fix(azure-prepare): ban conditional `administratorLoginPassword` pattern in SQL Server Bicep by Copilot · Pull Request #1763 · microsoft/GitHub-Copilot-for-Azure

Copilot · 2026-04-07T21:38:05Z

The agent was generating Entra-only SQL auth via a conditional ternary, leaving administratorLoginPassword textually present in the Bicep file even when the condition evaluated away — failing the integration test that checks for its absence anywhere in the file.

Prohibited pattern (was being generated):

properties: useEntraAuth ? {
  administrators: { azureADOnlyAuthentication: true ... }
} : {
  administratorLogin: sqlAdminLogin
  administratorLoginPassword: sqlAdminPassword  // ❌ text present → test fails
}

Changes:

SKILL.md — Added rule GitHub Copilot for Azure can't finish Azure account login process #10 explicitly prohibiting administratorLogin/administratorLoginPassword in any position: direct properties, ternary branches, or conditional expressions. Bumped version 1.1.8 → 1.1.9.
references/services/sql-database/bicep.md — Added top-of-file ⛔ CRITICAL callout; expanded "Legacy SQL Authentication" section to explicitly show the conditional ternary pattern as banned, with a "no fallback, no toggle, no conditional" directive.
references/services/sql-database/auth.md — Strengthened legacy auth section to cover conditional/optional constructs, not just direct usage.
references/generate.md — Updated Security Requirements bullet to call out the conditional-branch prohibition.
references/security.md — Updated checklist item to say "NEVER… including inside conditional branches".

…atorLoginPassword pattern Agent-Logs-Url: https://github.com/microsoft/GitHub-Copilot-for-Azure/sessions/ebd0795c-9873-46df-9e7d-e707c34ae65b Co-authored-by: fanyang-mono <52458914+fanyang-mono@users.noreply.github.com>

github-actions · 2026-04-07T22:30:43Z

Details

# 🔍 Token Analysis Report

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts compare --base origin/main --head HEAD --markdown

📊 Token Change Report

Comparing origin/main → HEAD

Summary

Metric	Value
📈 Total Change	+460 tokens (+6%)
Before	8,034 tokens
After	8,494 tokens
Files Changed	5

Changed Files

File	Before	After	Change
`plugin/skills/azure-prepare/references/services/sql-database/bicep.md`	1,226	1,500	+274 (+22%)
`plugin/skills/azure-prepare/SKILL.md`	2,767	2,859	+92 (+3%)
`plugin/skills/azure-prepare/references/services/sql-database/auth.md`	732	782	+50 (+7%)
`plugin/skills/azure-prepare/references/generate.md`	1,176	1,206	+30 (+3%)
`plugin/skills/azure-prepare/references/security.md`	2,133	2,147	+14 (+1%)

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts check --markdown

📊 Token Limit Check Report

Checked: 543 files
Exceeded: 74 files

⚠️ Files Exceeding Token Limits

File	Tokens	Limit	Over By
`.github/skills/analyze-test-run/SKILL.md`	2471	500	+1971
`.github/skills/file-test-bug/SKILL.md`	628	500	+128
`.github/skills/sensei/README.md`	3531	2000	+1531
`.github/skills/sensei/SKILL.md`	3026	500	+2526
`.github/skills/sensei/references/EXAMPLES.md`	3701	2000	+1701
`.github/skills/sensei/references/LOOP.md`	4181	2000	+2181
`.github/skills/sensei/references/SCORING.md`	4200	2000	+2200
`.github/skills/skill-authoring/SKILL.md`	839	500	+339
`plugin/skills/appinsights-instrumentation/SKILL.md`	908	500	+408
`plugin/skills/azure-ai/SKILL.md`	817	500	+317
`plugin/skills/azure-aigateway/SKILL.md`	1258	500	+758
`plugin/skills/azure-aigateway/references/policies.md`	2342	2000	+342
`plugin/skills/azure-cloud-migrate/references/services/functions/lambda-to-functions.md`	2600	2000	+600
`plugin/skills/azure-cloud-migrate/references/services/functions/runtimes/javascript.md`	2181	2000	+181
`plugin/skills/azure-compliance/SKILL.md`	1185	500	+685
`plugin/skills/azure-compute/SKILL.md`	755	500	+255
`plugin/skills/azure-compute/workflows/vm-recommender/vm-recommender.md`	2393	2000	+393
`plugin/skills/azure-cost/SKILL.md`	1861	500	+1361
`plugin/skills/azure-deploy/SKILL.md`	1643	500	+1143
`plugin/skills/azure-deploy/references/pre-deploy-checklist.md`	2204	2000	+204
`plugin/skills/azure-deploy/references/recipes/azd/errors.md`	3429	2000	+1429
`plugin/skills/azure-deploy/references/troubleshooting.md`	2038	2000	+38
`plugin/skills/azure-diagnostics/SKILL.md`	1132	500	+632
`plugin/skills/azure-diagnostics/aks-troubleshooting/networking.md`	2147	2000	+147
`plugin/skills/azure-diagnostics/aks-troubleshooting/node-issues.md`	2003	2000	+3
`plugin/skills/azure-enterprise-infra-planner/SKILL.md`	999	500	+499
`plugin/skills/azure-enterprise-infra-planner/references/constraints/compute-apps.md`	2022	2000	+22
`plugin/skills/azure-hosted-copilot-sdk/SKILL.md`	1260	500	+760
`plugin/skills/azure-kubernetes/SKILL.md`	2266	500	+1766
`plugin/skills/azure-kusto/SKILL.md`	2149	500	+1649
`plugin/skills/azure-messaging/SKILL.md`	967	500	+467
`plugin/skills/azure-prepare/SKILL.md`	2859	500	+2359
`plugin/skills/azure-prepare/references/aspire.md`	4003	2000	+2003
`plugin/skills/azure-prepare/references/plan-template.md`	2559	2000	+559
`plugin/skills/azure-prepare/references/recipes/azd/aspire.md`	3069	2000	+1069
`plugin/skills/azure-prepare/references/recipes/azd/terraform.md`	3012	2000	+1012
`plugin/skills/azure-prepare/references/research.md`	2217	2000	+217
`plugin/skills/azure-prepare/references/resources-limits-quotas.md`	3322	2000	+1322
`plugin/skills/azure-prepare/references/security.md`	2147	2000	+147
`plugin/skills/azure-prepare/references/services/functions/bicep.md`	3065	2000	+1065
`plugin/skills/azure-prepare/references/services/functions/templates/SPEC-composable-templates.md`	6187	2000	+4187
`plugin/skills/azure-prepare/references/services/functions/templates/recipes/composition.md`	4649	2000	+2649
`plugin/skills/azure-prepare/references/services/functions/terraform.md`	3358	2000	+1358
`plugin/skills/azure-quotas/SKILL.md`	3445	500	+2945
`plugin/skills/azure-quotas/references/commands.md`	2644	2000	+644
`plugin/skills/azure-resource-lookup/SKILL.md`	1288	500	+788
`plugin/skills/azure-resource-visualizer/SKILL.md`	2054	500	+1554
`plugin/skills/azure-storage/SKILL.md`	1180	500	+680
`plugin/skills/azure-upgrade/SKILL.md`	1001	500	+501
`plugin/skills/azure-upgrade/references/services/functions/automation.md`	3463	2000	+1463
`plugin/skills/azure-upgrade/references/services/functions/consumption-to-flex.md`	2773	2000	+773
`plugin/skills/azure-validate/SKILL.md`	906	500	+406
`plugin/skills/entra-app-registration/SKILL.md`	2067	500	+1567
`plugin/skills/entra-app-registration/references/api-permissions.md`	2545	2000	+545
`plugin/skills/entra-app-registration/references/cli-commands.md`	2211	2000	+211
`plugin/skills/entra-app-registration/references/console-app-example.md`	2752	2000	+752
`plugin/skills/entra-app-registration/references/oauth-flows.md`	2375	2000	+375
`plugin/skills/microsoft-foundry/SKILL.md`	2870	500	+2370
`plugin/skills/microsoft-foundry/foundry-agent/create/create.md`	3016	2000	+1016
`plugin/skills/microsoft-foundry/foundry-agent/deploy/deploy.md`	5555	2000	+3555
`plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/eval-datasets.md`	2342	2000	+342
`plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/references/trace-to-dataset.md`	4268	2000	+2268
`plugin/skills/microsoft-foundry/foundry-agent/observe/observe.md`	2547	2000	+547
`plugin/skills/microsoft-foundry/foundry-agent/trace/references/kql-templates.md`	2701	2000	+701
`plugin/skills/microsoft-foundry/foundry-agent/troubleshoot/troubleshoot.md`	2164	2000	+164
`plugin/skills/microsoft-foundry/models/deploy-model/SKILL.md`	1640	500	+1140
`plugin/skills/microsoft-foundry/models/deploy-model/capacity/SKILL.md`	1739	500	+1239
`plugin/skills/microsoft-foundry/models/deploy-model/customize/SKILL.md`	2235	500	+1735
`plugin/skills/microsoft-foundry/models/deploy-model/customize/references/customize-workflow.md`	3335	2000	+1335
`plugin/skills/microsoft-foundry/models/deploy-model/preset/SKILL.md`	1226	500	+726
`plugin/skills/microsoft-foundry/models/deploy-model/preset/references/preset-workflow.md`	5534	2000	+3534
`plugin/skills/microsoft-foundry/quota/quota.md`	2288	2000	+288
`plugin/skills/microsoft-foundry/quota/references/capacity-planning.md`	2080	2000	+80
`plugin/skills/microsoft-foundry/references/sdk/foundry-sdk-py.md`	2162	2000	+162

Consider moving content to references/ subdirectories.

Automated token analysis. See skill authoring guidelines for best practices.

Copilot

Pull request overview

Updates the azure-prepare skill guidance to prevent generating SQL Server Bicep that textually contains administratorLogin / administratorLoginPassword (including inside conditional/ternary branches), aligning generated output with repo validation expectations.

Changes:

Explicitly bans administratorLogin / administratorLoginPassword anywhere in SQL Server Bicep guidance (including conditional constructs).
Strengthens SQL Database reference docs with a critical callout and a concrete “banned ternary” example.
Propagates the prohibition across security and generation reference checklists.

Show a summary per file

File	Description
plugin/skills/azure-prepare/SKILL.md	Adds an explicit rule prohibiting `administratorLogin*` tokens anywhere in SQL Server Bicep; bumps skill version.
plugin/skills/azure-prepare/references/services/sql-database/bicep.md	Adds a critical warning and expands the legacy auth section with an explicitly banned conditional example.
plugin/skills/azure-prepare/references/services/sql-database/auth.md	Clarifies that legacy auth (SQL user/password + admin login props) is prohibited even conditionally.
plugin/skills/azure-prepare/references/security.md	Updates security checklist wording to prohibit conditional-branch usage.
plugin/skills/azure-prepare/references/generate.md	Updates generation security requirements to ban conditional/ternary inclusion of the properties.

Copilot's findings

Files reviewed: 5/5 changed files
Comments generated: 2

plugin/skills/azure-prepare/references/services/sql-database/bicep.md

…icep.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Updates azure-prepare skill guidance to prevent generation of SQL Server Bicep that textually contains administratorLogin / administratorLoginPassword (including inside conditional/ternary branches), aligning with Entra-only auth requirements and avoiding integration test failures.

Changes:

Adds an explicit azure-prepare rule prohibiting administratorLogin / administratorLoginPassword anywhere in generated SQL Server Bicep, including conditional branches.
Strengthens SQL Database Bicep/auth reference docs with “no fallback / no toggle / no conditional” guidance and an explicit banned ternary example.
Updates security/generation checklists to reiterate the unconditional ban (including conditional branches) and require Entra-only auth.

Show a summary per file

File	Description
plugin/skills/azure-prepare/SKILL.md	Adds rule #10 explicitly banning SQL admin properties anywhere in SQL Server Bicep; version bumped to 1.1.9.
plugin/skills/azure-prepare/references/services/sql-database/bicep.md	Adds critical top-of-file warning and expands legacy auth section with an explicit banned conditional example.
plugin/skills/azure-prepare/references/services/sql-database/auth.md	Strengthens legacy auth prohibition to cover conditional/optional constructs and links it to Bicep generation.
plugin/skills/azure-prepare/references/security.md	Updates security checklist to emphasize “never anywhere,” including conditional branches.
plugin/skills/azure-prepare/references/generate.md	Updates security requirements to explicitly ban presence of SQL admin property names even in conditional branches.

Copilot's findings

Files reviewed: 5/5 changed files
Comments generated: 0 new

Initial plan

033d214

Copilot AI assigned Copilot and fanyang-mono Apr 7, 2026

Copilot started work on behalf of fanyang-mono April 7, 2026 21:38 View session

Copilot AI linked an issue Apr 7, 2026 that may be closed by this pull request

Integration test failure: azure-prepare – ASP.NET Core EF Core SQL auth [Assertion mismatch] #1723

Open

Copilot AI changed the title ~~[WIP] Fix integration test failure for azure-prepare SQL auth~~ fix(azure-prepare): ban conditional administratorLoginPassword pattern in SQL Server Bicep Apr 7, 2026

Copilot finished work on behalf of fanyang-mono April 7, 2026 21:42

Copilot AI requested a review from fanyang-mono April 7, 2026 21:42

Merge branch 'main' into copilot/fix-azure-prepare-integration-test

7e6aeab

fanyang-mono marked this pull request as ready for review April 7, 2026 22:29

fanyang-mono requested review from kvenkatrajan, tmeschter and wbreza as code owners April 7, 2026 22:29

Copilot AI review requested due to automatic review settings April 7, 2026 22:29

fanyang-mono approved these changes Apr 7, 2026

View reviewed changes

Copilot started reviewing on behalf of fanyang-mono April 7, 2026 22:30 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

plugin/skills/azure-prepare/references/services/sql-database/bicep.md Show resolved Hide resolved

plugin/skills/azure-prepare/references/services/sql-database/bicep.md Outdated Show resolved Hide resolved

Update plugin/skills/azure-prepare/references/services/sql-database/b…

e23d377

…icep.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 7, 2026 23:10

Copilot started reviewing on behalf of fanyang-mono April 7, 2026 23:11 View session

Update version to 1.1.10 in SKILL.md

ffc83b0

Copilot AI reviewed Apr 7, 2026

View reviewed changes

Update snapshot

99155f1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(azure-prepare): ban conditional `administratorLoginPassword` pattern in SQL Server Bicep#1763

fix(azure-prepare): ban conditional `administratorLoginPassword` pattern in SQL Server Bicep#1763
Copilot wants to merge 6 commits intomainfrom
copilot/fix-azure-prepare-integration-test

Copilot AI commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 7, 2026 •

edited

Loading

📊 Token Change Report

Summary

Changed Files

📊 Token Limit Check Report

⚠️ Files Exceeding Token Limits

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Token Change Report

Summary

Changed Files

📊 Token Limit Check Report

⚠️ Files Exceeding Token Limits

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 7, 2026 •

edited

Loading

github-actions bot commented Apr 7, 2026 •

edited

Loading