Quantum: Add az quantum workspace user create/delete commands

[v-elegacheva]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️quantum

rule	cmd_name	rule_message	suggest_message
⚠️ 1011 - SubgroupAdd	quantum workspace user	sub group quantum workspace user added

Summary

Adds two new commands to manage user access to an Azure Quantum workspace:

• az quantum workspace user create - granted a user, group, or service principal access to a workspace
• az quantum workspace user delete - removes that access

Changes

• Added the quantum workspace user command group with create and delete commands
• "create" assigns the Quantum Workspace Data Contributor role (defualt) at the workspace scope. "delete" removes it (with confirmation)
• Added --assignee, --assignee-object-id , and optional --role override.
• Added help entries with examples and unit + live scenario test coverage.
• Bumped the extension version

Testing

• azdev style and azdev linter pass for the new commands
• Unit test validates the workspace scope construction
• Verified end-to-end against a live workspace

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[a0x1ab]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Not ready to approve

The new live scenario test relies on az ad signed-in-user show (user-login only) and should be made robust for headless/service-principal execution.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds a new az quantum workspace user command group to manage access to Azure Quantum workspaces by creating/removing RBAC role assignments at the workspace scope.

Changes:

• Introduces az quantum workspace user create/delete commands wired to RBAC role assignment create/delete at the workspace resource ID scope.
• Adds a default role constant (Quantum Workspace Data Contributor) with an optional --role override plus new --assignee/--assignee-object-id parameters.
• Updates help text, scenario/unit tests, and bumps the extension version + history.

File summaries

File	Description
src/quantum/setup.py	Bumps the extension version to 1.0.0b20.
src/quantum/HISTORY.rst	Documents the new workspace user commands in release notes.
src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py	Adds a live scenario for user access management plus a unit test for workspace scope construction.
src/quantum/azext_quantum/operations/workspace.py	Implements scope helper and add_user/remove_user operations using RBAC role assignments.
src/quantum/azext_quantum/commands.py	Registers the new quantum workspace user command group and commands.
src/quantum/azext_quantum/_params.py	Adds CLI parameters for assignee/assignee object id and role override on the new commands.
src/quantum/azext_quantum/_help.py	Adds help entries and examples for the new command group and commands.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Not ready to approve

The new user grant/remove operations lack explicit CLI-level validation for --assignee vs --assignee-object-id, and the added live test doesn’t exercise the default role behavior as written.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Comments suppressed due to low confidence (4)

src/quantum/azext_quantum/operations/workspace.py:476

• add_user forwards both assignee and assignee_object_id without validating that exactly one is provided. As written, callers can pass neither (leading to a less actionable downstream error) or both (ambiguous precedence). Add an explicit check to require one and forbid specifying both.

    info = WorkspaceInfo(cmd, resource_group_name, workspace_name)
    scope = _get_workspace_resource_id(info)
    role = role or QUANTUM_WORKSPACE_DATA_CONTRIBUTOR_ROLE_ID
    return create_role_assignment(cmd, role=role, scope=scope, assignee=assignee, assignee_object_id=assignee_object_id)

src/quantum/azext_quantum/operations/workspace.py:488

• remove_user forwards both assignee and assignee_object_id without validating that exactly one is provided. This makes the CLI behavior ambiguous when both are supplied, and error messages less clear when neither is supplied.

    info = WorkspaceInfo(cmd, resource_group_name, workspace_name)
    scope = _get_workspace_resource_id(info)
    role = role or QUANTUM_WORKSPACE_DATA_CONTRIBUTOR_ROLE_ID
    return delete_role_assignments(cmd, role=role, scope=scope, assignee=assignee, assignee_object_id=assignee_object_id)

src/quantum/azext_quantum/_params.py:70

• The --assignee help text has a grammar issue ("Represent" -> "Represents") and implies a single format even though multiple are listed.

    assignee_type = CLIArgumentType(options_list=['--assignee'], help='Represent a user, group, or service principal. Supported format: object id, user sign-in name, or service principal name.')

src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py:309

• This live test passes a --role value that is identical to the command's default role, so it doesn't actually exercise the defaulting behavior described in the PR. Dropping --role here would validate the default role path while keeping the same principalId assertion.

        # grant access using the object id and an explicit role
        self.cmd(f'az quantum workspace user create -g {test_resource_group} --workspace-name {test_workspace_temp} --assignee-object-id {test_object_id} --role c1410b24-3e69-4857-8f86-4d0a2e603250 -o json', checks=[
            self.check("principalId", test_object_id)
        ])

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The new remove_user implementation likely calls delete_role_assignments with the wrong first argument/signature, which can break the delete command at runtime.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Comments suppressed due to low confidence (1)

src/quantum/azext_quantum/_params.py:72

• --role is used by both workspace user create and workspace user delete, but the help text currently only describes assignment. This can confuse users when using delete to remove access.

    role_type = CLIArgumentType(options_list=['--role'], help="Role name or id to assign to the user. Defaults to the 'Quantum Workspace Data Contributor' role.")

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟢 Ready to approve

The changes are cohesive, include validation and test coverage, and only minor maintainability feedback was identified.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Comments suppressed due to low confidence (1)

src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py:316

• The live test hard-codes the built-in Quantum Workspace Data Contributor role GUID in multiple places. This duplicates the source-of-truth constant added in operations/workspace.py and makes the test more brittle if the default role ever changes.

        # grant access using the object id, relying on the default role. Verify the
        # default 'Quantum Workspace Data Contributor' role was assigned.
        self.cmd(f'az quantum workspace user create -g {test_resource_group} --workspace-name {test_workspace_temp} --assignee-object-id {test_object_id} -o json', checks=[
            self.check("principalId", test_object_id),
            self.check("ends_with(roleDefinitionId, 'c1410b24-3e69-4857-8f86-4d0a2e603250')", True)

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[yonzhan]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).