@pnp/cli-microsoft365 12.0.0-beta.10c5833 → 12.0.0-beta.235caf5

package/dist/m365/tenant/commands/serviceannouncement/serviceannouncement-message-get.js

@@ -1,12 +1,16 @@
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _TenantServiceAnnouncementMessageGetCommand_instances, _TenantServiceAnnouncementMessageGetCommand_initOptions, _TenantServiceAnnouncementMessageGetCommand_initValidators;
+import { z } from 'zod';
+import { globalOptionsZod } from '../../../../Command.js';
 import request from '../../../../request.js';
 import GraphCommand from '../../../base/GraphCommand.js';
 import commands from '../../commands.js';
+export const options = z.strictObject({
+    ...globalOptionsZod.shape,
+    id: z.string()
+        .refine(val => (/MC\d{6}/).test(val), {
+        message: 'The value is not a valid message ID'
+    })
+        .alias('i')
+});
 class TenantServiceAnnouncementMessageGetCommand extends GraphCommand {
     get name() {
         return commands.SERVICEANNOUNCEMENT_MESSAGE_GET;
@@ -14,11 +18,8 @@ class TenantServiceAnnouncementMessageGetCommand extends GraphCommand {
     get description() {
         return 'Retrieves a specified service update message for the tenant';
     }
-    constructor() {
-        super();
-        _TenantServiceAnnouncementMessageGetCommand_instances.add(this);
-        __classPrivateFieldGet(this, _TenantServiceAnnouncementMessageGetCommand_instances, "m", _TenantServiceAnnouncementMessageGetCommand_initOptions).call(this);
-        __classPrivateFieldGet(this, _TenantServiceAnnouncementMessageGetCommand_instances, "m", _TenantServiceAnnouncementMessageGetCommand_initValidators).call(this);
+    get schema() {
+        return options;
     }
     async commandAction(logger, args) {
         if (this.verbose) {
@@ -39,21 +40,6 @@ class TenantServiceAnnouncementMessageGetCommand extends GraphCommand {
             this.handleRejectedODataJsonPromise(err);
         }
     }
-    isValidId(id) {
-        return (/MC\d{6}/).test(id);
-    }
 }
-_TenantServiceAnnouncementMessageGetCommand_instances = new WeakSet(), _TenantServiceAnnouncementMessageGetCommand_initOptions = function _TenantServiceAnnouncementMessageGetCommand_initOptions() {
-    this.options.unshift({
-        option: '-i, --id <id>'
-    });
-}, _TenantServiceAnnouncementMessageGetCommand_initValidators = function _TenantServiceAnnouncementMessageGetCommand_initValidators() {
-    this.validators.push(async (args) => {
-        if (!this.isValidId(args.options.id)) {
-            return `${args.options.id} is not a valid message ID`;
-        }
-        return true;
-    });
-};
 export default new TenantServiceAnnouncementMessageGetCommand();
 //# sourceMappingURL=serviceannouncement-message-get.js.map

package/dist/m365/tenant/commands/serviceannouncement/serviceannouncement-message-list.js

@@ -1,13 +1,13 @@
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _TenantServiceAnnouncementMessageListCommand_instances, _TenantServiceAnnouncementMessageListCommand_initTelemetry, _TenantServiceAnnouncementMessageListCommand_initOptions;
+import { z } from 'zod';
+import { globalOptionsZod } from '../../../../Command.js';
 import { formatting } from '../../../../utils/formatting.js';
 import { odata } from '../../../../utils/odata.js';
 import GraphCommand from '../../../base/GraphCommand.js';
 import commands from '../../commands.js';
+export const options = z.strictObject({
+    ...globalOptionsZod.shape,
+    service: z.string().optional().alias('s')
+});
 class TenantServiceAnnouncementMessageListCommand extends GraphCommand {
     get name() {
         return commands.SERVICEANNOUNCEMENT_MESSAGE_LIST;
@@ -18,11 +18,8 @@ class TenantServiceAnnouncementMessageListCommand extends GraphCommand {
     defaultProperties() {
         return ['id', 'title'];
     }
-    constructor() {
-        super();
-        _TenantServiceAnnouncementMessageListCommand_instances.add(this);
-        __classPrivateFieldGet(this, _TenantServiceAnnouncementMessageListCommand_instances, "m", _TenantServiceAnnouncementMessageListCommand_initTelemetry).call(this);
-        __classPrivateFieldGet(this, _TenantServiceAnnouncementMessageListCommand_instances, "m", _TenantServiceAnnouncementMessageListCommand_initOptions).call(this);
+    get schema() {
+        return options;
     }
     async commandAction(logger, args) {
         let endpoint = `${this.resource}/v1.0/admin/serviceAnnouncement/messages`;
@@ -38,16 +35,5 @@ class TenantServiceAnnouncementMessageListCommand extends GraphCommand {
         }
     }
 }
-_TenantServiceAnnouncementMessageListCommand_instances = new WeakSet(), _TenantServiceAnnouncementMessageListCommand_initTelemetry = function _TenantServiceAnnouncementMessageListCommand_initTelemetry() {
-    this.telemetry.push((args) => {
-        Object.assign(this.telemetryProperties, {
-            service: typeof args.options.service !== 'undefined'
-        });
-    });
-}, _TenantServiceAnnouncementMessageListCommand_initOptions = function _TenantServiceAnnouncementMessageListCommand_initOptions() {
-    this.options.unshift({
-        option: '-s, --service [service]'
-    });
-};
 export default new TenantServiceAnnouncementMessageListCommand();
 //# sourceMappingURL=serviceannouncement-message-list.js.map

package/dist/m365/util/commands/accesstoken/accesstoken-get.js

@@ -1,13 +1,14 @@
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _UtilAccessTokenGetCommand_instances, _UtilAccessTokenGetCommand_initTelemetry, _UtilAccessTokenGetCommand_initOptions;
+import { z } from 'zod';
 import auth, { Auth } from '../../../../Auth.js';
-import Command from '../../../../Command.js';
+import Command, { globalOptionsZod } from '../../../../Command.js';
 import commands from '../../commands.js';
 import { accessToken } from '../../../../utils/accessToken.js';
+export const options = z.strictObject({
+    ...globalOptionsZod.shape,
+    resource: z.string().alias('r'),
+    new: z.boolean().optional(),
+    decoded: z.boolean().optional()
+});
 class UtilAccessTokenGetCommand extends Command {
     get name() {
         return commands.ACCESSTOKEN_GET;
@@ -15,11 +16,8 @@ class UtilAccessTokenGetCommand extends Command {
     get description() {
         return 'Gets access token for the specified resource';
     }
-    constructor() {
-        super();
-        _UtilAccessTokenGetCommand_instances.add(this);
-        __classPrivateFieldGet(this, _UtilAccessTokenGetCommand_instances, "m", _UtilAccessTokenGetCommand_initTelemetry).call(this);
-        __classPrivateFieldGet(this, _UtilAccessTokenGetCommand_instances, "m", _UtilAccessTokenGetCommand_initOptions).call(this);
+    get schema() {
+        return options;
     }
     async commandAction(logger, args) {
         let resource = args.options.resource;
@@ -49,21 +47,5 @@ class UtilAccessTokenGetCommand extends Command {
         }
     }
 }
-_UtilAccessTokenGetCommand_instances = new WeakSet(), _UtilAccessTokenGetCommand_initTelemetry = function _UtilAccessTokenGetCommand_initTelemetry() {
-    this.telemetry.push((args) => {
-        Object.assign(this.telemetryProperties, {
-            new: args.options.new,
-            decoded: args.options.decoded
-        });
-    });
-}, _UtilAccessTokenGetCommand_initOptions = function _UtilAccessTokenGetCommand_initOptions() {
-    this.options.unshift({
-        option: '-r, --resource <resource>'
-    }, {
-        option: '--new'
-    }, {
-        option: '--decoded'
-    });
-};
 export default new UtilAccessTokenGetCommand();
 //# sourceMappingURL=accesstoken-get.js.map

package/dist/telemetry.js

@@ -1,25 +1,21 @@
-import appInsights from './appInsights.js';
 import { cli } from './cli/cli.js';
+import { googleAnalytics } from './googleAnalytics.js';
 import { settingsNames } from './settingsNames.js';
 import { pid } from './utils/pid.js';
 import { session } from './utils/session.js';
 async function trackTelemetry(object) {
     try {
         const { commandName, properties, exception } = object;
-        appInsights.commonProperties.shell = pid.getProcessName(process.ppid) || '';
-        appInsights.context.tags[appInsights.context.keys.sessionId] = session.getId(process.ppid);
+        const context = {
+            shell: pid.getProcessName(process.ppid) || '',
+            sessionId: session.getId(process.ppid)
+        };
         if (exception) {
-            appInsights.trackException({
-                exception
-            });
+            await googleAnalytics.trackException(exception, context);
         }
         else {
-            appInsights.trackEvent({
-                name: commandName,
-                properties
-            });
+            await googleAnalytics.trackEvent(commandName, properties, context);
         }
-        await appInsights.flush();
     }
     catch {
         // Do nothing

package/dist/utils/calendar.js

@@ -18,7 +18,7 @@ export const calendar = {
         return await request.get(requestOptions);
     },
     async getUserCalendarByName(userId, name, calendarGroupId, properties) {
-        let url = `https://graph.microsoft.com/v1.0/users('${userId}')/${calendarGroupId ? `calendarGroups/${calendarGroupId}/` : ''}calendars?$filter=name eq '${formatting.encodeQueryParameter(name)}'`;
+        let url = `https://graph.microsoft.com/v1.0/users('${formatting.encodeQueryParameter(userId)}')/${calendarGroupId ? `calendarGroups/${calendarGroupId}/` : ''}calendars?$filter=name eq '${formatting.encodeQueryParameter(name)}'`;
         if (properties) {
             url += `&$select=${properties}`;
         }

package/dist/utils/formatting.js

@@ -189,6 +189,22 @@ export const formatting = {
         const guidPattern = /\/Guid\(([0-9a-f-]+)\)\//i;
         const match = str.match(guidPattern);
         return match ? match[1] : str;
+    },
+    /**
+     * Converts a CSOM date string to an ISO 8601 date string.
+     * @param str The string to extract the date from
+     * @description The string should be in the format /Date(year,month,day,hours,minutes,seconds,milliseconds)/ where month is 0-based. Escaped slashes (\/Date(...)\/) are supported as well. The date parts are interpreted as UTC.
+     * @returns The date as an ISO 8601 string or the original string if no match is found
+     * @example /Date(2026,8,21,12,24,45,997)/ => 2026-09-21T12:24:45.997Z
+     */
+    extractCsomDate(str) {
+        const datePattern = /^\\?\/Date\((\d+(?:,\d+){2,6})\)\\?\/$/i;
+        const match = str.trim().match(datePattern);
+        if (!match) {
+            return str;
+        }
+        const [year, month, day, hours = 0, minutes = 0, seconds = 0, milliseconds = 0] = match[1].split(',').map(Number);
+        return new Date(Date.UTC(year, month, day, hours, minutes, seconds, milliseconds)).toISOString();
     }
 };
 //# sourceMappingURL=formatting.js.map

package/dist/utils/pid.js

@@ -1,6 +1,7 @@
 import child_process from 'child_process';
 import fs from 'fs';
 import os from 'os';
+import path from 'path';
 import { cache } from './cache.js';
 function getProcessNameOnMacOs(pid) {
     const res = child_process.spawnSync('ps', ['-o', 'comm=', pid.toString()], { encoding: 'utf8' });
@@ -21,24 +22,14 @@ function getProcessNameOnLinux(pid) {
     return procName;
 }
 function getProcessNameOnWindows(pid) {
-    const findProcess = child_process.spawnSync('wmic', ['PROCESS', 'where', `ProcessId=${pid}`, 'get', 'Caption'], { encoding: 'utf8' });
-    if (findProcess.error || findProcess.stderr) {
+    const tasklist = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tasklist.exe');
+    const res = child_process.spawnSync(tasklist, ['/FI', `PID eq ${pid}`, '/FO', 'CSV', '/NH'], { encoding: 'utf8' });
+    if (res.error || res.status !== 0) {
         return undefined;
     }
-    else {
-        const getPid = child_process.spawnSync('find', ['/V', '"Caption"'], {
-            encoding: 'utf8',
-            input: findProcess.stdout,
-            // must include or passing quoted "Caption" will fail
-            windowsVerbatimArguments: true
-        });
-        if (getPid.error || getPid.stderr) {
-            return undefined;
-        }
-        else {
-            return getPid.stdout.trim();
-        }
-    }
+    // "pwsh.exe","12345","Console","1","98,765 K"
+    const match = res.stdout.match(/^"([^"]+)","(\d+)"/m);
+    return match && match[2] === pid.toString() ? match[1] : undefined;
 }
 export const pid = {
     getProcessName(pid) {

package/dist/utils/spe.js

@@ -9,7 +9,7 @@ export const spe = {
      * @returns ID of the container type
      */
     async getContainerTypeIdByName(name) {
-        const containerTypes = await odata.getAllItems(`${graphResource}/beta/storage/fileStorage/containerTypes?$select=id,name&$filter=name eq '${formatting.encodeQueryParameter(name)}'`);
+        const containerTypes = await odata.getAllItems(`${graphResource}/v1.0/storage/fileStorage/containerTypes?$select=id,name&$filter=name eq '${formatting.encodeQueryParameter(name)}'`);
         if (containerTypes.length === 0) {
             throw new Error(`The specified container type '${name}' does not exist.`);
         }

package/dist/utils/spo.js

@@ -576,6 +576,45 @@ export const spo = {
         return request.post(requestOptions);
     },
     /**
+    * Retrieves the navigation node with the specified key.
+    * Returns the node along with the menu state that contains it.
+    * @param webUrl Web url
+    * @param key Key (ID) of the navigation node
+    * @param location Navigation to search. When not specified, searches the quick launch first and then the top navigation
+    */
+    async getMenuStateNodeByKey(webUrl, key, location) {
+        const locations = location ? [location] : ['QuickLaunch', 'TopNavigationBar'];
+        for (const navigationLocation of locations) {
+            const menuState = navigationLocation === 'TopNavigationBar'
+                ? await this.getTopNavigationMenuState(webUrl)
+                : await this.getQuickLaunchMenuState(webUrl);
+            const node = this.findMenuStateNode(menuState.Nodes, key);
+            if (node) {
+                return { menuState, node };
+            }
+        }
+        throw location
+            ? `Navigation node with id '${key}' not found in ${location}.`
+            : `Navigation node with id '${key}' not found.`;
+    },
+    /**
+    * Recursively searches the specified menu state nodes for the node with the specified key.
+    * @param nodes Menu state nodes to search
+    * @param key Key (ID) of the navigation node
+    */
+    findMenuStateNode(nodes, key) {
+        for (const node of nodes) {
+            if (node.Key === key) {
+                return node;
+            }
+            const childNode = this.findMenuStateNode(node.Nodes, key);
+            if (childNode) {
+                return childNode;
+            }
+        }
+        return undefined;
+    },
+    /**
     * Retrieves the spo group by name.
     * Returns a group object
     * @param webUrl Web url
@@ -1250,9 +1289,7 @@ export const spo = {
             // Neither properties nor contentTypeName provided, no need to proceed
             throw 'Either properties or contentTypeName must be provided for systemUpdateListItem.';
         }
-        const parsedUrl = new URL(absoluteListUrl);
-        const serverRelativeSiteMatch = absoluteListUrl.match(new RegExp('/sites/[^/]+'));
-        const webUrl = `${parsedUrl.protocol}//${parsedUrl.host}${serverRelativeSiteMatch ?? ''}`;
+        const webUrl = absoluteListUrl.substring(0, absoluteListUrl.indexOf('/_api/'));
         if (verbose && logger) {
             await logger.logToStderr(`Getting list id...`);
         }

package/dist/utils/urlUtil.js

@@ -165,8 +165,8 @@ export const urlUtil = {
     */
     getTargetSiteAbsoluteUrl(webUrl, url) {
         const fullUrl = url.startsWith('https://') ? url : urlUtil.getAbsoluteUrl(webUrl, url);
-        // Pattern to match SharePoint URLs
-        const urlPattern = /https:\/\/[\w-]+\.sharepoint\.com\/(teams|sites|personal)\/([\w-]+)/;
+        // Pattern to match SharePoint site collection URLs on any of the supported managed paths
+        const urlPattern = /^https:\/\/[\w-]+\.sharepoint\.com\/(teams|sites|personal)\/[^/?#]+/i;
         const match = fullUrl.match(urlPattern);
         if (match) {
             // If a match is found, return the matched URL

package/dist/utils/validation.js

@@ -100,6 +100,30 @@ export const validation = {
         }
         return false;
     },
+    isValidGraphDateTime(dateTime) {
+        const graphDateTimeRegEx = new RegExp(/^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|(02)-(0[1-9]|[12][0-9]))T(0[0-9]|1[0-9]|2[0-3]):(0[0-9]|[1-5][0-9]):(0[0-9]|[1-5][0-9])$/);
+        if (!graphDateTimeRegEx.test(dateTime)) {
+            return false;
+        }
+        const [date] = dateTime.split('T');
+        const [year, month, day] = date.split('-').map(Number);
+        const isLeapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+        const daysInMonth = [
+            31,
+            isLeapYear ? 29 : 28,
+            31,
+            30,
+            31,
+            30,
+            31,
+            31,
+            30,
+            31,
+            30,
+            31
+        ];
+        return day <= daysInMonth[month - 1];
+    },
     isValidBoolean(value) {
         return value.toLowerCase() === 'true' || value.toLowerCase() === 'false';
     },

package/dist/utils/zod.js

@@ -3,6 +3,10 @@ z.ZodType.prototype.alias = function (name) {
     this.def.alias = name;
     return this;
 };
+z.ZodType.prototype.autocomplete = function (values) {
+    this.def.autocomplete = values;
+    return this;
+};
 function parseObject(schema, options, _currentOption) {
     for (const key in schema.properties) {
         const property = schema.properties[key];
@@ -24,6 +28,9 @@ function parseString(schema, _options, currentOption) {
         if (schema.enum) {
             currentOption.autocomplete = schema.enum.map(e => String(e));
         }
+        else if (schema['x-autocomplete']) {
+            currentOption.autocomplete = schema['x-autocomplete'];
+        }
     }
     return;
 }
@@ -89,9 +96,12 @@ export const zod = {
     schemaToOptionInfo(schema) {
         const jsonSchema = z.toJSONSchema(schema, {
             override: s => {
-                const alias = s.zodSchema.def.alias;
-                if (alias) {
-                    s.jsonSchema['x-alias'] = alias;
+                const definition = s.zodSchema.def;
+                if (definition.alias) {
+                    s.jsonSchema['x-alias'] = definition.alias;
+                }
+                if (definition.autocomplete) {
+                    s.jsonSchema['x-autocomplete'] = definition.autocomplete;
                 }
             },
             unrepresentable: 'any'
@@ -110,14 +120,14 @@ export const zod = {
         });
         return options;
     },
-    coercedEnum: (e) => z.preprocess(val => {
-        const target = String(val)?.toLowerCase();
+    coercedEnum: (e) => z.string().pipe(z.preprocess(val => {
+        const target = String(val).toLowerCase();
         for (const k of Object.values(e)) {
-            if (String(k)?.toLowerCase() === target) {
+            if (String(k).toLowerCase() === target) {
                 return k;
             }
         }
         return null;
-    }, z.enum(e))
+    }, z.enum(e)))
 };
 //# sourceMappingURL=zod.js.map

package/docs/docs/cmd/entra/agent/agent-blueprint-list.mdx

@@ -0,0 +1,175 @@
+import Global from '../../_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# entra agent blueprint list
+
+Retrieves a list of templates defining the agent identity type
+
+## Usage
+
+```sh
+m365 entra agent blueprint list [options]
+```
+
+## Options
+
+```md definition-list
+`-p, --properties [properties]`
+: Comma-separated list of properties to retrieve.
+```
+
+<Global />
+
+## Remarks
+
+Using the --properties option, you can specify a comma-separated list of agent blueprint properties to retrieve from Microsoft Graph. If you don't specify any properties, Microsoft Graph returns its default property set, as shown in the response examples. The CLI's default properties are used only for text output.
+
+:::note
+
+A principal who creates a blueprint or blueprint principal is assigned as the owner. Owners can create agent identities and modify only the resources they own, even if they aren't assigned an Agent ID role.
+
+For nonowners to call this API in delegated scenarios using work or school accounts, the admin must be assigned a supported [Microsoft Entra role](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference). This operation supports the following built-in roles, which provide only the least privilege necessary:
+
+- **Agent ID Administrator**.
+- **Agent ID Developer** - Create agent identity blueprints and blueprint principals.
+
+ :::
+
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource        | Permissions                     |
+  |-----------------|---------------------------------|
+  | Microsoft Graph | AgentIdentityBlueprint.Read.All |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource        | Permissions                     |
+  |-----------------|---------------------------------|
+  | Microsoft Graph | AgentIdentityBlueprint.Read.All |
+
+  </TabItem>
+</Tabs>
+
+## Examples
+
+Retrieve all agent blueprint templates
+
+```sh
+m365 entra agent blueprint list
+```
+
+Retrieve id and name of agent blueprint templates
+
+```sh
+m365 entra agent blueprint list --properties 'id,displayName'
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+      "appId": "0e81af7f-b058-470a-84be-3a4f5a8014ca",
+      "createdByAppId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
+      "createdDateTime": "2025-11-20T07:47:39Z",
+      "defaultRedirectUri": null,
+      "description": null,
+      "disabledByMicrosoftStatus": null,
+      "displayName": "OcnAgentBluePrint02",
+      "groupMembershipClaims": null,
+      "identifierUris": [],
+      "managerApplications": [],
+      "publisherDomain": "contoso.onmicrosoft.com",
+      "serviceManagementReference": null,
+      "signInAudience": "AzureADMyOrg",
+      "tags": [],
+      "tokenEncryptionKeyId": null,
+      "uniqueName": null,
+      "id": "0e81af7f-b058-470a-84be-3a4f5a8014ca",
+      "certification": null,
+      "optionalClaims": null,
+      "api": {
+        "acceptMappedClaims": null,
+        "knownClientApplications": [],
+        "requestedAccessTokenVersion": 2,
+        "oauth2PermissionScopes": [],
+        "preAuthorizedApplications": []
+      },
+      "appRoles": [],
+      "info": {
+        "logoUrl": null,
+        "marketingUrl": null,
+        "privacyStatementUrl": null,
+        "supportUrl": null,
+        "termsOfServiceUrl": null
+      },
+      "keyCredentials": [],
+      "passwordCredentials": [],
+      "requiredResourceAccess": [],
+      "verifiedPublisher": {
+        "displayName": null,
+        "verifiedPublisherId": null,
+        "addedDateTime": null
+      },
+      "web": {
+        "homePageUrl": null,
+        "logoutUrl": null,
+        "redirectUris": [],
+        "implicitGrantSettings": {
+          "enableAccessTokenIssuance": false,
+          "enableIdTokenIssuance": false
+        },
+        "redirectUriSettings": []
+      }
+    }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  appId      : 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  displayName: OcnAgentBluePrint02
+  id         : 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  appId,createdByAppId,createdDateTime,defaultRedirectUri,description,disabledByMicrosoftStatus,displayName,groupMembershipClaims,publisherDomain,serviceManagementReference,signInAudience,tokenEncryptionKeyId,uniqueName,id,certification,optionalClaims
+  0e81af7f-b058-470a-84be-3a4f5a8014ca,14d82eec-204b-4c2f-b7e8-296a70dab67e,2025-11-20T07:47:39Z,,,,OcnAgentBluePrint02,,contoso.onmicrosoft.com,,AzureADMyOrg,,,0e81af7f-b058-470a-84be-3a4f5a8014ca,,
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # entra agent blueprint list --debug "false" --verbose "false"
+
+  Date: 6/5/2026
+
+  ## OcnAgentBluePrint02 (0e81af7f-b058-470a-84be-3a4f5a8014ca)
+
+  Property | Value
+  ---------|-------
+  appId | 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  createdByAppId | 14d82eec-204b-4c2f-b7e8-296a70dab67e
+  createdDateTime | 2025-11-20T07:47:39Z
+  displayName | OcnAgentBluePrint02
+  publisherDomain | contoso.onmicrosoft.com
+  signInAudience | AzureADMyOrg
+  id | 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  ```
+
+  </TabItem>
+</Tabs>

package/docs/docs/cmd/login.mdx

@@ -78,7 +78,20 @@ When logging in to Microsoft 365 using the user name and password, next to the a
 
 When logging in to Microsoft 365 using a certificate, the CLI for Microsoft 365 will store the contents of the certificate so that it can automatically re-authenticate if necessary. The contents of the certificate are removed by re-authenticating using the device code or by calling the [logout](logout.mdx) command.  
 
-Federated Identity is currently supported in GitHub Actions. To use this you need to set `authType` to `federatedIdentity` and specify `appId` and `tenant` to the values of the app registration you've configured a federated credential on. 
+Federated Identity is currently supported in GitHub Actions, Azure DevOps and GitLab CI/CD. To use this you need to set `authType` to `federatedIdentity` and specify `appId` and `tenant` to the values of the app registration you've configured a federated credential on.
+
+To use Federated Identity in GitLab CI/CD, the job must request an ID token named `GITLAB_OIDC_TOKEN` with audience `api://AzureADTokenExchange`, for example:
+
+```yaml
+job:
+  id_tokens:
+    GITLAB_OIDC_TOKEN:
+      aud: "api://AzureADTokenExchange"
+  script:
+    - m365 login --authType federatedIdentity --appId eb96cfd0-abfa-4477-8d1d-c6dfde3efb19 --tenant 9a1a1bbd-e158-4cf5-967d-a53b8e85c628
+```
+
+The corresponding federated credential on the Microsoft Entra app registration must have issuer `https://gitlab.com` (or your self-managed GitLab instance URL) and a subject matching the GitLab OIDC claim for the job, for example `project_path:<group>/<project>:ref_type:branch:ref:<branch>`.
 
 To log in to Microsoft 365 using a certificate or secret, you will typically [create a custom Microsoft Entra application](../user-guide/using-own-identity.mdx). To use this application with the CLI for Microsoft 365, you will set the `CLIMICROSOFT365_ENTRAAPPID` environment variable to the application's ID and the `CLIMICROSOFT365_TENANT` environment variable to the ID of the Microsoft Entra tenant, where you created the Microsoft Entra application. Also, please make sure to read about [the caveats when using the certificate login option](../user-guide/cli-certificate-caveats.mdx).
 
@@ -202,7 +215,7 @@ Log in to Microsoft 365 using a user-assigned managed identity with `clientId` s
 m365 login --authType identity --userName ac9fbed5-804c-4362-a369-21a4ec51109e
 ```
 
-Log in to Microsoft 365 using a federated identity. Can currently only be used in GitHub Actions.
+Log in to Microsoft 365 using a federated identity. Can currently only be used in GitHub Actions, Azure DevOps and GitLab CI/CD.
 
 ```sh
 m365 login --authType federatedIdentity --appId eb96cfd0-abfa-4477-8d1d-c6dfde3efb19 --tenant 9a1a1bbd-e158-4cf5-967d-a53b8e85c628