feat(azurebackup): add vault private-endpoint command group by shrja-ms · Pull Request #3345 · microsoft/mcp

Shraddha Jain (shrja-ms) · 2026-08-21T14:25:34Z

Description

Adds a new azurebackup vault private-endpoint command group for managing Private Endpoints (v2 experience) on Recovery Services vaults (RSV):

Command	Purpose
`azmcp azurebackup vault private-endpoint create`	Provisions the `Microsoft.Network/privateEndpoints` resource in a customer VNet subnet and optionally auto-approves the resulting Private Endpoint Connection (PEC) on the RSV.
`azmcp azurebackup vault private-endpoint get`	Returns one or all PECs attached to a Recovery Services vault.
`azmcp azurebackup vault private-endpoint approve`	Approves a pending PEC on the vault. Idempotent — already-Approved connections return their current state.
`azmcp azurebackup vault private-endpoint reject`	Rejects a pending PEC on the vault. Idempotent — already-Rejected connections return their current state.
`azmcp azurebackup vault private-endpoint delete`	Removes the vault-side PEC object. The underlying `Microsoft.Network/privateEndpoints` resource must be deleted separately.

All commands accept --vault-type rsv|dpp. Backup vaults (DPP) are not supported and return a NotSupportedException with clear guidance directing the caller to RSV.

create enforces the well-known RSV constraints:

--group-id must be AzureBackup (primary region) or AzureBackup_secondary (paired region / Cross-Region Restore).
The RSV must have no protected items.
RSV supports at most 12 Private Endpoints per vault.

Files changed

tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Vault/PrivateEndpoint/* — 5 new commands.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Vault/PrivateEndpoint/* — flat POCO option classes with [Option] attributes.
tools/Azure.Mcp.Tools.AzureBackup/src/Models/PrivateEndpointConnectionInfo.cs — response model.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/RsvBackupOperations.PrivateEndpoint.cs — partial class implementing the PE operations against the RSV data plane.
tools/Azure.Mcp.Tools.AzureBackup/src/AzureBackupSetup.cs, AzureBackupJsonContext.cs, IAzureBackupService.cs, AzureBackupService.cs, IRsvBackupOperations.cs, RsvBackupOperations.cs, AzureBackupOptionDefinitions.cs, AzureBackupTelemetryTags.cs — command registration, JSON serialization context, and service wiring.
servers/Azure.Mcp.Server/docs/azmcp-commands.md, e2eTestPrompts.md, Resources/consolidated-tools.json — documentation and tool registry.
servers/Azure.Mcp.Server/changelog-entries/shrja-azurebackup-vault-private-endpoint.yml — changelog entry.

Tests

Unit tests for all 5 commands under tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/Vault/PrivateEndpoint/.
Recorded live tests in AzureBackupPrivateEndpointCommandTests.cs using RecordedCommandTestsBase:
- PrivateEndpointGet_EmptyVault_ReturnsEmptyList — recorded.
- PrivateEndpointGet_OnDppVault_ReturnsNotSupported — recorded (verifies the DPP guard).
- PrivateEndpointLifecycle_Create_Approve_Get_Delete — [LiveTestOnly] (network resource lifecycle; not recorded).
Bicep test infrastructure — tests/test-resources.bicep now provisions an RSV, VNet, and subnet dedicated to Private Endpoint scenarios (with matching RBAC).

Full suite (773 tests) passes locally in Playback:

Test run summary: Passed!
  total: 781
  failed: 0
  succeeded: 773
  skipped: 8

ToolDescriptionEvaluator scores

All 5 new tool descriptions were evaluated with 3 representative prompts each. Every prompt matched at rank #1–#3 with confidence ≥ 0.4 (target for this repo).

Tool	Rank #1	Rank #2–#3	Min score
`azurebackup_vault_private-endpoint_create`	3 / 3	0	0.60
`azurebackup_vault_private-endpoint_get`	2 / 3	1 (#3)	0.52
`azurebackup_vault_private-endpoint_approve`	2 / 3	1	≥ 0.4
`azurebackup_vault_private-endpoint_reject`	2 / 3	1	≥ 0.4
`azurebackup_vault_private-endpoint_delete`	3 / 3	0	0.55

Checklist

dotnet build — clean, 0 errors, 0 warnings on the AzureBackup toolset.
dotnet test — full AzureBackup test project passes in Playback (773 succeeded, 8 [LiveTestOnly] skipped).
Recorded live tests pushed via test-proxy push — assets.json tag updated.
Invoke-Cspell.ps1 — clean (exit 0).
Documentation updated (azmcp-commands.md, e2eTestPrompts.md, consolidated-tools.json).
Changelog entry added under servers/Azure.Mcp.Server/changelog-entries/.
ToolDescriptionEvaluator ≥ 0.4 for all new tools.

Invoking Livetests

Copilot submitted PRs are not trustworthy by default. Users with write access to the repo need to validate the contents of this PR before leaving a comment with the text /azp run mcp - pullrequest - live. This will trigger the necessary livetest workflows to complete required validation.

Adds 5 new commands under 'azmcp azurebackup vault private-endpoint': - create: provisions Microsoft.Network/privateEndpoints resource in a customer VNet subnet and optionally auto-approves the connection on the RSV. - get: retrieves one or all Private Endpoint Connections (PECs) attached to a Recovery Services vault. - approve/reject: manages the PEC state on the vault. - delete: removes the vault-side PEC object. All commands support --vault-type rsv|dpp. Backup vaults (DPP) return a NotSupportedException with clear guidance to use RSV. Includes: - Unit tests for all commands (Vault/PrivateEndpoint/*) - Recorded live tests (AzureBackupPrivateEndpointCommandTests) using the RecordedCommandTestsBase pattern - Bicep test infrastructure additions (RSV + VNet + subnet) for Private Endpoint scenarios - Documentation updates (azmcp-commands.md, e2eTestPrompts.md, consolidated-tools.json) - Changelog entry

azure-pipelines · 2026-08-21T14:25:53Z

Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

Adds a new AzureBackup vault private-endpoint command group to manage Recovery Services vault (RSV) Private Endpoint Connections (PECs), including create/get/delete/approve/reject, along with service-layer implementation, docs, and tests.

Changes:

Introduces 5 new azurebackup vault private-endpoint commands + options and response model.
Adds RSV private-endpoint operations in RsvBackupOperations and wires them through IAzureBackupService.
Expands test infrastructure + unit/recorded tests and updates docs/tool registry/changelog.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/Azure.Mcp.Tools.AzureBackup/tests/test-resources.bicep	Adds dedicated VNet/subnet + fresh RSV for PE test scenarios and RBAC.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/Vault/PrivateEndpoint/PrivateEndpointRejectCommandTests.cs	Unit tests for reject command behavior + error mappings.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/Vault/PrivateEndpoint/PrivateEndpointGetCommandTests.cs	Unit tests for get/list behavior + DPP guard/error mappings.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/Vault/PrivateEndpoint/PrivateEndpointDeleteCommandTests.cs	Unit tests for delete behavior + error mappings.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/Vault/PrivateEndpoint/PrivateEndpointCreateCommandTests.cs	Unit tests for create behavior + status/error mappings.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/Vault/PrivateEndpoint/PrivateEndpointApproveCommandTests.cs	Unit tests for approve behavior + error mappings.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/AzureBackupPrivateEndpointCommandTests.cs	Recorded/live PE tests validating tool behavior end-to-end.
tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.Tests/assets.json	Updates test-proxy assets tag for new recordings.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/RsvBackupOperations.PrivateEndpoint.cs	Implements RSV PE lifecycle operations (create/list/get/approve/reject/delete).
tools/Azure.Mcp.Tools.AzureBackup/src/Services/RsvBackupOperations.cs	Makes `RsvBackupOperations` partial to host new PE partial implementation.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/IRsvBackupOperations.cs	Adds PE operation contracts to RSV operations interface.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/IAzureBackupService.cs	Exposes PE operations on the toolset service boundary.
tools/Azure.Mcp.Tools.AzureBackup/src/Services/AzureBackupService.cs	Routes PE operations to RSV implementation and enforces DPP NotSupported behavior.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Vault/PrivateEndpoint/PrivateEndpointRejectOptions.cs	Options for reject operation.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Vault/PrivateEndpoint/PrivateEndpointGetOptions.cs	Options for get/list operation.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Vault/PrivateEndpoint/PrivateEndpointDeleteOptions.cs	Options for delete operation.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Vault/PrivateEndpoint/PrivateEndpointCreateOptions.cs	Options for create operation.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/Vault/PrivateEndpoint/PrivateEndpointApproveOptions.cs	Options for approve operation.
tools/Azure.Mcp.Tools.AzureBackup/src/Options/AzureBackupOptionDefinitions.cs	Adds option help text for PE options.
tools/Azure.Mcp.Tools.AzureBackup/src/Models/PrivateEndpointConnectionInfo.cs	Adds response model for PEC summary.
tools/Azure.Mcp.Tools.AzureBackup/src/Models/AzureBackupTelemetryTags.cs	Adds telemetry tag for PE action classification.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Vault/PrivateEndpoint/PrivateEndpointRejectCommand.cs	New reject command + error/status mappings.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Vault/PrivateEndpoint/PrivateEndpointGetCommand.cs	New get/list command + error/status mappings.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Vault/PrivateEndpoint/PrivateEndpointDeleteCommand.cs	New delete command + error/status mappings.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Vault/PrivateEndpoint/PrivateEndpointCreateCommand.cs	New create command + error/status mappings.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/Vault/PrivateEndpoint/PrivateEndpointApproveCommand.cs	New approve command + error/status mappings.
tools/Azure.Mcp.Tools.AzureBackup/src/Commands/AzureBackupJsonContext.cs	Registers new command result types/models for AOT-safe serialization.
tools/Azure.Mcp.Tools.AzureBackup/src/AzureBackupSetup.cs	Registers new commands and adds the new subgroup under `vault`.
tools/Azure.Mcp.Tools.AzureBackup/src/Azure.Mcp.Tools.AzureBackup.csproj	Adds `Azure.ResourceManager.Network` dependency for PE operations.
servers/Azure.Mcp.Server/src/Resources/consolidated-tools.json	Maps new tools into consolidated mode categories.
servers/Azure.Mcp.Server/docs/e2eTestPrompts.md	Adds e2e prompts for the 5 new tools.
servers/Azure.Mcp.Server/docs/azmcp-commands.md	Documents the new command group and usage examples.
servers/Azure.Mcp.Server/changelog-entries/shrja-azurebackup-vault-private-endpoint.yml	Adds changelog entry for the new feature.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…lag with consolidated tool groups PrivateEndpointCreateCommand belongs to create_azure_backup_resources (Destructive=true) and PrivateEndpointApproveCommand belongs to update_azure_backup_settings (Destructive=true). The mismatch caused ConsolidatedToolDiscoveryStrategy to throw InvalidOperationException at server startup in DEBUG builds, failing ConsolidatedModeTests on CI.

- Merge approve/reject commands into single approve-reject with --action param - Rename group 'private-endpoint' -> 'privateendpoint' (concatenated lowercase) - Use ResourceIdentifier for subnet + PE ID parsing (no manual regex) - Remove 12-endpoint per-vault cap - Full-ID (case-insensitive) match for PrivateEndpointConnection lookup - Auto-approve description = 'Auto-approved by Azure MCP tool' - Regenerate command metadata icons; update docs, e2e prompts, changelog

- Switch assets.json Tag to df01193e95 (from upstream/main via PR microsoft#3345) which contains recordings for the new AzureBackupPrivateEndpointCommandTests tests introduced after this PR's baseline. - Regenerate azmcp-commands.md metadata annotations for the resourceguard command group, enable-mua and disable-mua commands (out of sync after the resource-guard additions). - Fixes CI test failures: * AzureBackupPrivateEndpointCommandTests.PrivateEndpointGet_EmptyVault_ReturnsEmptyList * AzureBackupPrivateEndpointCommandTests.PrivateEndpointGet_OnDppVault_ReturnsNotSupported * CommandMetadataSyncTests.AzCommandsMetadata_Should_Be_Synchronized

…disable-mua) The prior tag df01193e95 (from upstream/main via PR microsoft#3345) had recordings for the new AzureBackupPrivateEndpointCommandTests but was missing recordings for this PR's SecurityDisableMua_RsvVault_Successfully and SecurityDisableMua_DppVault_Successfully. Combined both sets by extracting the 2 disable-mua recordings from tag e1d7bb1d4c and pushing the merged set as new tag fdd4f0baf5.

…3322) * Add azurebackup resourceguard group and fix MUA disable safety PR 3: New `azurebackup resourceguard` command group (create/get/delete) for Microsoft.DataProtection/resourceGuards, backing Multi-User Authorization. PR 6: Fix `security configure-mua` silently disabling MUA when --resource-guard-id was omitted. --resource-guard-id is now required. Added new `security disable-mua` command that requires --force to explicitly disable MUA. Added `mua.action` telemetry tag. * Address PR #3322 review comments - ResourceGuardGetCommand: telemetry tag value 'single' -> 'get' (comment 3811668346) - ResourceGuardCreateCommand: trim tag key/value and reject empty (comment 3811668398) - ResourceGuardCreateOptions: add disableSecurityFeatures to mandatory ops list in description (comment 3811668438) - azmcp-commands.md: resourceguard create marked Idempotent (comment 3811668460) - Added [Theory] test for empty tag key/value validation * Record security disable-mua tests (RSV + DPP) - Removed [LiveTestOnly] from SecurityDisableMua_RsvVault_Successfully and SecurityDisableMua_DppVault_Successfully now that they have live recordings. - Updated assets.json Tag to Azure.Mcp.Tools.AzureBackup.Tests_e1d7bb1d4c (added 2 new SessionRecords for the disable-mua tests). * Fix consolidated-mode metadata mismatches for AzureBackup commands SecurityConfigureMuaCommand: revert Destructive=true to match the update_azure_backup_settings consolidated group (linking a Resource Guard modifies vault settings). ResourceGuardCreateCommand: set Destructive=true, Idempotent=false to match the create_azure_backup_resources group (consistent with vault/policy/protecteditem create commands). Also update azmcp-commands.md metadata markers to stay in sync. Fixes the DEBUG-only InvalidOperationException in ConsolidatedToolDiscoveryStrategy that was crashing server startup and causing all 13 ConsolidatedModeTests to time out with 'Connection refused'. * Address PR review comments: rename configure-mua to enable-mua, drop --force gates, simplify status handling * fix(azurebackup): update recording tag + regen commands doc - Switch assets.json Tag to df01193e95 (from upstream/main via PR #3345) which contains recordings for the new AzureBackupPrivateEndpointCommandTests tests introduced after this PR's baseline. - Regenerate azmcp-commands.md metadata annotations for the resourceguard command group, enable-mua and disable-mua commands (out of sync after the resource-guard additions). - Fixes CI test failures: * AzureBackupPrivateEndpointCommandTests.PrivateEndpointGet_EmptyVault_ReturnsEmptyList * AzureBackupPrivateEndpointCommandTests.PrivateEndpointGet_OnDppVault_ReturnsNotSupported * CommandMetadataSyncTests.AzCommandsMetadata_Should_Be_Synchronized * fix(azurebackup): repoint recording tag to fdd4f0baf5 (combined PE + disable-mua) The prior tag df01193e95 (from upstream/main via PR #3345) had recordings for the new AzureBackupPrivateEndpointCommandTests but was missing recordings for this PR's SecurityDisableMua_RsvVault_Successfully and SecurityDisableMua_DppVault_Successfully. Combined both sets by extracting the 2 disable-mua recordings from tag e1d7bb1d4c and pushing the merged set as new tag fdd4f0baf5.

Copilot AI lite review requested due to automatic review settings August 21, 2026 14:25

Shraddha Jain (shrja-ms) requested a review from a team as a code owner August 21, 2026 14:25

Shraddha Jain (shrja-ms) requested review from JasonYeMSFT (JasonYeMSFT), Rick Winter (RickWinter), Alan Zimmer (alzimmermsft), Sai Koumudi Kaluvakolanu (saikoumudi), Sandeep Sen (sandeep-sen), Tom Meschter (tmeschter) and Jeff Fisher (xirzec) August 21, 2026 14:25

github-actions Bot added server-Azure.Mcp Azure.Mcp.Server tools-AzureBackup labels Aug 21, 2026

Copilot started reviewing on behalf of Shraddha Jain (shrja-ms) August 21, 2026 14:26 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Comment thread tools/Azure.Mcp.Tools.AzureBackup/src/Options/AzureBackupOptionDefinitions.cs Outdated

Comment thread tools/Azure.Mcp.Tools.AzureBackup/src/Services/RsvBackupOperations.PrivateEndpoint.cs Outdated

Comment thread tools/Azure.Mcp.Tools.AzureBackup/src/AzureBackupSetup.cs Outdated

Alan Zimmer (alzimmermsft) reviewed Aug 24, 2026

View reviewed changes

Shraddha Jain (shrja-ms) added 2 commits August 25, 2026 11:30

fix(azurebackup): add 'privateendpoint' to cspell dictionaries

405a38f

Shraddha Jain (shrja-ms) requested a review from Alan Zimmer (alzimmermsft) August 25, 2026 10:58

Alan Zimmer (alzimmermsft) approved these changes Aug 25, 2026

View reviewed changes

Shraddha Jain (shrja-ms) enabled auto-merge (squash) August 26, 2026 04:16

Shraddha Jain (shrja-ms) merged commit ea093a3 into microsoft:main Aug 26, 2026
18 of 19 checks passed

Navigation Menu

Uh oh!

feat(azurebackup): add vault private-endpoint command group - #3345

feat(azurebackup): add vault private-endpoint command group#3345
Shraddha Jain (shrja-ms) merged 4 commits into
microsoft:mainfrom
shrja-ms:user/azurebackup-vault-private-endpoint

Shraddha Jain (shrja-ms) commented Aug 21, 2026

Uh oh!

azure-pipelines Bot commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Shraddha Jain (shrja-ms) commented Aug 21, 2026

Description

Files changed

Tests

ToolDescriptionEvaluator scores

Checklist

Invoking Livetests

Uh oh!

azure-pipelines Bot commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants