upd for cross-cloud calls and unification of OIDC endpoints/calls#771
Merged
paullizer merged 1 commit intoDevelopmentfrom Mar 5, 2026
Merged
upd for cross-cloud calls and unification of OIDC endpoints/calls#771paullizer merged 1 commit intoDevelopmentfrom
paullizer merged 1 commit intoDevelopmentfrom
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR unifies the resolution of Microsoft Graph endpoints and OIDC authority URLs to better support cross-cloud authentication scenarios. It consolidates previously scattered, environment-specific hardcoded Graph URL logic into centralized helper functions, and introduces new optional env-var overrides (CUSTOM_GRAPH_AUTHORITY_URL_VALUE, CUSTOM_OIDC_METADATA_URL_VALUE) that can be applied independently of the base AZURE_ENVIRONMENT setting.
Changes:
- Adds
get_graph_endpoint(),get_graph_base_url(), andget_graph_authority()helper functions infunctions_authentication.pyto centralize Graph URL resolution, and replaces all previously scattered hardcoded/environment-branched Graph URL construction in route files. - Adds
CUSTOM_GRAPH_AUTHORITY_URL_VALUEandCUSTOM_OIDC_METADATA_URL_VALUEtoconfig.pyand extends theAUTHORITY/authoritysetup block to enable cross-cloud override scenarios. - Updates
example.envto document the new optional Graph override variables, and bumpsVERSIONto0.239.004.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
application/single_app/functions_authentication.py |
Adds _normalize_authority, get_graph_authority, get_graph_base_url, and get_graph_endpoint helper functions; updates _build_msal_app to accept an authority override; updates get_valid_access_token and get_valid_access_token_for_plugins to use the new Graph authority; refactors get_user_profile_image to use get_graph_endpoint. |
application/single_app/config.py |
Adds CUSTOM_GRAPH_AUTHORITY_URL_VALUE and CUSTOM_OIDC_METADATA_URL_VALUE env vars; restructures AUTHORITY/authority resolution to handle custom overrides; re-orders WORD_CHUNK_SIZE placement; bumps version. |
application/single_app/route_backend_users.py |
Replaces environment-branched Graph URL construction with get_graph_endpoint("/users"). |
application/single_app/route_backend_public_workspaces.py |
Replaces environment-branched Graph URL construction with get_graph_endpoint(f"/users/{user_id}"). |
application/single_app/route_backend_documents.py |
Replaces hardcoded public-cloud Graph URL with get_graph_endpoint(f"/users/{oid}"). |
application/single_app/example.env |
Documents the two new optional Graph override env vars. |
You can also share your feedback on Copilot code review. Take the survey.
paullizer
approved these changes
Mar 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unifies authority derived for authentication and graph calls. Allows for custom authentication while remaining in one of the major clouds (MAC/MAG) enabling easier cross-cloud authentication scenarios to be supported.