@pnp/cli-microsoft365 12.0.0-beta.f682e10 → 12.0.0

package/dist/utils/validation.js

@@ -100,6 +100,30 @@ export const validation = {
         }
         return false;
     },
+    isValidGraphDateTime(dateTime) {
+        const graphDateTimeRegEx = new RegExp(/^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|(02)-(0[1-9]|[12][0-9]))T(0[0-9]|1[0-9]|2[0-3]):(0[0-9]|[1-5][0-9]):(0[0-9]|[1-5][0-9])$/);
+        if (!graphDateTimeRegEx.test(dateTime)) {
+            return false;
+        }
+        const [date] = dateTime.split('T');
+        const [year, month, day] = date.split('-').map(Number);
+        const isLeapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+        const daysInMonth = [
+            31,
+            isLeapYear ? 29 : 28,
+            31,
+            30,
+            31,
+            30,
+            31,
+            31,
+            30,
+            31,
+            30,
+            31
+        ];
+        return day <= daysInMonth[month - 1];
+    },
     isValidBoolean(value) {
         return value.toLowerCase() === 'true' || value.toLowerCase() === 'false';
     },
@@ -361,6 +385,18 @@ export const validation = {
     isValidPowerPagesUrl(url) {
         const powerPagesUrlPattern = /^https:\/\/[a-zA-Z0-9-]+\.powerappsportals\.com$/;
         return powerPagesUrlPattern.test(url);
+    },
+    isValidJsonOrEmpty(value) {
+        if (value === '') {
+            return true;
+        }
+        try {
+            JSON.parse(value);
+            return true;
+        }
+        catch {
+            return false;
+        }
     }
 };
 //# sourceMappingURL=validation.js.map

package/dist/utils/zod.js

@@ -3,6 +3,10 @@ z.ZodType.prototype.alias = function (name) {
     this.def.alias = name;
     return this;
 };
+z.ZodType.prototype.autocomplete = function (values) {
+    this.def.autocomplete = values;
+    return this;
+};
 function parseObject(schema, options, _currentOption) {
     for (const key in schema.properties) {
         const property = schema.properties[key];
@@ -10,6 +14,7 @@ function parseObject(schema, options, _currentOption) {
             name: key,
             long: key,
             short: property['x-alias'],
+            autocomplete: property['x-autocomplete'],
             required: schema.required?.includes(key) && property.default === undefined || false,
             type: 'string'
         };
@@ -24,6 +29,9 @@ function parseString(schema, _options, currentOption) {
         if (schema.enum) {
             currentOption.autocomplete = schema.enum.map(e => String(e));
         }
+        else if (schema['x-autocomplete']) {
+            currentOption.autocomplete = schema['x-autocomplete'];
+        }
     }
     return;
 }
@@ -89,9 +97,12 @@ export const zod = {
     schemaToOptionInfo(schema) {
         const jsonSchema = z.toJSONSchema(schema, {
             override: s => {
-                const alias = s.zodSchema.def.alias;
-                if (alias) {
-                    s.jsonSchema['x-alias'] = alias;
+                const definition = s.zodSchema.def;
+                if (definition.alias) {
+                    s.jsonSchema['x-alias'] = definition.alias;
+                }
+                if (definition.autocomplete) {
+                    s.jsonSchema['x-autocomplete'] = definition.autocomplete;
                 }
             },
             unrepresentable: 'any'
@@ -110,14 +121,14 @@ export const zod = {
         });
         return options;
     },
-    coercedEnum: (e) => z.preprocess(val => {
-        const target = String(val)?.toLowerCase();
+    coercedEnum: (e) => z.string().pipe(z.preprocess(val => {
+        const target = String(val).toLowerCase();
         for (const k of Object.values(e)) {
-            if (String(k)?.toLowerCase() === target) {
+            if (String(k).toLowerCase() === target) {
                 return k;
             }
         }
         return null;
-    }, z.enum(e))
+    }, z.enum(e)))
 };
 //# sourceMappingURL=zod.js.map

package/docs/docs/cmd/entra/agent/agent-blueprint-list.mdx

@@ -0,0 +1,175 @@
+import Global from '../../_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# entra agent blueprint list
+
+Retrieves a list of templates defining the agent identity type
+
+## Usage
+
+```sh
+m365 entra agent blueprint list [options]
+```
+
+## Options
+
+```md definition-list
+`-p, --properties [properties]`
+: Comma-separated list of properties to retrieve.
+```
+
+<Global />
+
+## Remarks
+
+Using the --properties option, you can specify a comma-separated list of agent blueprint properties to retrieve from Microsoft Graph. If you don't specify any properties, Microsoft Graph returns its default property set, as shown in the response examples. The CLI's default properties are used only for text output.
+
+:::note
+
+A principal who creates a blueprint or blueprint principal is assigned as the owner. Owners can create agent identities and modify only the resources they own, even if they aren't assigned an Agent ID role.
+
+For nonowners to call this API in delegated scenarios using work or school accounts, the admin must be assigned a supported [Microsoft Entra role](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference). This operation supports the following built-in roles, which provide only the least privilege necessary:
+
+- **Agent ID Administrator**.
+- **Agent ID Developer** - Create agent identity blueprints and blueprint principals.
+
+ :::
+
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource        | Permissions                     |
+  |-----------------|---------------------------------|
+  | Microsoft Graph | AgentIdentityBlueprint.Read.All |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource        | Permissions                     |
+  |-----------------|---------------------------------|
+  | Microsoft Graph | AgentIdentityBlueprint.Read.All |
+
+  </TabItem>
+</Tabs>
+
+## Examples
+
+Retrieve all agent blueprint templates
+
+```sh
+m365 entra agent blueprint list
+```
+
+Retrieve id and name of agent blueprint templates
+
+```sh
+m365 entra agent blueprint list --properties 'id,displayName'
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+      "appId": "0e81af7f-b058-470a-84be-3a4f5a8014ca",
+      "createdByAppId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
+      "createdDateTime": "2025-11-20T07:47:39Z",
+      "defaultRedirectUri": null,
+      "description": null,
+      "disabledByMicrosoftStatus": null,
+      "displayName": "OcnAgentBluePrint02",
+      "groupMembershipClaims": null,
+      "identifierUris": [],
+      "managerApplications": [],
+      "publisherDomain": "contoso.onmicrosoft.com",
+      "serviceManagementReference": null,
+      "signInAudience": "AzureADMyOrg",
+      "tags": [],
+      "tokenEncryptionKeyId": null,
+      "uniqueName": null,
+      "id": "0e81af7f-b058-470a-84be-3a4f5a8014ca",
+      "certification": null,
+      "optionalClaims": null,
+      "api": {
+        "acceptMappedClaims": null,
+        "knownClientApplications": [],
+        "requestedAccessTokenVersion": 2,
+        "oauth2PermissionScopes": [],
+        "preAuthorizedApplications": []
+      },
+      "appRoles": [],
+      "info": {
+        "logoUrl": null,
+        "marketingUrl": null,
+        "privacyStatementUrl": null,
+        "supportUrl": null,
+        "termsOfServiceUrl": null
+      },
+      "keyCredentials": [],
+      "passwordCredentials": [],
+      "requiredResourceAccess": [],
+      "verifiedPublisher": {
+        "displayName": null,
+        "verifiedPublisherId": null,
+        "addedDateTime": null
+      },
+      "web": {
+        "homePageUrl": null,
+        "logoutUrl": null,
+        "redirectUris": [],
+        "implicitGrantSettings": {
+          "enableAccessTokenIssuance": false,
+          "enableIdTokenIssuance": false
+        },
+        "redirectUriSettings": []
+      }
+    }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  appId      : 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  displayName: OcnAgentBluePrint02
+  id         : 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  appId,createdByAppId,createdDateTime,defaultRedirectUri,description,disabledByMicrosoftStatus,displayName,groupMembershipClaims,publisherDomain,serviceManagementReference,signInAudience,tokenEncryptionKeyId,uniqueName,id,certification,optionalClaims
+  0e81af7f-b058-470a-84be-3a4f5a8014ca,14d82eec-204b-4c2f-b7e8-296a70dab67e,2025-11-20T07:47:39Z,,,,OcnAgentBluePrint02,,contoso.onmicrosoft.com,,AzureADMyOrg,,,0e81af7f-b058-470a-84be-3a4f5a8014ca,,
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # entra agent blueprint list --debug "false" --verbose "false"
+
+  Date: 6/5/2026
+
+  ## OcnAgentBluePrint02 (0e81af7f-b058-470a-84be-3a4f5a8014ca)
+
+  Property | Value
+  ---------|-------
+  appId | 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  createdByAppId | 14d82eec-204b-4c2f-b7e8-296a70dab67e
+  createdDateTime | 2025-11-20T07:47:39Z
+  displayName | OcnAgentBluePrint02
+  publisherDomain | contoso.onmicrosoft.com
+  signInAudience | AzureADMyOrg
+  id | 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  ```
+
+  </TabItem>
+</Tabs>

package/docs/docs/cmd/entra/agent/agent-blueprintprincipal-list.mdx

@@ -0,0 +1,156 @@
+import Global from '../../_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# entra agent blueprintprincipal list
+
+Retrieves a list of agent blueprint principals
+
+## Usage
+
+```sh
+m365 entra agent blueprintprincipal list [options]
+```
+
+## Options
+
+```md definition-list
+`-p, --properties [properties]`
+: Comma-separated list of properties to retrieve.
+```
+
+<Global />
+
+## Remarks
+
+Using the `--properties` option, you can specify a comma-separated list of agent blueprint principal properties to retrieve from Microsoft Graph. If you don't specify any properties, Microsoft Graph returns its default property set. The CLI's default properties (`id`, `appDisplayName`, and `appId`) are used only for text output.
+
+:::important
+
+A principal who creates a blueprint or blueprint principal is assigned as the owner. Owners can create agent identities and modify only the resources they own, even if they aren't assigned an Agent ID role.
+
+For nonowners to call this API in delegated scenarios using work or school accounts, the admin must be assigned a supported [Microsoft Entra role](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json). This operation supports the following built-in roles, which provide only the least privilege necessary:
+
+- Agent ID Administrator.
+- Agent ID Developer - Create agent identity blueprints and blueprint principals.
+
+:::
+
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource        | Permissions                              |
+  |-----------------|------------------------------------------|
+  | Microsoft Graph | AgentIdentityBlueprintPrincipal.Read.All |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource        | Permissions                              |
+  |-----------------|------------------------------------------|
+  | Microsoft Graph | AgentIdentityBlueprintPrincipal.Read.All |
+
+  </TabItem>
+</Tabs>
+
+## Examples
+
+Retrieve all agent blueprint principals
+
+```sh
+m365 entra agent blueprintprincipal list
+```
+
+Retrieve id and name of agent blueprint principals
+
+```sh
+m365 entra agent blueprintprincipal list --properties 'id,appDisplayName'
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+      "accountEnabled": true,
+      "appDescription": null,
+      "appDisplayName": "OcnAgentBluePrint02",
+      "appId": "0e81af7f-b058-470a-84be-3a4f5a8014ca",
+      "appOwnerOrganizationId": "70cf0eca-e1e8-4d78-9d03-62ecf811dfc2",
+      "appRoleAssignmentRequired": false,
+      "createdByAppId": "14d82eec-204b-4c2f-b7e8-296a70dab67e",
+      "disabledByMicrosoftStatus": null,
+      "displayName": "OcnAgentBluePrint02",
+      "servicePrincipalNames": [
+        "0e81af7f-b058-470a-84be-3a4f5a8014ca"
+      ],
+      "servicePrincipalType": "Application",
+      "signInAudience": "AzureADMyOrg",
+      "tags": [],
+      "id": "59246ef4-b832-48eb-a5e0-87748132e12c",
+      "appRoles": [],
+      "info": {
+        "logoUrl": null,
+        "marketingUrl": null,
+        "privacyStatementUrl": null,
+        "supportUrl": null,
+        "termsOfServiceUrl": null
+      },
+      "oauth2PermissionScopes": [],
+      "verifiedPublisher": {
+        "displayName": null,
+        "verifiedPublisherId": null,
+        "addedDateTime": null
+      }
+    }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  appDisplayName: OcnAgentBluePrint02
+  appId         : 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  id            : 59246ef4-b832-48eb-a5e0-87748132e12c
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  accountEnabled,appDescription,appDisplayName,appId,appOwnerOrganizationId,appRoleAssignmentRequired,createdByAppId,disabledByMicrosoftStatus,displayName,servicePrincipalType,signInAudience,id
+  1,,OcnAgentBluePrint02,0e81af7f-b058-470a-84be-3a4f5a8014ca,70cf0eca-e1e8-4d78-9d03-62ecf811dfc2,0,14d82eec-204b-4c2f-b7e8-296a70dab67e,,OcnAgentBluePrint02,Application,AzureADMyOrg,59246ef4-b832-48eb-a5e0-87748132e12c
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # entra agent blueprintprincipal list --debug "false" --verbose "false"
+
+  Date: 6/5/2026
+
+  ## OcnAgentBluePrint02 (59246ef4-b832-48eb-a5e0-87748132e12c)
+
+  Property | Value
+  ---------|-------
+  accountEnabled | true
+  appDisplayName | OcnAgentBluePrint02
+  appId | 0e81af7f-b058-470a-84be-3a4f5a8014ca
+  appOwnerOrganizationId | 70cf0eca-e1e8-4d78-9d03-62ecf811dfc2
+  appRoleAssignmentRequired | false
+  createdByAppId | 14d82eec-204b-4c2f-b7e8-296a70dab67e
+  displayName | OcnAgentBluePrint02
+  servicePrincipalType | Application
+  signInAudience | AzureADMyOrg
+  id | 59246ef4-b832-48eb-a5e0-87748132e12c
+  ```
+
+  </TabItem>
+</Tabs>

package/docs/docs/cmd/login.mdx

@@ -78,7 +78,20 @@ When logging in to Microsoft 365 using the user name and password, next to the a
 
 When logging in to Microsoft 365 using a certificate, the CLI for Microsoft 365 will store the contents of the certificate so that it can automatically re-authenticate if necessary. The contents of the certificate are removed by re-authenticating using the device code or by calling the [logout](logout.mdx) command.  
 
-Federated Identity is currently supported in GitHub Actions. To use this you need to set `authType` to `federatedIdentity` and specify `appId` and `tenant` to the values of the app registration you've configured a federated credential on. 
+Federated Identity is currently supported in GitHub Actions, Azure DevOps and GitLab CI/CD. To use this you need to set `authType` to `federatedIdentity` and specify `appId` and `tenant` to the values of the app registration you've configured a federated credential on.
+
+To use Federated Identity in GitLab CI/CD, the job must request an ID token named `GITLAB_OIDC_TOKEN` with audience `api://AzureADTokenExchange`, for example:
+
+```yaml
+job:
+  id_tokens:
+    GITLAB_OIDC_TOKEN:
+      aud: "api://AzureADTokenExchange"
+  script:
+    - m365 login --authType federatedIdentity --appId eb96cfd0-abfa-4477-8d1d-c6dfde3efb19 --tenant 9a1a1bbd-e158-4cf5-967d-a53b8e85c628
+```
+
+The corresponding federated credential on the Microsoft Entra app registration must have issuer `https://gitlab.com` (or your self-managed GitLab instance URL) and a subject matching the GitLab OIDC claim for the job, for example `project_path:<group>/<project>:ref_type:branch:ref:<branch>`.
 
 To log in to Microsoft 365 using a certificate or secret, you will typically [create a custom Microsoft Entra application](../user-guide/using-own-identity.mdx). To use this application with the CLI for Microsoft 365, you will set the `CLIMICROSOFT365_ENTRAAPPID` environment variable to the application's ID and the `CLIMICROSOFT365_TENANT` environment variable to the ID of the Microsoft Entra tenant, where you created the Microsoft Entra application. Also, please make sure to read about [the caveats when using the certificate login option](../user-guide/cli-certificate-caveats.mdx).
 
@@ -202,7 +215,7 @@ Log in to Microsoft 365 using a user-assigned managed identity with `clientId` s
 m365 login --authType identity --userName ac9fbed5-804c-4362-a369-21a4ec51109e
 ```
 
-Log in to Microsoft 365 using a federated identity. Can currently only be used in GitHub Actions.
+Log in to Microsoft 365 using a federated identity. Can currently only be used in GitHub Actions, Azure DevOps and GitLab CI/CD.
 
 ```sh
 m365 login --authType federatedIdentity --appId eb96cfd0-abfa-4477-8d1d-c6dfde3efb19 --tenant 9a1a1bbd-e158-4cf5-967d-a53b8e85c628

package/docs/docs/cmd/outlook/calendargroup/calendargroup-add.mdx

@@ -0,0 +1,126 @@
+import Global from '../../_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# outlook calendargroup add
+
+Creates a new calendar group for a user.
+
+## Usage
+
+```sh
+m365 outlook calendargroup add [options]
+```
+
+## Options
+
+```md definition-list
+`--userId [userId]`
+: ID of the user. Specify either `userId` or `userName`, but not both.
+
+`--userName [userName]`
+: UPN of the user. Specify either `userId` or `userName`, but not both.
+
+`--name <name>`
+: Name of the calendar group.
+```
+
+<Global />
+
+## Permissions
+
+<Tabs>
+  <TabItem value="Delegated">
+
+  | Resource        | Permissions                            |
+  |-----------------|----------------------------------------|
+  | Microsoft Graph | Calendars.ReadWrite, Calendars.ReadWrite.Shared |
+
+  </TabItem>
+  <TabItem value="Application">
+
+  | Resource        | Permissions          |
+  |-----------------|----------------------|
+  | Microsoft Graph | Calendars.ReadWrite  |
+
+  </TabItem>
+</Tabs>
+
+:::note
+
+When using delegated permissions, specifying `userId` or `userName` for a different user requires the `Calendars.ReadWrite.Shared` scope. When the specified user matches the signed-in user, no shared scope is needed.
+
+:::
+
+## Examples
+
+Create a new calendar group for the current user
+
+```sh
+m365 outlook calendargroup add --name "Personal Events" --userId "@meId"
+```
+
+Create a new calendar group for a user
+
+```sh
+m365 outlook calendargroup add --name "Personal Events" --userId "44288f7d-7710-4293-8c8e-36f310ed2e6a"
+```
+
+Create a new calendar group for a user specified by email
+
+```sh
+m365 outlook calendargroup add --name "Personal Events" --userName "john.doe@contoso.com"
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  {
+    "id": "AQMkAGRlM2Y5YTkzLWI2NzAtNDczOS05YWMyLTJhZGY2MGExMGU0MgBGAAADSG3wPE27kUeySjmT5eRT8QcAfJKVL07sbkmIfHqjbDnRgQAAAgEGAAAAfJKVL07sbkmIfHqjbDnRgQADK5c4ngAAAA==",
+    "name": "My Work Calendars",
+    "classId": "c02d4ddf-4809-485f-9cd4-1ef0937e03be",
+    "changeKey": "fJKVL07sbkmIfHqjbDnRgQADKqwfAA=="
+  }
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  changeKey: fJKVL07sbkmIfHqjbDnRgQADKqwfAA==
+  classId  : c02d4ddf-4809-485f-9cd4-1ef0937e03be
+  id       : AQMkAGRlM2Y5YTkzLWI2NzAtNDczOS05YWMyLTJhZGY2MGExMGU0MgBGAAADSG3wPE27kUeySjmT5eRT8QcAfJKVL07sbkmIfHqjbDnRgQAAAgEGAAAAfJKVL07sbkmIfHqjbDnRgQADK5c4ngAAAA==
+  name     : My Work Calendars
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,name,classId,changeKey
+  AQMkAGRlM2Y5YTkzLWI2NzAtNDczOS05YWMyLTJhZGY2MGExMGU0MgBGAAADSG3wPE27kUeySjmT5eRT8QcAfJKVL07sbkmIfHqjbDnRgQAAAgEGAAAAfJKVL07sbkmIfHqjbDnRgQADK5c4ngAAAA==,My Work Calendars,c02d4ddf-4809-485f-9cd4-1ef0937e03be,fJKVL07sbkmIfHqjbDnRgQADKqwfAA==
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # outlook calendargroup add --debug "false" --verbose "false" --name "My Work Calendars"
+
+  Date: 7/9/2026
+
+  ## My Work Calendars (AQMkAGRlM2Y5YTkzLWI2NzAtNDczOS05YWMyLTJhZGY2MGExMGU0MgBGAAADSG3wPE27kUeySjmT5eRT8QcAfJKVL07sbkmIfHqjbDnRgQAAAgEGAAAAfJKVL07sbkmIfHqjbDnRgQADK5c4ngAAAA==)
+
+  Property | Value
+  ---------|-------
+  id | AQMkAGRlM2Y5YTkzLWI2NzAtNDczOS05YWMyLTJhZGY2MGExMGU0MgBGAAADSG3wPE27kUeySjmT5eRT8QcAfJKVL07sbkmIfHqjbDnRgQAAAgEGAAAAfJKVL07sbkmIfHqjbDnRgQADK5c4ngAAAA==
+  name | My Work Calendars
+  classId | c02d4ddf-4809-485f-9cd4-1ef0937e03be
+  changeKey | fJKVL07sbkmIfHqjbDnRgQADKqwfAA==
+  ```
+
+  </TabItem>
+</Tabs>