From e6967a235bad5aac93a93ecd84cab838cafef740 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Thu, 13 Aug 2026 15:57:36 -0700
Subject: [PATCH 01/15] Route generation module installs through the private
 CFS feed (PowerShell Gallery follow-up)

Phase 2 of the PowerShell CFSClean remediation: eliminate the CFSClean2-tier egress to
www.powershellgallery.com / cdn.powershellgallery.com in the generation pipelines (187/221/663) by
routing every generation-time Install-Module/Find-Module through the private Azure Artifacts feed
PowerShell_V2_Build, which already has a PowerShell Gallery upstream (so it serves both the
internally published Graph modules and public tooling modules).

Mechanism:
- Expose $(System.AccessToken) as a process-wide SYSTEM_ACCESSTOKEN variable in weekly-generation.yml,
  command-metadata-refresh.yml and ci-build.yml, so credentials are available to every step and to
  the ForEach-Object -Parallel runspaces used by GenerateModules.ps1.
- install-tools.yml: new "Register private module feed" step registers PowerShell_V2_Build as a
  Trusted PSRepository (persisted for the job).
- tools/Get-CfsFeedCredential.ps1: shared helper (Get-CfsFeedName / Get-CfsFeedCredential /
  Register-CfsFeed) that builds a PSCredential from SYSTEM_ACCESSTOKEN; returns $null locally so
  behaviour is unchanged off-CI.
- Repoint sources from PSGallery to PowerShell_V2_Build and inject the credential via
  $PSDefaultParameterValues (runspace-local, so it works inside the parallel generation):
  ValidateUpdatedModuleVersion, GenerateRollUpModule, GenerateMetaModule,
  GenerateAuthenticationModule, BuildModule, Versions/BumpModuleVersion, plus the ad-hoc tooling
  installs (PlatyPS, Pester, powershell-yaml, PowerHTML) in GenerateHelp/TestModule/ImportExamples/
  UpdateOpenApi.

DRAFT: requires CI validation. Open questions to confirm in a pipeline run:
- ValidateUpdatedModuleVersion's version gate now queries the private feed (with PSGallery upstream)
  instead of public PSGallery directly; confirm the published-version comparison still behaves as
  intended (the upstream proxies public versions, but the feed may also expose internally published
  versions).
- Confirm www.powershellgallery.com / cdn.powershellgallery.com drop to 0 in the generation jobs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
---
 .azure-pipelines/ci-build.yml                 |  3 ++
 .azure-pipelines/command-metadata-refresh.yml |  3 ++
 .../common-templates/install-tools.yml        | 15 +++++++
 .azure-pipelines/weekly-generation.yml        |  3 ++
 tools/BuildModule.ps1                         |  6 ++-
 tools/GenerateAuthenticationModule.ps1        |  2 +-
 tools/GenerateHelp.ps1                        |  6 ++-
 tools/GenerateMetaModule.ps1                  |  2 +-
 tools/GenerateRollUpModule.ps1                | 10 ++++-
 tools/Get-CfsFeedCredential.ps1               | 41 +++++++++++++++++++
 tools/ImportExamples.ps1                      |  8 +++-
 tools/TestModule.ps1                          |  6 ++-
 tools/UpdateOpenApi.ps1                       |  7 +++-
 tools/ValidateUpdatedModuleVersion.ps1        | 11 ++++-
 tools/Versions/BumpModuleVersion.ps1          |  7 +++-
 15 files changed, 118 insertions(+), 12 deletions(-)
 create mode 100644 tools/Get-CfsFeedCredential.ps1

diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml
index 835d60c9fd7..a3077918519 100644
--- a/.azure-pipelines/ci-build.yml
+++ b/.azure-pipelines/ci-build.yml
@@ -31,6 +31,9 @@ variables:
   REGISTRY: 'msgraphprodregistry.azurecr.io'
   REGISTRY_NAME: 'msgraphprodregistry'
   IMAGE_NAME: 'public/microsoftgraph/powershell'
+  # Expose the build identity's token as a process-wide env var so generation scripts (including
+  # ForEach-Object -Parallel runspaces) can authenticate to the private CFS module feed. (CFSClean)
+  SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 
 trigger:
   branches:
diff --git a/.azure-pipelines/command-metadata-refresh.yml b/.azure-pipelines/command-metadata-refresh.yml
index 801e7ebd72b..68b47ade3de 100644
--- a/.azure-pipelines/command-metadata-refresh.yml
+++ b/.azure-pipelines/command-metadata-refresh.yml
@@ -31,6 +31,9 @@ variables:
   BuildAgent: ${{ parameters.BuildAgent }}
   Branch: "ModuleCommandMetadataRefresh"
   BaseBranch: ${{ parameters.BaseBranch }}
+  # Expose the build identity's token as a process-wide env var so generation scripts (including
+  # ForEach-Object -Parallel runspaces) can authenticate to the private CFS module feed. (CFSClean)
+  SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 
 trigger:
   branches:
diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 0b64943de14..d26de8160cc 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -61,6 +61,21 @@ steps:
         Copy-Item -Path $src -Destination $dst -Force
         Write-Host "Copied npm config to $dst"
 
+  - task: PowerShell@2
+    displayName: Register private module feed (CFSClean)
+    inputs:
+      targetType: inline
+      pwsh: true
+      script: |
+        # Register the private Azure Artifacts feed (PowerShell Gallery upstream) as a Trusted
+        # PSRepository so generation-time Install-Module/Find-Module resolve through it instead of
+        # the public PowerShell Gallery. Persisted for the job (visible to later steps + runspaces).
+        . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
+        Register-CfsFeed
+        Get-PSRepository -Name PowerShell_V2_Build | Format-List Name, SourceLocation, InstallationPolicy, Trusted
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+
   - task: Npm@1
     displayName: Install AutoRest
     inputs:
diff --git a/.azure-pipelines/weekly-generation.yml b/.azure-pipelines/weekly-generation.yml
index 6be0893c0c6..5cf86adc267 100644
--- a/.azure-pipelines/weekly-generation.yml
+++ b/.azure-pipelines/weekly-generation.yml
@@ -42,6 +42,9 @@ parameters:
 variables:
   BaseBranch: ${{ parameters.BaseBranch }}
   BuildAgent: ${{ parameters.BuildAgent }}
+  # Expose the build identity's token as a process-wide env var so generation scripts (including
+  # ForEach-Object -Parallel runspaces) can authenticate to the private CFS module feed. (CFSClean)
+  SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 trigger: none
 pr: none
 schedules:
diff --git a/tools/BuildModule.ps1 b/tools/BuildModule.ps1
index e6485f5dfd4..3ba051e5e82 100644
--- a/tools/BuildModule.ps1
+++ b/tools/BuildModule.ps1
@@ -66,7 +66,11 @@ if ($ModuleFullName -ne "Microsoft.Graph.Authentication") {
 }
 
 # Lock module GUID. See https://github.com/Azure/autorest.powershell/issues/981.
-$ExistingModule = Find-Module $ModuleFullName -Repository PSGallery -ErrorAction SilentlyContinue
+# CFSClean: authenticate module queries to the private feed (credential from the build token).
+. (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Find-Module:Credential'] = $__cfsCred }
+$ExistingModule = Find-Module $ModuleFullName -Repository (Get-CfsFeedName) -ErrorAction SilentlyContinue
 $ModuleGuid = ($null -eq $ExistingModule) ? (New-Guid).Guid : $ExistingModule.AdditionalMetadata.GUID
 
 [HashTable]$ModuleManifestSettings = @{
diff --git a/tools/GenerateAuthenticationModule.ps1 b/tools/GenerateAuthenticationModule.ps1
index 6d71c22f35d..18939a6ff0c 100644
--- a/tools/GenerateAuthenticationModule.ps1
+++ b/tools/GenerateAuthenticationModule.ps1
@@ -2,7 +2,7 @@
 # Licensed under the MIT License.
 [CmdletBinding()]
 Param(
-  [string] $RepositoryName = "PSGallery",
+  [string] $RepositoryName = "PowerShell_V2_Build",
   [string] $RepositoryApiKey,
   [string] $ArtifactsLocation = (Join-Path $PSScriptRoot "..\artifacts\"),
   [switch] $Build,
diff --git a/tools/GenerateHelp.ps1 b/tools/GenerateHelp.ps1
index 24750d984f1..1138a96912d 100644
--- a/tools/GenerateHelp.ps1
+++ b/tools/GenerateHelp.ps1
@@ -7,8 +7,12 @@ Param(
     [string] $ModuleMappingConfigPath = (Join-Path $PSScriptRoot "..\config\ModulesMapping.jsonc")
 )
 # Install PlatyPS
+# CFSClean: install tooling modules from the private feed (PowerShell Gallery upstream).
+. (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Install-Module:Credential'] = $__cfsCred }
 if (!(Get-Module -Name PlatyPS -ListAvailable)) {
-    Install-Module PlatyPS -Force
+    Install-Module PlatyPS -Repository (Get-CfsFeedName) -Force
 }
 Import-Module PlatyPS -Force -Scope Global
 
diff --git a/tools/GenerateMetaModule.ps1 b/tools/GenerateMetaModule.ps1
index a921fb8cb25..1419db24f47 100644
--- a/tools/GenerateMetaModule.ps1
+++ b/tools/GenerateMetaModule.ps1
@@ -6,7 +6,7 @@ Param(
     [ValidateSet("v1.0", "beta")]
     $ApiVersion = @("v1.0", "beta"),
     [string] $RepositoryApiKey,
-    [string] $RepositoryName = "PSGallery",
+    [string] $RepositoryName = "PowerShell_V2_Build",
     [string] $ArtifactsLocation = (Join-Path $PSScriptRoot "..\artifacts\"),
     [switch] $Pack,
     [switch] $Publish,
diff --git a/tools/GenerateRollUpModule.ps1 b/tools/GenerateRollUpModule.ps1
index 25e779bdf6b..7a76433b230 100644
--- a/tools/GenerateRollUpModule.ps1
+++ b/tools/GenerateRollUpModule.ps1
@@ -4,7 +4,7 @@
 [CmdletBinding()]
 Param(
     [string] $RepositoryApiKey,
-    [string] $RepositoryName = "PSGallery",
+    [string] $RepositoryName = "PowerShell_V2_Build",
     [string] $ArtifactsLocation = (Join-Path $PSScriptRoot "..\artifacts\"),
     [string] $ModuleMappingConfigPath = (Join-Path $PSScriptRoot "..\config\ModulesMapping.jsonc"),
     [int] $ModulePreviewNumber = -1,
@@ -19,6 +19,14 @@ enum VersionState {
 }
 $ErrorActionPreference = 'Stop'
 $LASTEXITCODE = $null
+# CFSClean: authenticate module installs/queries to the private feed (credential from the build token).
+. (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) {
+    $PSDefaultParameterValues['Find-Module:Credential']    = $__cfsCred
+    $PSDefaultParameterValues['Install-Module:Credential'] = $__cfsCred
+    $PSDefaultParameterValues['Save-Module:Credential']    = $__cfsCred
+}
 if ($PSEdition -ne 'Core') {
     Write-Error 'This script requires PowerShell Core to execute. [Note] Generated cmdlets will work in both PowerShell Core or Windows PowerShell.'
 }
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
new file mode 100644
index 00000000000..9356ff906ed
--- /dev/null
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -0,0 +1,41 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+<#
+.SYNOPSIS
+    Shared helpers to route PowerShell module installs/queries through the private Azure Artifacts
+    feed (CFSClean network isolation) instead of the public PowerShell Gallery.
+
+.DESCRIPTION
+    The private feed `PowerShell_V2_Build` has a PowerShell Gallery upstream, so it can serve both
+    the internally published Graph modules and public tooling modules (Pester, PlatyPS,
+    powershell-yaml, PowerHTML). Reads the credential from the process-wide $env:SYSTEM_ACCESSTOKEN
+    (mapped from $(System.AccessToken) at the pipeline `variables:` level), so it works inside
+    ForEach-Object -Parallel runspaces where session state is not inherited.
+#>
+
+$script:CfsFeedName = 'PowerShell_V2_Build'
+$script:CfsFeedUrl  = 'https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/PowerShell_V2_Build/nuget/v2'
+
+function Get-CfsFeedName {
+    return $script:CfsFeedName
+}
+
+function Get-CfsFeedCredential {
+    # Returns a PSCredential built from the build identity's access token, or $null when the token is
+    # unavailable (e.g. local dev), in which case callers fall back to their default behaviour.
+    if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) {
+        return $null
+    }
+    $token = ConvertTo-SecureString $env:SYSTEM_ACCESSTOKEN -AsPlainText -Force
+    return [System.Management.Automation.PSCredential]::new('azure', $token)
+}
+
+function Register-CfsFeed {
+    # Registers the private feed as a Trusted PSRepository (idempotent). Persisted under the user's
+    # PowerShellGet config, so a single registration per job is visible to later steps and runspaces.
+    $cred = Get-CfsFeedCredential
+    if (-not (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue)) {
+        Register-PSRepository -Name $script:CfsFeedName -SourceLocation $script:CfsFeedUrl -InstallationPolicy Trusted -Credential $cred
+    }
+}
diff --git a/tools/ImportExamples.ps1 b/tools/ImportExamples.ps1
index 030b224e757..3212d68e1f8 100644
--- a/tools/ImportExamples.ps1
+++ b/tools/ImportExamples.ps1
@@ -575,13 +575,17 @@ function Get-ExistingCorrectExamples {
 }
 $RetainedExamples = New-Object Collections.Generic.List[string]
 
+# CFSClean: install tooling modules from the private feed (PowerShell Gallery upstream).
+. (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Install-Module:Credential'] = $__cfsCred }
 if (!(Get-Module "powershell-yaml" -ListAvailable -ErrorAction SilentlyContinue)) {
-    Install-Module "powershell-yaml" -AcceptLicense -Scope CurrentUser -Force
+    Install-Module "powershell-yaml" -Repository (Get-CfsFeedName) -AcceptLicense -Scope CurrentUser -Force
 }
 
 If (-not (Get-Module -ErrorAction Ignore -ListAvailable PowerHTML)) {
     Write-Verbose "Installing PowerHTML module for the current user..."
-    Install-Module PowerHTML -ErrorAction Stop -Scope CurrentUser -Force
+    Install-Module PowerHTML -Repository (Get-CfsFeedName) -ErrorAction Stop -Scope CurrentUser -Force
 }
 Import-Module -ErrorAction Stop PowerHTML
 
diff --git a/tools/TestModule.ps1 b/tools/TestModule.ps1
index adfb15d7576..081f9ca81d8 100644
--- a/tools/TestModule.ps1
+++ b/tools/TestModule.ps1
@@ -5,8 +5,12 @@ param([string] $ModulePath, [string] $ModuleName, [string] $ModuleTestsPath, [sw
 $ErrorActionPreference = 'Stop'
 
 # Install Pester
+# CFSClean: install tooling modules from the private feed (PowerShell Gallery upstream).
+. (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Install-Module:Credential'] = $__cfsCred }
 if (!(Get-Module -Name Pester -ListAvailable)) {
-    Install-Module -Name Pester -Force -SkipPublisherCheck
+    Install-Module -Name Pester -Repository (Get-CfsFeedName) -Force -SkipPublisherCheck
 }
 
 if(-not $Isolated) {
diff --git a/tools/UpdateOpenApi.ps1 b/tools/UpdateOpenApi.ps1
index 64d4e4f154c..1b98f04ca41 100644
--- a/tools/UpdateOpenApi.ps1
+++ b/tools/UpdateOpenApi.ps1
@@ -15,8 +15,11 @@ if ($PSEdition -ne 'Core') {
 }
 
 if (!(Get-Module powershell-yaml -ListAvailable)) {
-    # Install Powershell-yaml
-    Install-Module powershell-yaml -Force
+    # Install Powershell-yaml from the private feed (PowerShell Gallery upstream). (CFSClean)
+    . (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+    $__cfsCred = Get-CfsFeedCredential
+    if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Install-Module:Credential'] = $__cfsCred }
+    Install-Module powershell-yaml -Repository (Get-CfsFeedName) -Force
 }
 
 $GraphVersion = "v1.0"
diff --git a/tools/ValidateUpdatedModuleVersion.ps1 b/tools/ValidateUpdatedModuleVersion.ps1
index b916f78f5b6..69d925b1725 100644
--- a/tools/ValidateUpdatedModuleVersion.ps1
+++ b/tools/ValidateUpdatedModuleVersion.ps1
@@ -4,7 +4,7 @@
 param(
     [Parameter()][ValidateNotNullOrEmpty()][string] $ModuleName,
     [Parameter()][ValidateNotNullOrEmpty()][string] $NextVersion,
-    [Parameter()][string] $PSRepository = "PSGallery",
+    [Parameter()][string] $PSRepository = "PowerShell_V2_Build",
     [int] $ModulePreviewNumber = -1
 )
 enum VersionState {
@@ -18,6 +18,15 @@ enum VersionState {
 Import-Module PackageManagement
 Import-Module PowerShellGet
 
+# CFSClean: authenticate module queries to the private feed (credential from the build token).
+. (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) {
+    $PSDefaultParameterValues['Find-Module:Credential']    = $__cfsCred
+    $PSDefaultParameterValues['Install-Module:Credential'] = $__cfsCred
+    $PSDefaultParameterValues['Save-Module:Credential']    = $__cfsCred
+}
+
 $AllowPreRelease = $true
 if($ModulePreviewNumber -eq -1) {
     $AllowPreRelease = $false
diff --git a/tools/Versions/BumpModuleVersion.ps1 b/tools/Versions/BumpModuleVersion.ps1
index 6325b5ddc0b..411fe80b426 100644
--- a/tools/Versions/BumpModuleVersion.ps1
+++ b/tools/Versions/BumpModuleVersion.ps1
@@ -7,12 +7,17 @@ Param(
     [switch] $BumpBetaModule,
     [switch] $BumpAuthModule,
     [string] $PreReleaseTag,
-    [string] $Repository = "PSGallery"
+    [string] $Repository = "PowerShell_V2_Build"
 )
 $ErrorActionPreference = "Stop"
 
 . $PSScriptRoot\SetModuleVersion.ps1
 
+# CFSClean: authenticate module queries to the private feed (credential from the build token).
+. (Join-Path $PSScriptRoot '..\Get-CfsFeedCredential.ps1')
+$__cfsCred = Get-CfsFeedCredential
+if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Find-Module:Credential'] = $__cfsCred }
+
 # Calculate and bump v1.0 module version
 if ($BumpV1Module.IsPresent) {
     $v1Module = Find-Module "Microsoft.Graph" -Repository $Repository -AllowPrerelease

From 835ecba167ba3c232739be8db4bdb2c0776eebff Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 24 Aug 2026 13:16:41 -0700
Subject: [PATCH 02/15] fix: make Register-CfsFeed tolerate existing package
 source (CFSClean)

The 'Register private module feed (CFSClean)' step failed with 'The name specified has already
been added to the list of available package sources' because a PackageManagement source named
PowerShell_V2_Build already exists in the build job (not surfaced by Get-PSRepository). The
repository still ends up registered, so wrap Register-PSRepository in try/catch and treat the
already-exists collision as success when Get-PSRepository confirms the repo is present.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 tools/Get-CfsFeedCredential.ps1 | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 9356ff906ed..8a6b7aa9a1b 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -35,7 +35,21 @@ function Register-CfsFeed {
     # Registers the private feed as a Trusted PSRepository (idempotent). Persisted under the user's
     # PowerShellGet config, so a single registration per job is visible to later steps and runspaces.
     $cred = Get-CfsFeedCredential
-    if (-not (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue)) {
-        Register-PSRepository -Name $script:CfsFeedName -SourceLocation $script:CfsFeedUrl -InstallationPolicy Trusted -Credential $cred
+    if (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue) {
+        return
+    }
+    try {
+        Register-PSRepository -Name $script:CfsFeedName -SourceLocation $script:CfsFeedUrl -InstallationPolicy Trusted -Credential $cred -ErrorAction Stop
+    }
+    catch {
+        # A package source with this name may already exist at the PackageManagement layer (e.g. a
+        # NuGet source, or a registration from an earlier step/runspace) that Get-PSRepository does
+        # not surface. If a usable PSRepository now exists, the registration effectively succeeded, so
+        # swallow the "already added" collision; otherwise rethrow the real failure.
+        if (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue) {
+            Write-Host "PSRepository '$($script:CfsFeedName)' is already registered; continuing."
+            return
+        }
+        throw
     }
 }

From 1a7235296a321207f70b56a5fcd2f8f6e9262c85 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 24 Aug 2026 13:34:17 -0700
Subject: [PATCH 03/15] fix: make Register-CfsFeed robust to non-terminating
 source collision

The 'already added' error is non-terminating and bypasses -ErrorAction Stop (so try/catch never
fires) yet fails the PowerShell task under its default Stop preference. Pre-check Get-PackageSource
(surfaces the collision that Get-PSRepository lazily misses in a fresh session), and suppress all
streams on Register-PSRepository with a post-verify instead of relying on the call to not error.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 tools/Get-CfsFeedCredential.ps1 | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 8a6b7aa9a1b..781157ab692 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -35,21 +35,20 @@ function Register-CfsFeed {
     # Registers the private feed as a Trusted PSRepository (idempotent). Persisted under the user's
     # PowerShellGet config, so a single registration per job is visible to later steps and runspaces.
     $cred = Get-CfsFeedCredential
-    if (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue) {
+    # Get-PSRepository can lazily return nothing in a fresh session even when the source is already
+    # persisted (registered by an earlier step/runspace). Get-PackageSource surfaces that collision,
+    # so check both before attempting to register.
+    if ((Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue) -or
+        (Get-PackageSource -Name $script:CfsFeedName -ErrorAction SilentlyContinue)) {
+        Write-Host "Package source '$($script:CfsFeedName)' is already registered; skipping."
         return
     }
-    try {
-        Register-PSRepository -Name $script:CfsFeedName -SourceLocation $script:CfsFeedUrl -InstallationPolicy Trusted -Credential $cred -ErrorAction Stop
-    }
-    catch {
-        # A package source with this name may already exist at the PackageManagement layer (e.g. a
-        # NuGet source, or a registration from an earlier step/runspace) that Get-PSRepository does
-        # not surface. If a usable PSRepository now exists, the registration effectively succeeded, so
-        # swallow the "already added" collision; otherwise rethrow the real failure.
-        if (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue) {
-            Write-Host "PSRepository '$($script:CfsFeedName)' is already registered; continuing."
-            return
-        }
-        throw
+    # The "already added" collision is a non-terminating error emitted by an internal PackageManagement
+    # cmdlet that bypasses -ErrorAction Stop (and would otherwise fail the task under its default Stop
+    # preference), so redirect every stream to null and verify the outcome instead of trusting the call.
+    Register-PSRepository -Name $script:CfsFeedName -SourceLocation $script:CfsFeedUrl -InstallationPolicy Trusted -Credential $cred -ErrorAction SilentlyContinue *> $null
+    if (-not (Get-PSRepository -Name $script:CfsFeedName -ErrorAction SilentlyContinue)) {
+        throw "Failed to register PSRepository '$($script:CfsFeedName)'."
     }
+    Write-Host "Registered PSRepository '$($script:CfsFeedName)'."
 }

From c7a5c92d0114455525eeac2762e9e685406487e4 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 24 Aug 2026 13:46:39 -0700
Subject: [PATCH 04/15] ci: set errorActionPreference=continue on Register
 private module feed step

The step still exited 1 despite a successful registration because PackageManagement emits benign
non-terminating errors that trip the PowerShell task's default Stop preference. Set the task
errorActionPreference to continue; Register-CfsFeed still throws (terminating) on genuine failure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .azure-pipelines/common-templates/install-tools.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index beae75b61e7..1affcdbaa4f 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -69,10 +69,14 @@ steps:
     inputs:
       targetType: inline
       pwsh: true
+      errorActionPreference: continue
       script: |
         # Register the private Azure Artifacts feed (PowerShell Gallery upstream) as a Trusted
         # PSRepository so generation-time Install-Module/Find-Module resolve through it instead of
         # the public PowerShell Gallery. Persisted for the job (visible to later steps + runspaces).
+        # errorActionPreference is 'continue' because PackageManagement emits benign non-terminating
+        # errors (e.g. source-already-registered) that would otherwise fail the task; Register-CfsFeed
+        # throws on genuine failure, which still fails the step.
         . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
         Register-CfsFeed
         Get-PSRepository -Name PowerShell_V2_Build | Format-List Name, SourceLocation, InstallationPolicy, Trusted

From a99fe74a18c6475a4b98fa36e0c22445e2c9219f Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 24 Aug 2026 13:58:42 -0700
Subject: [PATCH 05/15] ci: reset stray LASTEXITCODE after Register private
 module feed

Registration succeeds (repo is created + printed) but the step exited 1 because PowerShellGet's
NuGet-provider bootstrap leaves a non-zero \0 that the task checks. Reset it at the end
of the step; Register-CfsFeed throws on genuine failure before this line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .azure-pipelines/common-templates/install-tools.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 1affcdbaa4f..240d71c0771 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -80,6 +80,10 @@ steps:
         . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
         Register-CfsFeed
         Get-PSRepository -Name PowerShell_V2_Build | Format-List Name, SourceLocation, InstallationPolicy, Trusted
+        # PowerShellGet bootstraps the NuGet provider via a native tool during registration, which can
+        # leave a stray non-zero $LASTEXITCODE that fails the task even though registration succeeded.
+        # Register-CfsFeed throws on genuine failure (halting before this line), so reset it here.
+        $global:LASTEXITCODE = 0
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 

From 4143f53ed46bf327dea6028959cab269437b7883 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 24 Aug 2026 14:40:24 -0700
Subject: [PATCH 06/15] fix: source locked module GUID from the private feed
 package (CFSClean)

BuildModule.ps1 read the existing module GUID from Find-Module's AdditionalMetadata.GUID, which the
private Azure Artifacts feed does not populate (public PS Gallery does), producing a null GUID and
failing Update-ModuleManifest. Add Get-CfsModuleGuid: Save-Package the published nupkg from the feed
(NuGet provider, no dependency resolution) and read GUID from its .psd1; fall back to a fresh GUID
only when the module is unpublished. Keeps the GUID lock working without any public PS Gallery call.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 tools/BuildModule.ps1           | 10 ++++----
 tools/Get-CfsFeedCredential.ps1 | 43 +++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/tools/BuildModule.ps1 b/tools/BuildModule.ps1
index 3ba051e5e82..7aa82f20b81 100644
--- a/tools/BuildModule.ps1
+++ b/tools/BuildModule.ps1
@@ -66,12 +66,12 @@ if ($ModuleFullName -ne "Microsoft.Graph.Authentication") {
 }
 
 # Lock module GUID. See https://github.com/Azure/autorest.powershell/issues/981.
-# CFSClean: authenticate module queries to the private feed (credential from the build token).
+# CFSClean: the private feed does not surface the module GUID via Find-Module's AdditionalMetadata,
+# so read it from the package published on the feed. Mint a new GUID only when unpublished (matches
+# the original "first publish" behaviour) without ever querying the public PowerShell Gallery.
 . (Join-Path $PSScriptRoot 'Get-CfsFeedCredential.ps1')
-$__cfsCred = Get-CfsFeedCredential
-if ($null -ne $__cfsCred) { $PSDefaultParameterValues['Find-Module:Credential'] = $__cfsCred }
-$ExistingModule = Find-Module $ModuleFullName -Repository (Get-CfsFeedName) -ErrorAction SilentlyContinue
-$ModuleGuid = ($null -eq $ExistingModule) ? (New-Guid).Guid : $ExistingModule.AdditionalMetadata.GUID
+$ModuleGuid = Get-CfsModuleGuid -Name $ModuleFullName
+if ([string]::IsNullOrWhiteSpace($ModuleGuid)) { $ModuleGuid = (New-Guid).Guid }
 
 [HashTable]$ModuleManifestSettings = @{
     Guid          = $ModuleGuid
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 781157ab692..8dccba00160 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -52,3 +52,46 @@ function Register-CfsFeed {
     }
     Write-Host "Registered PSRepository '$($script:CfsFeedName)'."
 }
+
+function Get-CfsModuleGuid {
+    # Returns the GUID of the module already published to the private feed, or $null when it is not
+    # published there or the GUID cannot be determined. The Azure Artifacts feed does not surface the
+    # module GUID via Find-Module's AdditionalMetadata (public PS Gallery does), so download the
+    # package (nupkg) from the feed and read the GUID out of its manifest. Callers mint a fresh GUID
+    # when this returns $null, preserving the original "first publish" behaviour without ever querying
+    # the public PowerShell Gallery.
+    param(
+        [Parameter(Mandatory)][string] $Name
+    )
+    $cred = Get-CfsFeedCredential
+    $found = Find-Module -Name $Name -Repository $script:CfsFeedName -Credential $cred -ErrorAction SilentlyContinue
+    if ($null -eq $found) { return $null }
+    $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("cfsguid_" + [System.Guid]::NewGuid().ToString('N'))
+    try {
+        New-Item -ItemType Directory -Path $tmp -Force | Out-Null
+        # Save-Package (NuGet provider) downloads just this package's nupkg (no dependency resolution),
+        # so it stays cheap even for meta-modules that depend on many sub-modules.
+        Save-Package -Name $Name -RequiredVersion $found.Version -Source $script:CfsFeedUrl -ProviderName NuGet -Credential $cred -Path $tmp -Force -ErrorAction Stop *> $null
+        $nupkg = Get-ChildItem -Path $tmp -Filter '*.nupkg' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
+        if ($null -eq $nupkg) { return $null }
+        Add-Type -AssemblyName System.IO.Compression.FileSystem
+        $zip = [System.IO.Compression.ZipFile]::OpenRead($nupkg.FullName)
+        try {
+            $entry = $zip.Entries | Where-Object { $_.Name -eq "$Name.psd1" } | Select-Object -First 1
+            if ($null -eq $entry) { return $null }
+            $reader = [System.IO.StreamReader]::new($entry.Open())
+            try { $content = $reader.ReadToEnd() } finally { $reader.Dispose() }
+        }
+        finally { $zip.Dispose() }
+        $match = [regex]::Match($content, "(?im)^\s*GUID\s*=\s*['`"]([0-9a-fA-F-]{36})['`"]")
+        if ($match.Success) { return $match.Groups[1].Value }
+        return $null
+    }
+    catch { return $null }
+    finally {
+        Remove-Item -Path $tmp -Recurse -Force -ErrorAction SilentlyContinue
+        # PackageManagement/NuGet can leave a stray non-zero $LASTEXITCODE from an internal native call;
+        # this helper is a side-effect-free read, so do not let that leak into the caller's exit code.
+        $global:LASTEXITCODE = 0
+    }
+}

From e8465e51d277b111c84d249525dd1f2a3b12929b Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Mon, 24 Aug 2026 15:02:12 -0700
Subject: [PATCH 07/15] fix: unregister public PSGallery so installs resolve
 only via the private feed

Generation failed installing PlatyPS: 'multiple modules matched platyPS. Please specify a single
-Repository' because PSGallery and the private feed were both registered. Unregister PSGallery in
the register step so the private feed (which has a PS Gallery upstream) is the sole source -
eliminating install ambiguity and any residual public PS Gallery egress. Persists per-user for
later generation steps/runspaces.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .azure-pipelines/common-templates/install-tools.yml |  3 ++-
 tools/Get-CfsFeedCredential.ps1                     | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 240d71c0771..2a84d4b05e3 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -79,7 +79,8 @@ steps:
         # throws on genuine failure, which still fails the step.
         . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
         Register-CfsFeed
-        Get-PSRepository -Name PowerShell_V2_Build | Format-List Name, SourceLocation, InstallationPolicy, Trusted
+        Unregister-PublicPSGallery
+        Get-PSRepository | Format-List Name, SourceLocation, InstallationPolicy, Trusted
         # PowerShellGet bootstraps the NuGet provider via a native tool during registration, which can
         # leave a stray non-zero $LASTEXITCODE that fails the task even though registration succeeded.
         # Register-CfsFeed throws on genuine failure (halting before this line), so reset it here.
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 8dccba00160..9a3747dcd74 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -53,6 +53,18 @@ function Register-CfsFeed {
     Write-Host "Registered PSRepository '$($script:CfsFeedName)'."
 }
 
+function Unregister-PublicPSGallery {
+    # Removes the public PowerShell Gallery repository so module installs cannot resolve to it and are
+    # never ambiguous between PSGallery and the private feed (Install-Module errors when a module name
+    # matches more than one registered repository). The private feed has a PS Gallery upstream, so it
+    # can still serve every module. Persisted per-user, so later steps/runspaces inherit the removal.
+    if (Get-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue) {
+        Unregister-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue *> $null
+        Write-Host "Unregistered public 'PSGallery'; module installs now resolve only through '$($script:CfsFeedName)'."
+    }
+    $global:LASTEXITCODE = 0
+}
+
 function Get-CfsModuleGuid {
     # Returns the GUID of the module already published to the private feed, or $null when it is not
     # published there or the GUID cannot be determined. The Azure Artifacts feed does not surface the

From 40aa9859eff6fc017cf880d412532da62ccf49ed Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Tue, 25 Aug 2026 16:38:12 -0700
Subject: [PATCH 08/15] ci: pre-install generation tooling modules from private
 feed (CFSClean)

Install PlatyPS/Pester/powershell-yaml/PowerHTML once in install-tools (controlled credential
context) so the lazy, already-guarded Install-Module calls during generation are skipped via their
Get-Module -ListAvailable checks. Avoids repeating fragile authenticated private-feed installs across
the parallel generation runspaces.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .../common-templates/install-tools.yml        | 18 +++++++++++++
 tools/Get-CfsFeedCredential.ps1               | 27 +++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 2a84d4b05e3..5276efba80d 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -88,6 +88,24 @@ steps:
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 
+  - task: PowerShell@2
+    displayName: Pre-install generation tooling modules (CFSClean)
+    inputs:
+      targetType: inline
+      pwsh: true
+      errorActionPreference: continue
+      script: |
+        # Install PlatyPS / Pester / powershell-yaml / PowerHTML from the private feed up-front, in this
+        # controlled credential context, so the lazy Install-Module calls during generation are skipped
+        # by their Get-Module -ListAvailable guards (authenticated private-feed installs are fragile in
+        # the parallel generation runspaces).
+        . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
+        Install-CfsToolingModules
+        Get-Module -ListAvailable -Name PlatyPS, Pester, powershell-yaml, PowerHTML | Format-Table Name, Version, Path -AutoSize
+        $global:LASTEXITCODE = 0
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+
   - task: Npm@1
     displayName: Install AutoRest
     retryCountOnTaskFailure: 2
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 9a3747dcd74..3ce5ab42a84 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -65,6 +65,33 @@ function Unregister-PublicPSGallery {
     $global:LASTEXITCODE = 0
 }
 
+function Install-CfsToolingModules {
+    # Pre-installs the generation-time tooling modules from the private feed once, in this controlled
+    # credential context, so the lazy Install-Module calls during generation are skipped by their
+    # Get-Module -ListAvailable guards. This avoids repeating authenticated private-feed installs across
+    # many generation steps and parallel runspaces (where credential/source resolution is fragile).
+    $cred = Get-CfsFeedCredential
+    $tooling = @(
+        @{ Name = 'PlatyPS' },
+        @{ Name = 'Pester'; SkipPublisherCheck = $true },
+        @{ Name = 'powershell-yaml'; AcceptLicense = $true },
+        @{ Name = 'PowerHTML' }
+    )
+    foreach ($t in $tooling) {
+        if (Get-Module -Name $t.Name -ListAvailable) {
+            Write-Host "Tooling module '$($t.Name)' already available; skipping."
+            continue
+        }
+        $params = @{ Name = $t.Name; Repository = $script:CfsFeedName; Scope = 'AllUsers'; Force = $true; AllowClobber = $true }
+        if ($null -ne $cred) { $params.Credential = $cred }
+        if ($t.SkipPublisherCheck) { $params.SkipPublisherCheck = $true }
+        if ($t.AcceptLicense) { $params.AcceptLicense = $true }
+        Install-Module @params
+        Write-Host "Installed tooling module '$($t.Name)' from '$($script:CfsFeedName)'."
+    }
+    $global:LASTEXITCODE = 0
+}
+
 function Get-CfsModuleGuid {
     # Returns the GUID of the module already published to the private feed, or $null when it is not
     # published there or the GUID cannot be determined. The Azure Artifacts feed does not surface the

From 42808b5d04e3c56ba5b275647a298659973488cc Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 26 Aug 2026 11:09:17 -0700
Subject: [PATCH 09/15] fix: make Get-CfsModuleGuid robust - Save-Package
 latest directly from feed URL

The GUID lock returned null in CI (random GUID -> 'Should lock GUID' test failure) because
Get-CfsModuleGuid first did Find-Module -Repository PowerShell_V2_Build, which returns null in the
generation runspace where the PSRepository registration isn't visible. Drop that lookup and
Save-Package the latest package straight from the feed URL (no registration needed; GUID is
version-independent). Verified locally in a fresh process with no repo registered: returns the
correct locked GUID.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 tools/Get-CfsFeedCredential.ps1 | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 3ce5ab42a84..c47c49f1493 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -103,15 +103,19 @@ function Get-CfsModuleGuid {
         [Parameter(Mandatory)][string] $Name
     )
     $cred = Get-CfsFeedCredential
-    $found = Find-Module -Name $Name -Repository $script:CfsFeedName -Credential $cred -ErrorAction SilentlyContinue
-    if ($null -eq $found) { return $null }
     $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("cfsguid_" + [System.Guid]::NewGuid().ToString('N'))
     try {
         New-Item -ItemType Directory -Path $tmp -Force | Out-Null
-        # Save-Package (NuGet provider) downloads just this package's nupkg (no dependency resolution),
-        # so it stays cheap even for meta-modules that depend on many sub-modules.
-        Save-Package -Name $Name -RequiredVersion $found.Version -Source $script:CfsFeedUrl -ProviderName NuGet -Credential $cred -Path $tmp -Force -ErrorAction Stop *> $null
-        $nupkg = Get-ChildItem -Path $tmp -Filter '*.nupkg' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
+        # Download the latest published package straight from the feed URL via the NuGet provider. This
+        # deliberately avoids a Find-Module -Repository lookup, which is unreliable across steps and
+        # parallel generation runspaces where the PSRepository registration may not be visible (that is
+        # why the earlier implementation returned $null and a random GUID was minted). The module GUID
+        # is version-independent (locked), so the latest package's manifest GUID is authoritative.
+        # Save-Package throws when the module is not yet published (caught below -> $null), so callers
+        # still mint a fresh GUID on first publish.
+        Save-Package -Name $Name -Source $script:CfsFeedUrl -ProviderName NuGet -Credential $cred -Path $tmp -Force -ErrorAction Stop *> $null
+        $nupkg = Get-ChildItem -Path $tmp -Filter '*.nupkg' -Recurse -ErrorAction SilentlyContinue |
+            Where-Object { $_.Name -match ('^' + [regex]::Escape($Name) + '\.\d') } | Select-Object -First 1
         if ($null -eq $nupkg) { return $null }
         Add-Type -AssemblyName System.IO.Compression.FileSystem
         $zip = [System.IO.Compression.ZipFile]::OpenRead($nupkg.FullName)

From 7b976f60c5e83479114d6ed71abae61138a460e8 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 26 Aug 2026 14:35:48 -0700
Subject: [PATCH 10/15] ci: pre-seed NuGet package provider to avoid PS Gallery
 bootstrap (CFSClean2)

Attempt to eliminate the 3 residual www.powershellgallery.com connections during the register step
(CFSClean2 violations) by pre-seeding the NuGet package provider from the private feed before any
PowerShellGet operation, falling back to importing the agent's existing provider.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .../common-templates/install-tools.yml           |  1 +
 tools/Get-CfsFeedCredential.ps1                  | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 5276efba80d..2bc760ddcbc 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -78,6 +78,7 @@ steps:
         # errors (e.g. source-already-registered) that would otherwise fail the task; Register-CfsFeed
         # throws on genuine failure, which still fails the step.
         . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
+        Initialize-CfsPackageProvider
         Register-CfsFeed
         Unregister-PublicPSGallery
         Get-PSRepository | Format-List Name, SourceLocation, InstallationPolicy, Trusted
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index c47c49f1493..2a23b3eaa53 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -31,6 +31,22 @@ function Get-CfsFeedCredential {
     return [System.Management.Automation.PSCredential]::new('azure', $token)
 }
 
+function Initialize-CfsPackageProvider {
+    # Pre-seed the NuGet package provider so PowerShellGet uses it directly rather than bootstrapping /
+    # resolving a public source on first use, which egresses to www.powershellgallery.com (a CFSClean2
+    # violation). Prefer the private feed; otherwise import the provider already bundled on the agent.
+    $cred = Get-CfsFeedCredential
+    try {
+        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Source $script:CfsFeedUrl -Credential $cred -Scope AllUsers -Force -ErrorAction Stop *> $null
+        Write-Host "Pre-seeded NuGet package provider from the private feed."
+    }
+    catch {
+        Import-PackageProvider -Name NuGet -Force -ErrorAction SilentlyContinue *> $null
+        Write-Host "Imported the agent's existing NuGet package provider (private-feed seed unavailable)."
+    }
+    $global:LASTEXITCODE = 0
+}
+
 function Register-CfsFeed {
     # Registers the private feed as a Trusted PSRepository (idempotent). Persisted under the user's
     # PowerShellGet config, so a single registration per job is visible to later steps and runspaces.

From 305fa7f2cb9db1d2d138ac2424e111645be84e21 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 26 Aug 2026 15:54:21 -0700
Subject: [PATCH 11/15] fix: robust GUID via direct HTTP nupkg download +
 unregister PSGallery first

- Get-CfsModuleGuid now downloads the published package over HTTP from the feed's NuGet v2 OData
  endpoint and reads the GUID from the .psd1, bypassing PowerShellGet/PackageManagement source
  resolution (which returns null in generation runspaces -> random GUID -> 'Should lock GUID'
  test failure). Verified locally.
- Unregister-PublicPSGallery now runs FIRST (before any other PowerShellGet call) via the low-level
  Unregister-PackageSource, so PSGallery is gone before an enumeration resolves its location and
  egresses to www.powershellgallery.com (CFSClean2).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .../common-templates/install-tools.yml        |  2 +-
 tools/Get-CfsFeedCredential.ps1               | 55 +++++++++----------
 2 files changed, 27 insertions(+), 30 deletions(-)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 2bc760ddcbc..7883b3837d7 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -78,9 +78,9 @@ steps:
         # errors (e.g. source-already-registered) that would otherwise fail the task; Register-CfsFeed
         # throws on genuine failure, which still fails the step.
         . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
+        Unregister-PublicPSGallery
         Initialize-CfsPackageProvider
         Register-CfsFeed
-        Unregister-PublicPSGallery
         Get-PSRepository | Format-List Name, SourceLocation, InstallationPolicy, Trusted
         # PowerShellGet bootstraps the NuGet provider via a native tool during registration, which can
         # leave a stray non-zero $LASTEXITCODE that fails the task even though registration succeeded.
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 2a23b3eaa53..ae55bb0fd43 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -70,14 +70,15 @@ function Register-CfsFeed {
 }
 
 function Unregister-PublicPSGallery {
-    # Removes the public PowerShell Gallery repository so module installs cannot resolve to it and are
-    # never ambiguous between PSGallery and the private feed (Install-Module errors when a module name
-    # matches more than one registered repository). The private feed has a PS Gallery upstream, so it
-    # can still serve every module. Persisted per-user, so later steps/runspaces inherit the removal.
+    # Remove the public PowerShell Gallery. Call this FIRST, before any other PowerShellGet operation,
+    # so PSGallery is gone before an enumeration resolves its source location (which egresses to
+    # www.powershellgallery.com - a CFSClean2 violation). Unregister-PackageSource removes the source
+    # entry without resolving its location; the PSRepository fallback covers the PowerShellGet view.
+    Unregister-PackageSource -Name 'PSGallery' -Force -ErrorAction SilentlyContinue *> $null
     if (Get-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue) {
         Unregister-PSRepository -Name 'PSGallery' -ErrorAction SilentlyContinue *> $null
-        Write-Host "Unregistered public 'PSGallery'; module installs now resolve only through '$($script:CfsFeedName)'."
     }
+    Write-Host "Removed public 'PSGallery'; module installs now resolve only through '$($script:CfsFeedName)'."
     $global:LASTEXITCODE = 0
 }
 
@@ -110,35 +111,34 @@ function Install-CfsToolingModules {
 
 function Get-CfsModuleGuid {
     # Returns the GUID of the module already published to the private feed, or $null when it is not
-    # published there or the GUID cannot be determined. The Azure Artifacts feed does not surface the
-    # module GUID via Find-Module's AdditionalMetadata (public PS Gallery does), so download the
-    # package (nupkg) from the feed and read the GUID out of its manifest. Callers mint a fresh GUID
-    # when this returns $null, preserving the original "first publish" behaviour without ever querying
-    # the public PowerShell Gallery.
+    # published there or the GUID cannot be determined (callers then mint a fresh GUID, preserving the
+    # original "first publish" behaviour). The Azure Artifacts feed does not surface the GUID via
+    # Find-Module's AdditionalMetadata (public PS Gallery does), so this downloads the published package
+    # directly over HTTP from the feed's NuGet v2 OData endpoint and reads the GUID from its manifest.
+    # Using raw HTTP (not Find-Module/Save-Package) avoids PowerShellGet/PackageManagement source
+    # resolution, which is unreliable in the generation runspaces, and never touches public PS Gallery.
+    # The module GUID is version-independent (locked), so any published version's manifest is fine.
     param(
         [Parameter(Mandatory)][string] $Name
     )
-    $cred = Get-CfsFeedCredential
+    if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) { return $null }
+    $headers = @{ Authorization = 'Basic ' + [Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("azure:$($env:SYSTEM_ACCESSTOKEN)")) }
     $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("cfsguid_" + [System.Guid]::NewGuid().ToString('N'))
     try {
         New-Item -ItemType Directory -Path $tmp -Force | Out-Null
-        # Download the latest published package straight from the feed URL via the NuGet provider. This
-        # deliberately avoids a Find-Module -Repository lookup, which is unreliable across steps and
-        # parallel generation runspaces where the PSRepository registration may not be visible (that is
-        # why the earlier implementation returned $null and a random GUID was minted). The module GUID
-        # is version-independent (locked), so the latest package's manifest GUID is authoritative.
-        # Save-Package throws when the module is not yet published (caught below -> $null), so callers
-        # still mint a fresh GUID on first publish.
-        Save-Package -Name $Name -Source $script:CfsFeedUrl -ProviderName NuGet -Credential $cred -Path $tmp -Force -ErrorAction Stop *> $null
-        $nupkg = Get-ChildItem -Path $tmp -Filter '*.nupkg' -Recurse -ErrorAction SilentlyContinue |
-            Where-Object { $_.Name -match ('^' + [regex]::Escape($Name) + '\.\d') } | Select-Object -First 1
-        if ($null -eq $nupkg) { return $null }
+        $findUri = "$($script:CfsFeedUrl)/FindPackagesById()?id='$Name'"
+        $resp = Invoke-WebRequest -Uri $findUri -Headers $headers -UseBasicParsing -ErrorAction Stop
+        [xml]$xml = $resp.Content
+        $entry = @($xml.feed.entry) | Where-Object { $_.content.src } | Select-Object -Last 1
+        if ($null -eq $entry) { return $null }
+        $nupkgPath = Join-Path $tmp "$Name.nupkg"
+        Invoke-WebRequest -Uri $entry.content.src -Headers $headers -OutFile $nupkgPath -UseBasicParsing -ErrorAction Stop
         Add-Type -AssemblyName System.IO.Compression.FileSystem
-        $zip = [System.IO.Compression.ZipFile]::OpenRead($nupkg.FullName)
+        $zip = [System.IO.Compression.ZipFile]::OpenRead($nupkgPath)
         try {
-            $entry = $zip.Entries | Where-Object { $_.Name -eq "$Name.psd1" } | Select-Object -First 1
-            if ($null -eq $entry) { return $null }
-            $reader = [System.IO.StreamReader]::new($entry.Open())
+            $psd1 = $zip.Entries | Where-Object { $_.Name -eq "$Name.psd1" } | Select-Object -First 1
+            if ($null -eq $psd1) { return $null }
+            $reader = [System.IO.StreamReader]::new($psd1.Open())
             try { $content = $reader.ReadToEnd() } finally { $reader.Dispose() }
         }
         finally { $zip.Dispose() }
@@ -149,8 +149,5 @@ function Get-CfsModuleGuid {
     catch { return $null }
     finally {
         Remove-Item -Path $tmp -Recurse -Force -ErrorAction SilentlyContinue
-        # PackageManagement/NuGet can leave a stray non-zero $LASTEXITCODE from an internal native call;
-        # this helper is a side-effect-free read, so do not let that leak into the caller's exit code.
-        $global:LASTEXITCODE = 0
     }
 }

From 80646ff476b6a80e763864259c31c5fdd8192069 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 26 Aug 2026 16:16:42 -0700
Subject: [PATCH 12/15] diag: log Get-CfsModuleGuid path + map
 SYSTEM_ACCESSTOKEN in generation step

Add temporary diagnostics to Get-CfsModuleGuid (token presence, OData status, GUID match) and map
env SYSTEM_ACCESSTOKEN into the Generate Authentication Module step - the generation steps did not
expose the token, so Get-CfsModuleGuid returned null (random GUID -> lock test failure).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .../generation-templates/authentication-module.yml     |  2 ++
 tools/Get-CfsFeedCredential.ps1                        | 10 ++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.azure-pipelines/generation-templates/authentication-module.yml b/.azure-pipelines/generation-templates/authentication-module.yml
index 4dc2d7148d1..df35650f367 100644
--- a/.azure-pipelines/generation-templates/authentication-module.yml
+++ b/.azure-pipelines/generation-templates/authentication-module.yml
@@ -20,6 +20,8 @@ steps:
       pwsh: true
       script: |
         . $(System.DefaultWorkingDirectory)/tools/GenerateAuthenticationModule.ps1 -EnableSigning:$${{ parameters.Sign }} -Build
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 
   - ${{ if eq(parameters.Test, true) }}:
       - task: PowerShell@2
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index ae55bb0fd43..e96e0139871 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -121,7 +121,11 @@ function Get-CfsModuleGuid {
     param(
         [Parameter(Mandatory)][string] $Name
     )
-    if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) { return $null }
+    if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) {
+        Write-Host "[CfsGuid] $Name: SYSTEM_ACCESSTOKEN is empty in this step - returning null."
+        return $null
+    }
+    Write-Host "[CfsGuid] $Name: SYSTEM_ACCESSTOKEN present (len=$($env:SYSTEM_ACCESSTOKEN.Length))."
     $headers = @{ Authorization = 'Basic ' + [Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("azure:$($env:SYSTEM_ACCESSTOKEN)")) }
     $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("cfsguid_" + [System.Guid]::NewGuid().ToString('N'))
     try {
@@ -130,6 +134,7 @@ function Get-CfsModuleGuid {
         $resp = Invoke-WebRequest -Uri $findUri -Headers $headers -UseBasicParsing -ErrorAction Stop
         [xml]$xml = $resp.Content
         $entry = @($xml.feed.entry) | Where-Object { $_.content.src } | Select-Object -Last 1
+        Write-Host "[CfsGuid] $Name: OData status=$($resp.StatusCode) version=$($entry.properties.Version)"
         if ($null -eq $entry) { return $null }
         $nupkgPath = Join-Path $tmp "$Name.nupkg"
         Invoke-WebRequest -Uri $entry.content.src -Headers $headers -OutFile $nupkgPath -UseBasicParsing -ErrorAction Stop
@@ -143,10 +148,11 @@ function Get-CfsModuleGuid {
         }
         finally { $zip.Dispose() }
         $match = [regex]::Match($content, "(?im)^\s*GUID\s*=\s*['`"]([0-9a-fA-F-]{36})['`"]")
+        Write-Host "[CfsGuid] $Name: GUID match=$($match.Success) value=$($match.Groups[1].Value)"
         if ($match.Success) { return $match.Groups[1].Value }
         return $null
     }
-    catch { return $null }
+    catch { Write-Host "[CfsGuid] $Name FAILED: $($_.Exception.Message)"; return $null }
     finally {
         Remove-Item -Path $tmp -Recurse -Force -ErrorAction SilentlyContinue
     }

From be86e3d5f95ffe29db6841139ef009ad8d22efed Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 26 Aug 2026 16:32:52 -0700
Subject: [PATCH 13/15] fix: delimit variable name in Get-CfsModuleGuid
 diagnostics

Diagnostic strings used an unbraced variable before a colon, which PowerShell parses as a
drive-qualified reference (InvalidVariableReferenceWithDrive), breaking the helper parse and the
generation step. Use braces to delimit the name.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 tools/Get-CfsFeedCredential.ps1 | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index e96e0139871..77f45e7bbdb 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -122,10 +122,10 @@ function Get-CfsModuleGuid {
         [Parameter(Mandatory)][string] $Name
     )
     if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) {
-        Write-Host "[CfsGuid] $Name: SYSTEM_ACCESSTOKEN is empty in this step - returning null."
+        Write-Host "[CfsGuid] ${Name}: SYSTEM_ACCESSTOKEN is empty in this step - returning null."
         return $null
     }
-    Write-Host "[CfsGuid] $Name: SYSTEM_ACCESSTOKEN present (len=$($env:SYSTEM_ACCESSTOKEN.Length))."
+    Write-Host "[CfsGuid] ${Name}: SYSTEM_ACCESSTOKEN present (len=$($env:SYSTEM_ACCESSTOKEN.Length))."
     $headers = @{ Authorization = 'Basic ' + [Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("azure:$($env:SYSTEM_ACCESSTOKEN)")) }
     $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("cfsguid_" + [System.Guid]::NewGuid().ToString('N'))
     try {
@@ -134,7 +134,7 @@ function Get-CfsModuleGuid {
         $resp = Invoke-WebRequest -Uri $findUri -Headers $headers -UseBasicParsing -ErrorAction Stop
         [xml]$xml = $resp.Content
         $entry = @($xml.feed.entry) | Where-Object { $_.content.src } | Select-Object -Last 1
-        Write-Host "[CfsGuid] $Name: OData status=$($resp.StatusCode) version=$($entry.properties.Version)"
+        Write-Host "[CfsGuid] ${Name}: OData status=$($resp.StatusCode) version=$($entry.properties.Version)"
         if ($null -eq $entry) { return $null }
         $nupkgPath = Join-Path $tmp "$Name.nupkg"
         Invoke-WebRequest -Uri $entry.content.src -Headers $headers -OutFile $nupkgPath -UseBasicParsing -ErrorAction Stop
@@ -148,7 +148,7 @@ function Get-CfsModuleGuid {
         }
         finally { $zip.Dispose() }
         $match = [regex]::Match($content, "(?im)^\s*GUID\s*=\s*['`"]([0-9a-fA-F-]{36})['`"]")
-        Write-Host "[CfsGuid] $Name: GUID match=$($match.Success) value=$($match.Groups[1].Value)"
+        Write-Host "[CfsGuid] ${Name}: GUID match=$($match.Success) value=$($match.Groups[1].Value)"
         if ($match.Success) { return $match.Groups[1].Value }
         return $null
     }

From 7b3b20df2977ae14d09ff1aa6ceb99390e2a74a8 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 26 Aug 2026 16:56:32 -0700
Subject: [PATCH 14/15] fix: pre-install Az.Accounts + map SYSTEM_ACCESSTOKEN
 into workload/meta generation

- Connect-MgGraph.Tests.ps1 installed Az.Accounts from public PSGallery, which fails now that
  PSGallery is unregistered. Pre-install Az.Accounts from the private feed (tooling list) and guard
  the test install with Get-Module -ListAvailable so it resolves without PSGallery.
- Map env SYSTEM_ACCESSTOKEN into the workload/meta generation + pack steps so Get-CfsModuleGuid and
  the private-feed installs have the build token (previously only install-tools steps exposed it).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .azure-pipelines/generation-templates/meta-module.yml       | 4 +++-
 .azure-pipelines/generation-templates/workload-modules.yml  | 6 +++++-
 .../Authentication/test/Connect-MgGraph.Tests.ps1           | 6 +++++-
 tools/Get-CfsFeedCredential.ps1                             | 3 ++-
 4 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/.azure-pipelines/generation-templates/meta-module.yml b/.azure-pipelines/generation-templates/meta-module.yml
index f4310d987d2..fcf9a876652 100644
--- a/.azure-pipelines/generation-templates/meta-module.yml
+++ b/.azure-pipelines/generation-templates/meta-module.yml
@@ -1,4 +1,4 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
+# Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
 
 parameters:
@@ -50,3 +50,5 @@ steps:
           pwsh: true
           script: |
             . $(System.DefaultWorkingDirectory)/tools/GenerateMetaModule.ps1 -Pack -ArtifactsLocation $(Build.ArtifactStagingDirectory)
+        env:
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
diff --git a/.azure-pipelines/generation-templates/workload-modules.yml b/.azure-pipelines/generation-templates/workload-modules.yml
index 47cbc030be1..4a5f5443764 100644
--- a/.azure-pipelines/generation-templates/workload-modules.yml
+++ b/.azure-pipelines/generation-templates/workload-modules.yml
@@ -1,4 +1,4 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
+# Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
 
 parameters:
@@ -20,6 +20,8 @@ steps:
       pwsh: true
       script: |
         . $(System.DefaultWorkingDirectory)/tools/GenerateModules.ps1 -EnableSigning:$${{ parameters.Sign }} -Build -ExcludeExampleTemplates -ExcludeNotesSection
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
 
   - template: ../common-templates/guardian-analyzer.yml
 
@@ -94,3 +96,5 @@ steps:
           pwsh: true
           script: |
             . $(System.DefaultWorkingDirectory)/tools/GenerateModules.ps1 -SkipGeneration -Pack -ArtifactsLocation $(Build.ArtifactStagingDirectory)
+        env:
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
diff --git a/src/Authentication/Authentication/test/Connect-MgGraph.Tests.ps1 b/src/Authentication/Authentication/test/Connect-MgGraph.Tests.ps1
index de52fcaef5a..1e257e1d5b8 100644
--- a/src/Authentication/Authentication/test/Connect-MgGraph.Tests.ps1
+++ b/src/Authentication/Authentication/test/Connect-MgGraph.Tests.ps1
@@ -7,7 +7,11 @@ BeforeAll {
     $ModulePath = Join-Path $PSScriptRoot "..\artifacts\$ModuleName.psd1"
     Import-Module $ModulePath -Force
     $RandomClientId = (New-Guid).Guid
-    Install-Module Az.Accounts -Repository PSGallery -Scope CurrentUser -Force -AllowClobber
+    # CFSClean: Az.Accounts is pre-installed from the private feed in install-tools (public PSGallery is
+    # unregistered under network isolation), so only install here if it is somehow not already present.
+    if (-not (Get-Module -Name Az.Accounts -ListAvailable)) {
+        Install-Module Az.Accounts -Scope CurrentUser -Force -AllowClobber
+    }
 }
 Describe 'Connect-MgGraph ParameterSets' {
     BeforeAll {
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index 77f45e7bbdb..ab436e46414 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -92,7 +92,8 @@ function Install-CfsToolingModules {
         @{ Name = 'PlatyPS' },
         @{ Name = 'Pester'; SkipPublisherCheck = $true },
         @{ Name = 'powershell-yaml'; AcceptLicense = $true },
-        @{ Name = 'PowerHTML' }
+        @{ Name = 'PowerHTML' },
+        @{ Name = 'Az.Accounts' }
     )
     foreach ($t in $tooling) {
         if (Get-Module -Name $t.Name -ListAvailable) {

From 81b1964ab12853e909fa61df2b088d426a832405 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Thu, 27 Aug 2026 04:07:14 -0700
Subject: [PATCH 15/15] chore: remove GUID diagnostics and ineffective NuGet
 provider pre-seed

The provider pre-seed did not eliminate the PowerShellGet-init PS Gallery pings during the register
step (and its failed private-feed bootstrap caused a PS Gallery module download), so remove it and
keep only the unregister-first behaviour. Also strip the temporary Get-CfsModuleGuid diagnostics now
that the HTTP GUID retrieval is confirmed working in CI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6ea00b50-c719-469b-bf9c-72120184bfe0
---
 .../common-templates/install-tools.yml        |  1 -
 tools/Get-CfsFeedCredential.ps1               | 26 ++-----------------
 2 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/.azure-pipelines/common-templates/install-tools.yml b/.azure-pipelines/common-templates/install-tools.yml
index 7883b3837d7..e8c44f83890 100644
--- a/.azure-pipelines/common-templates/install-tools.yml
+++ b/.azure-pipelines/common-templates/install-tools.yml
@@ -79,7 +79,6 @@ steps:
         # throws on genuine failure, which still fails the step.
         . "$(Build.SourcesDirectory)/tools/Get-CfsFeedCredential.ps1"
         Unregister-PublicPSGallery
-        Initialize-CfsPackageProvider
         Register-CfsFeed
         Get-PSRepository | Format-List Name, SourceLocation, InstallationPolicy, Trusted
         # PowerShellGet bootstraps the NuGet provider via a native tool during registration, which can
diff --git a/tools/Get-CfsFeedCredential.ps1 b/tools/Get-CfsFeedCredential.ps1
index ab436e46414..b6f62ae54ae 100644
--- a/tools/Get-CfsFeedCredential.ps1
+++ b/tools/Get-CfsFeedCredential.ps1
@@ -31,22 +31,6 @@ function Get-CfsFeedCredential {
     return [System.Management.Automation.PSCredential]::new('azure', $token)
 }
 
-function Initialize-CfsPackageProvider {
-    # Pre-seed the NuGet package provider so PowerShellGet uses it directly rather than bootstrapping /
-    # resolving a public source on first use, which egresses to www.powershellgallery.com (a CFSClean2
-    # violation). Prefer the private feed; otherwise import the provider already bundled on the agent.
-    $cred = Get-CfsFeedCredential
-    try {
-        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Source $script:CfsFeedUrl -Credential $cred -Scope AllUsers -Force -ErrorAction Stop *> $null
-        Write-Host "Pre-seeded NuGet package provider from the private feed."
-    }
-    catch {
-        Import-PackageProvider -Name NuGet -Force -ErrorAction SilentlyContinue *> $null
-        Write-Host "Imported the agent's existing NuGet package provider (private-feed seed unavailable)."
-    }
-    $global:LASTEXITCODE = 0
-}
-
 function Register-CfsFeed {
     # Registers the private feed as a Trusted PSRepository (idempotent). Persisted under the user's
     # PowerShellGet config, so a single registration per job is visible to later steps and runspaces.
@@ -122,11 +106,7 @@ function Get-CfsModuleGuid {
     param(
         [Parameter(Mandatory)][string] $Name
     )
-    if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) {
-        Write-Host "[CfsGuid] ${Name}: SYSTEM_ACCESSTOKEN is empty in this step - returning null."
-        return $null
-    }
-    Write-Host "[CfsGuid] ${Name}: SYSTEM_ACCESSTOKEN present (len=$($env:SYSTEM_ACCESSTOKEN.Length))."
+    if ([string]::IsNullOrWhiteSpace($env:SYSTEM_ACCESSTOKEN)) { return $null }
     $headers = @{ Authorization = 'Basic ' + [Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("azure:$($env:SYSTEM_ACCESSTOKEN)")) }
     $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("cfsguid_" + [System.Guid]::NewGuid().ToString('N'))
     try {
@@ -135,7 +115,6 @@ function Get-CfsModuleGuid {
         $resp = Invoke-WebRequest -Uri $findUri -Headers $headers -UseBasicParsing -ErrorAction Stop
         [xml]$xml = $resp.Content
         $entry = @($xml.feed.entry) | Where-Object { $_.content.src } | Select-Object -Last 1
-        Write-Host "[CfsGuid] ${Name}: OData status=$($resp.StatusCode) version=$($entry.properties.Version)"
         if ($null -eq $entry) { return $null }
         $nupkgPath = Join-Path $tmp "$Name.nupkg"
         Invoke-WebRequest -Uri $entry.content.src -Headers $headers -OutFile $nupkgPath -UseBasicParsing -ErrorAction Stop
@@ -149,11 +128,10 @@ function Get-CfsModuleGuid {
         }
         finally { $zip.Dispose() }
         $match = [regex]::Match($content, "(?im)^\s*GUID\s*=\s*['`"]([0-9a-fA-F-]{36})['`"]")
-        Write-Host "[CfsGuid] ${Name}: GUID match=$($match.Success) value=$($match.Groups[1].Value)"
         if ($match.Success) { return $match.Groups[1].Value }
         return $null
     }
-    catch { Write-Host "[CfsGuid] $Name FAILED: $($_.Exception.Message)"; return $null }
+    catch { return $null }
     finally {
         Remove-Item -Path $tmp -Recurse -Force -ErrorAction SilentlyContinue
     }