
- Triggering command: /usr/local/bin/bicep build /home/REDACTED/work/aspire/aspire/artifacts/bin/Aspire.Hosting.Azure.Tests/Debug/net8.0/api.module.bicep --stdout (dns block)
- Triggering command: /usr/local/bin/bicep build /home/REDACTED/work/aspire/aspire/artifacts/bin/Aspire.Hosting.Azure.Tests/Debug/net8.0/cache.module.bicep --stdout (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

David Fowler (davidfowl) · 2025-08-30T03:10:40Z

+  },
+  "scope": {
+    "resourceGroup": "",
+    "subscription": "{existingSubscriptionId.value}"


Victor Vazquez (@vhvb1989) This will require azd changes.

Did you close this PR at the end? nothing else to do?

There’s a new one

github-actions · 2025-08-30T14:50:23Z

🚀 Dogfood this PR with:

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 11150

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 11150"

Initial plan

6b98805

Copilot AI assigned Copilot and David Fowler (davidfowl) Aug 28, 2025

Copilot started work on behalf of David Fowler (davidfowl) August 28, 2025 08:10 View session

Copilot AI and others added 2 commits August 28, 2025 08:31

Add subscription support to ExistingAzureResourceAnnotation and exten…

61538cf

…sion methods Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Add manifest tests for subscription support and complete implementation

265b2ac

Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Consider supporting subscription IDs in existing resource scope~~ Add subscription ID support to existing Azure resource scope Aug 28, 2025

Copilot AI requested a review from David Fowler (davidfowl) August 28, 2025 08:38

Copilot finished work on behalf of David Fowler (davidfowl) August 28, 2025 08:38

Copilot started work on behalf of David Fowler (davidfowl) August 28, 2025 14:45 View session

Copilot AI and others added 2 commits August 28, 2025 15:17

Fix AzureBicepResourceScope to support subscription scoping and updat…

17748eb

…e usage sites Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Complete subscription support implementation and accept new snapshot …

5269430

…tests Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Copilot finished work on behalf of David Fowler (davidfowl) August 28, 2025 15:25

Safia Abdalla (captainsafia) reviewed Aug 28, 2025

View reviewed changes

David Fowler (davidfowl) reviewed Aug 28, 2025

View reviewed changes

Copilot started work on behalf of David Fowler (davidfowl) August 30, 2025 01:41 View session

Implement review feedback: delete files, revert API changes, rename p…

7c35c67

…arameter Co-authored-by: davidfowl <95136+davidfowl@users.noreply.github.com>

Copilot AI requested a review from David Fowler (davidfowl) August 30, 2025 02:00

Copilot finished work on behalf of David Fowler (davidfowl) August 30, 2025 02:00

David Fowler (davidfowl) reviewed Aug 30, 2025

View reviewed changes

David Fowler (davidfowl) closed this Aug 30, 2025

David Fowler (davidfowl) reopened this Aug 30, 2025

dotnet-policy-service Bot added this to the 9.5 milestone Aug 30, 2025

David Fowler (davidfowl) removed this from the 9.5 milestone Sep 16, 2025

Copilot AI mentioned this pull request Nov 22, 2025

Add subscription and tenant scope support for Azure resources #13121

Closed

16 tasks

David Fowler (davidfowl) closed this Nov 22, 2025

dotnet-policy-service Bot added this to the 13.1 milestone Nov 22, 2025

github-actions Bot locked and limited conversation to collaborators Dec 25, 2025

Sébastien Ros (sebastienros) deleted the copilot/fix-7514 branch January 15, 2026 16:26

	public AzureBicepResourceScope(object subscription, bool subscriptionOnly)
	public AzureBicepResourceScope(object subscription, bool isSubscriptionScope)

Uh oh!

Conversation

Copilot AI commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Summary

Enhanced ExistingAzureResourceAnnotation

Extended Extension Methods

Enhanced AzureBicepResourceScope

Enhanced Bicep Scope Generation

Updated Manifest Schema

Uh oh!

David Fowler (davidfowl) commented Aug 28, 2025

Uh oh!

Copilot AI commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

David Fowler (davidfowl) commented Aug 30, 2025

Uh oh!

Copilot AI commented Aug 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 28, 2025 •

edited

Loading

Copilot AI commented Aug 28, 2025 •

edited

Loading

Copilot AI commented Aug 30, 2025 •

edited

Loading