[Ramses Sanchez-Hernandez (ramsessanchez)]

No linked issue.

Changes proposed in this pull request

• Migrate only the three shared directives in src/DeviceManagement.Enrollment/DeviceManagement.Enrollment.md to the v3 shared cmdlet configuration. Preserve the active original directives, existing derived names, neighboring CRUD, and owned Autopilot actions. Both v1.0 and beta are required; neither is excluded. Ignore src/readme.graph.md and every profile-local readme. Parameter aliases/transforms and schema/response directives remain deferred; none occur in this shared file. Do not resurrect the excluded Actions module or introduce a naming/collision policy.
• Preserve the finite required-path ID alignment from normally merged Align operation IDs for required shared directive paths #3847: original/current literal selector sets are 0/0 in v1.0 and 11/11 in beta, including the three actual inherited assignedPrincipals functions. All three ordinary inventory mappings pass. No rejected Legacy bridge fields or global helper copies remain. Suppress five analytics CRUD operations, three inherited functions, three inherited counts, the Autopilot item PATCH, and the separate analytics count; retain inherited navigation CRUD and direct role-definition functions. Tests retain the finite historical function-path audit, not a generic integration stage.
• Preserve all prior source and separate combined client/cmdlet generation commits, with Copilot App coauthors. The latest bounded refresh normally integrates Sync current v2 Authentication into powershell-v3 #3891 and regenerates both profiles against its adapted Authentication package; it does not change module source/configuration/test semantics, specs, or frozen limitations. Existing Beta directory casing remains intact. No rebase, squash, force-push, unmerged overlay, or PR merge was performed.

Current normal Authentication refresh — build/source gates pass; a real runtime gate remains FAILED.

Normal target: 844672d7c2238f6b29a208f9ba73fe28e9e29cef (#3891), integrated by bba5fae4c2d9e5b26659a740b836968e3072513b. Canonical refreshed head: 78241367308920073d6a0d6c8589c9eaedd71fdd. Existing PR state was left unchanged; this is not an all-runtime-pass or approval claim.

Reproduced blocker matching #3886: the actual compiled Update-MgDeviceManagementConditionalAccessSetting sends typed PATCH JSON, receives 204, and re-fetches a typed result, but the follow-up GET drops the caller's bound generic Headers (x-offline-marker and Prefer). PATCH retains both headers. The gate fails on v1.0 and beta, in Global and USGov: four actual FAIL results / exit 1, preserved with raw captures. No unmerged fix, route suppression, or success fallback was applied. Normal Authentication closes the prior RMS serialization/closure gap; it does not fix this separate refetch-header defect.

Current profile	Separate combined generation commit	Full queued Release result	Fresh normal exports
v1.0	46778b96bb	Exit 0, status OK, 53.4 seconds	38
beta	7824136730	Exit 0, status OK, 63.9 seconds	374

Each full run regenerated Kiota client, cmdlets, projects, locks and the normal build manifest after final authored changes. Kiota client sources/locks remain byte-identical; emitted adapter calls now explicitly carry v1.0/beta, and projects prune the complete dependency closure. Generation commits contain 35/334 changed profile files respectively; no bin/obj, binaries or evidence logs are committed. No additional own source/test correction was needed. Final manifests require Authentication 2.41.2, have no RequiredAssemblies preloads, and wrapper bins contain exactly their three owned DLLs. Authentication alone supplies RMS/UriTemplate/Multipart/Kiota.

Unchanged compatible spec Git blobs

Profile	Git blob
v1.0	e9cde3860c4d6be4cc2aa2ddb02830f0865a3edd
beta	7a9b70f01dbfc02a3875149273e2d0835f60cdf3

Current acceptance environment

PowerShell 7.6.9/Core only; PowerShell 5.1 remains explicitly unsupported/out of scope. Isolated Kiota 1.36.1+fd3bf87790149b87f40f7eae1a5feb9016625943 with KIOTA_Generation__MaxDegreeOfParallelism=1. Process-local PATH starts with C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\tools\kiota.

The first process-local PSModulePath entry is the normally packaged locally built adapted Authentication 2.41.2, not a stock Gallery package or old 2.38 acceptance module:
C:\Users\ramsess\.copilot\session-state\4aa86cf9-d43c-4d2b-a4a3-aeaed01b8f29\files\authentication-v2-sync\final-source\modules.
It is followed by C:\Users\ramsess\OneDrive - Microsoft\Documents\PowerShell\Modules, C:\Program Files\PowerShell\Modules, and C:\Program Files\PowerShell\7\Modules. Fresh normal imports assert the exact adapted root and version. All 64 original file SHA256s are checked before/after transport validation. Original package SHA256: 2FC09BFE6B70D313BC56DF8ADCCFB1976FB4E90A1898BF8A916B4B8B792898EB. No DLL injection, Authentication shim, global environment edit, or alternate package is used.

Exact current validation commands and results

Here $root is the new retained evidence directory (old evidence is untouched):
C:\Users\ramsess\.copilot\session-state\f80169c8-2e6f-4478-bb8e-8ca70a2294c5\files\enrollment-auth-844672.

Full builds ran sequentially v1.0 then beta, in the process-local environment above:

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot (Get-Location).Path -Module DeviceManagement.Enrollment -ApiVersion v1.0 -Configuration Release
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot (Get-Location).Path -Module DeviceManagement.Enrollment -ApiVersion beta -Configuration Release

Both passed exit 0/status OK with the counts/times above. The unchanged four-mutex queue invokes the full Build-WrapperModule.ps1 with compatible specs. No SkipKiota, GenerateOnly, NoCollisionData, legacy spec fallback or NO-CMDLETS substitution was used.

pwsh -NoProfile -NonInteractive -File .\tools\Get-WrapperDirectiveMigrationInventory.ps1 -Module DeviceManagement.Enrollment -FailOnUnresolved -AsJson
dotnet test .\tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --filter 'FullyQualifiedName~DeviceManagementEnrollmentDirectiveMigrationTests|FullyQualifiedName~CmdletConfiguratorTests|FullyQualifiedName~NamingTests' --nologo --verbosity quiet --logger 'trx;LogFileName=targeted.trx' --results-directory $root
pwsh -NoProfile -NonInteractive -File .\tools\Test-WrapperDirectiveMigrationInventory.ps1

Results: ordinary strict inventory 3/3 Mapped, exit 0; combined tests 96/96 executed/passed, including 12 module cases, with nonzero raw TRX counters. Inventory framework regression passed on an isolated rerun after generation stopped writing the worktree. Its original concurrent-generation worktree-stability assertion failure is retained, not relabeled.

pwsh -NoProfile -NonInteractive -File "$root\Test-EnrollmentAuthentication.ps1" -Profile v1.0 -Environment Global
pwsh -NoProfile -NonInteractive -File "$root\Test-EnrollmentAuthentication.ps1" -Profile beta -Environment Global
pwsh -NoProfile -NonInteractive -File "$root\Test-EnrollmentAuthentication.ps1" -Profile v1.0 -Environment USGov
pwsh -NoProfile -NonInteractive -File "$root\Test-EnrollmentAuthentication.ps1" -Profile beta -Environment USGov

Each actual runtime run reports 11 PASS / 1 FAIL (exit 1): total 44 PASS / 4 FAIL, all four failures being the reproduced #3886 header loss. Each uses a real Connect-MgGraph session, the existing in-memory MockDataStore, the real authenticated GraphHttpClientFactory pipeline, and an offline terminal handler. Each captures 14 requests, five genuine declined-confirmation prompts, and zero live Graph/OAuth requests. No marker-only bare client substitutes for the real factory.

Passing current checks include fresh normal-manifest imports with 38/374 exports; every prior compiled route retained; all 1/13 reviewed suppressed routes absent; preserved owned actions/neighbors/client-only alias limits; GET List default, query binding, typed results and generic request headers; invalid parameter-set binding rejected before HTTP; typed POST JSON and result through Authentication-owned RMS; typed PATCH body/204/typed GET result (header assertion separately FAILS); bodyless DELETE with If-Match/Headers; typed parameterized and bodyless actions. WhatIf and genuine declined Confirm each send zero HTTP, exactly one prompt per declined representative mutation. Real generated beta requests use /beta, including USGov host routing, despite factory HttpClient.BaseAddress starting at global /v1.0/. Alternating profile adapters, cache reuse/invalidation and client timeout checks preserve the shared HttpClient/BaseAddress. Actual assembly source/context captures prove a single Authentication/Kiota closure from the adapted module. No blanket mutation-serialization success is inferred from WhatIf.

Actual compatible DELETE scope audit: 5 v1.0 and 48 beta operations; no DELETE query parameters, path-level parameter blocks or parameter references. The required ordinary DELETE-query gap tracked in #3882 is therefore not applicable to these owned specs; no query route was removed or fabricated to avoid it.

pwsh -NoProfile -NonInteractive -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\DeviceManagement.Enrollment\wrapper\v1.0\Cmdlets -OutLedger "$root\v1-parity.csv"
pwsh -NoProfile -NonInteractive -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\DeviceManagement.Enrollment\wrapper\Beta\Cmdlets -OutLedger "$root\beta-parity.csv"

Current raw parity: v1.0 passed 38/38, exit 0; beta failed 0/374, exit 1, retaining 368 pre-existing naming mismatches (263 prefix-only, 105 additional) plus six restore routes missing from the frozen oracle. No beta-prefix normalization or naming sweep is used to claim a pass.

Current $root contains raw logs/exits/TRX, all64 original Authentication/package hashes, source/spec/tool/manifest/assembly hashes, four actual runtime reports, HTTP captures, load contexts, explicit refetch-header failure matrix, DELETE scope audit, prior/live PR snapshots and canonical commit boundaries. Initial session-harness null-key assertion failures are retained; only that artifact assertion was corrected, not module/framework source. No wrapper nupkg build is claimed: these are normal generated-manifest imports and three-DLL bin outputs; Authentication package provenance is verified separately.

Preserved historical acceptance (not current Authentication proof)

Prior target #3847 604bd968 was normally integrated at d3de5e216d; source correction a71b863343 removed rejected bridge declarations. Initial migration 280914c952, prior v1.0 boundary ba27e4342a (honest empty byte-identical generation), and beta boundary 32768e77ec (aligned-spec lock only) remain intact. Those prior Authentication 2.38.1 full builds exported 38/374 in 31.9/33.8 seconds and had all three strict mappings / 96 tests passing. Their limited compiled/WhatIf checks did not claim actual mutation serialization or current 2.41.2 runtime success. Original raw proof remains under C:\Users\ramsess\.copilot\session-state\f80169c8-2e6f-4478-bb8e-8ca70a2294c5\files\enrollment-final-604bd968, unchanged.

Frozen/out-of-scope limitations: three direct role-definition assignedPrincipals functions remain unsuppressed but client-only because the emitter does not support OData parameter aliases; the three inherited functions are explicitly suppressed by shared directive intent. No live Graph calls, Desktop compatibility work, new capability/schema/naming policy, or unmerged #3881/#3882/#3886 overlay is included. Existing YamlReader 3.7.0 NU1903 warnings and verbatim Kiota-generated comment whitespace remain outside this scoped refresh. The actual #3886 runtime header failure is an outstanding framework limitation, not waived by passing builds/source tests.

Other links

• Sync current v2 Authentication into powershell-v3 #3891: normally merged Authentication 2.41.2 packaging/loader and profile-aware runtime generation; Align operation IDs for required shared directive paths #3847 and Support compatible natural-ID operation variants #3849: already normally integrated finite ID alignment and natural PATH-ID framework.
• Preserve generic headers on PATCH refetch requests #3886: actual remaining selected-PATCH 204 refetch generic-header loss reproduced by this PR's refreshed normal runtime; no fix copied. Support mandatory Query-prefixed parameters for required queries #3882 DELETE-query scope audited as not applicable here.
• Shared source, ordinary reviewed ledger, and tests: src/DeviceManagement.Enrollment/DeviceManagement.Enrollment.md, src/DeviceManagement.Enrollment/wrapper/DeviceManagement.Enrollment_directiveMigrationMap.json, and tools/WrapperGenerator.Tests/DeviceManagementEnrollmentDirectiveMigrationTests.cs.