Failed to create client secret error

[donnie-kerr]

a365 setup all fails to create client secret error due to Agent ID Developer not having permissions to create it in the App Reg.
What permissions are required to create the secret manually in the app registration for the blueprint?
Once created, how do I re-run the "setup all" to include the manual secret and complete the setup all process?

Also, I could not find and documentation on the right key to add the secret to the a365 config json. If the app reg has the client secret added manually, will it generate the correct config file to include it? If not, how do I add the secret manually?

This is show stopper for me right now to setup my agent in A365 so I would appreciate some help.

[github-actions]

[AUTO-TRIAGE] Team Assistant Triage

This issue has been automatically analyzed and triaged.

AI Decision Reasoning: Type: Classified as 'question' because the user is asking for clarification on required permissions, configuration steps, and documentation to resolve their issue.
Priority: Assigned P1 because the user explicitly states that this is a 'show stopper' preventing them from completing the setup process, which indicates a critical impact on their workflow. [Security issue detected: The issue discusses permissions required to create a client secret in an app registration, which relates to authentication and authorization. Misconfigured permissions or improper handling of client secrets could lead to security vulnerabilities, such as unauthorized access or exposure of sensitive information.]
Copilot: Security issues require human review and should not be auto-fixed
Assignment: Security issue assigned to security lead. The issue discusses permissions required to create a client secret in an app registration, which relates to authentication and authorization. Misconfigured permissions or improper handling of client secrets could lead to security vulnerabilities, such as unauthorized access or exposure of sensitive information.
Labels: Applied labels question, P1, security based on issue type and priority

Labels and assignee have been applied based on this analysis.

[github-actions]

[AUTO-TRIAGE] Results

Classification: question
Priority: P1
Confidence: 95.0%

Recommended Assignee: @pontemonti

Analysis:
type rationale: Classified as 'question' because the user is asking for clarification on required permissions, configuration steps, and documentation to resolve their issue.

priority rationale: Assigned P1 because the user explicitly states that this is a 'show stopper' preventing them from completing the setup process, which indicates a critical impact on their workflow. [Security issue detected: The issue discusses permissions required to create a client secret in an app registration, which relates to authentication and authorization. Misconfigured permissions or improper handling of client secrets could lead to security vulnerabilities, such as unauthorized access or exposure of sensitive information.]

copilot rationale: Security issues require human review and should not be auto-fixed

assignment rationale: Security issue assigned to security lead. The issue discusses permissions required to create a client secret in an app registration, which relates to authentication and authorization. Misconfigured permissions or improper handling of client secrets could lead to security vulnerabilities, such as unauthorized access or exposure of sensitive information.

labels rationale: Applied labels question, P1, security based on issue type and priority

[SUGGESTION] Suggested Approach

1. Verify the required permissions for the Agent ID Developer in Azure Active Directory. Ensure the account has 'Application Administrator' or 'Owner' permissions on the app registration. Update the documentation in docs/setup.md to include a detailed list of required permissions for creating client secrets.
2. Update the a365 setup all command to check for missing client secrets and provide a clear error message with instructions on how to manually add the secret. Modify the relevant logic in src/Services/SetupService.cs to include this validation and error handling.
3. Add a section to the documentation (docs/configuration.md) explaining how to manually add a client secret to the A365 configuration JSON file. Include an example JSON snippet and specify the correct key (e.g., clientSecret) for adding the secret manually.
4. Enhance the a365 setup all command to detect manually added client secrets in the app registration and automatically update the configuration file. Update the logic in src/Services/ConfigService.cs to include this functionality, ensuring it reads the secret from Azure and writes it to the config file.
5. Create integration tests in autoTriage/tests/integration to validate scenarios where the client secret is added manually. Include tests for both successful detection and configuration file updates to ensure the process works as expected.

---

Generated by TeamAssistant Auto-Triage powered by GitHub Models

[sellakumaran]

Hi @donnie-kerr , thanks for the detailed report. Here are answers to each of your questions.

Why did secret creation fail?

The CLI creates the blueprint app registration on your behalf and is also responsible for setting you as the owner of that app in the same step. If that owner-assignment step fails, the CLI retries silently — the blueprint is still created successfully, but without you as owner. The CLI then tries to add a client secret to the app it just created, and that call fails because the owner was never set.

Check your setup log to confirm this is what happened. Look for this specific warning:

Agent Blueprint creation with sponsors and owners failed (Bad Request). Retrying without sponsors/owners...

Log file location:

• Windows: %LocalAppData%\Microsoft.Agents.A365.DevTools.Cli\logs\a365.setup.log
• Linux/macOS: ~/.config/a365/logs/a365.setup.log

Or re-run with --verbose to surface it directly in the console:

a365 setup all --verbose

If that warning is in your log, the owner assignment failed during blueprint creation, which directly caused the secret step to fail. Please share the relevant log output when you reply — it will help us confirm and fix the root cause.

---

Q1: What permissions do I need to create the secret manually in Azure Portal?

To manually add a client secret to the blueprint app registration, you need one of these on the blueprint app registration specifically:

• Owner of the app registration (check the Owners tab on the blueprint app registration in Entra — see below)
• Application Administrator role in your Entra tenant
• Cloud Application Administrator role in your Entra tenant
• Global Administrator role in your Entra tenant

See: Microsoft Entra built-in roles — Application Administrator

To check if you're an owner of the blueprint app registration:

1. Go to Microsoft Entra admin center > App registrations > All applications
2. Search for your blueprint app (use the agentBlueprintId from a365 config display -g)
3. Go to Owners — if your account is listed, you can add the secret yourself

---

Q2: How to create the secret manually in Azure Portal

1. In Microsoft Entra admin center, go to App registrations > All applications
2. Search for your blueprint app by the agentBlueprintId value:

   a365 config display -g
   # Look for: agentBlueprintId

3. Open the app > Certificates & secrets > Client secrets > New client secret
4. Set a description and expiry, then select Add
5. Copy the Value immediately — it's only shown once. The Secret ID is not what you need; copy the Value column.

---

Q3: How to add the secret to the config, and will setup all use it?

Add the secret to a365.generated.config.json (in the same directory as a365.config.json) — not to a365.config.json.

Open a365.generated.config.json and add or update these two fields alongside the existing content:

{
  "agentBlueprintClientSecret": "<paste the secret Value here>",
  "agentBlueprintClientSecretProtected": false
}

Plaintext works. Setting agentBlueprintClientSecretProtected to false tells the CLI the value is not encrypted. The CLI will use it as-is. (When the CLI creates the secret automatically on Windows, it stores a DPAPI-encrypted value with agentBlueprintClientSecretProtected: true — that's just for at-rest protection on Windows. Plaintext with false works correctly.)

Keep a365.generated.config.json out of source control — it contains your secret.

---

How to re-run setup all after adding the secret

Once the secret is in a365.generated.config.json, re-run:

a365 setup all

The CLI will:

1. Find the existing blueprint by display name — detect it already exists
2. Load the secret from a365.generated.config.json — validate it against Microsoft Entra (it won't try to create a new one if the existing secret is valid)
3. Continue with the remaining steps: MCP permissions, Bot API permissions, and endpoint registration

Important: The permissions and admin consent steps (setup permissions mcp / setup permissions bot) still require Global Administrator. If your account doesn't have that role, those steps will also fail. The full setup all flow requires Global Administrator — see: setup all command reference.