Update SRE Agent scripts to stable ARM APIs

labs/deployment-compliance/scripts/post-deploy.sh

@@ -188,7 +188,7 @@ echo -e "\n${YELLOW}[4/7] Configuring Azure access and incident platform...${NC}
 SUBSCRIPTION_ID=$(az account show --query id -o tsv)
 AGENT_NAME=$(az resource list --resource-group "$RESOURCE_GROUP" --resource-type "Microsoft.App/agents" --query "[0].name" -o tsv)
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 
 # The agent queries LAW using built-in Azure observability tools (no ADX connector needed).
 # Activity Logs flow to LAW via diagnostic settings (Step 2).
@@ -386,28 +386,17 @@ rm -f /tmp/task-body.json
 # ---- Step 8: GitHub connector + code repo ----
 echo -e "\n${YELLOW}[8/8] Configuring GitHub connector and code repository...${NC}"
 
-# Create GitHub OAuth connector via data plane API (PUT is idempotent)
-TOKEN=$(get_agent_token)
-GITHUB_RESULT=$(curl -s -o /dev/null -w "%{http_code}" \
-  -X PUT "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"github","type":"AgentConnector","properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}')
-if [ "$GITHUB_RESULT" = "200" ] || [ "$GITHUB_RESULT" = "201" ]; then
-  echo -e "${GREEN}  ✓ GitHub OAuth connector created (data plane).${NC}"
+# Create the GitHub OAuth connector through the stable ARM child resource.
+echo "   Creating GitHub connector through ARM..."
+if az rest --method PUT \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
+  --output none 2>/dev/null; then
+  echo -e "${GREEN}  ✓ GitHub connector created through ARM.${NC}"
 else
-  echo -e "${YELLOW}  GitHub connector returned HTTP ${GITHUB_RESULT}. May need manual setup.${NC}"
+  echo -e "${YELLOW}  GitHub connector creation failed.${NC}"
 fi
 
-# Also create at ARM level so it's visible in the portal Full Setup page
-echo "   Creating GitHub connector at ARM level..."
-az rest --method PUT \
-  --url "https://management.azure.com${AGENT_RESOURCE_ID}/DataConnectors/github?api-version=${API_VERSION}" \
-  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
-  --output none 2>/dev/null \
-  && echo -e "${GREEN}  ✓ GitHub connector created at ARM level.${NC}" \
-  || echo -e "${YELLOW}  ⚠️  ARM-level connector creation failed (non-critical — data plane connector is active).${NC}"
-
 # Get the OAuth login URL
 TOKEN=$(get_agent_token)
 OAUTH_URL=$(curl -s "${AGENT_ENDPOINT}/api/v1/github/config" \
@@ -463,7 +452,7 @@ TOKEN=$(get_agent_token)
 VERIFY_PASS=0
 VERIFY_FAIL=0
 
-# Check connectors via data plane API
+# Check connectors
 echo -e "\n  ${YELLOW}Connectors:${NC}"
 
 # Check LAW access (built-in, verified by diagnostic settings + role assignment in steps 2-3)
@@ -475,16 +464,11 @@ else
   VERIFY_FAIL=$((VERIFY_FAIL + 1))
 fi
 
-# Check GitHub connector
-GITHUB_CHECK=$(curl -s "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
-import sys,json
-try:
-    d=json.load(sys.stdin)
-    print('ok' if d.get('name')=='github' else 'missing')
-except: print('missing')
-" 2>/dev/null)
-if [ "$GITHUB_CHECK" = "ok" ]; then
+# Check the GitHub connector through the stable ARM resource.
+GITHUB_CHECK=$(az rest --method GET \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --query "name" -o tsv 2>/dev/null || echo "")
+if [[ "$GITHUB_CHECK" == "github" || "$GITHUB_CHECK" == */github ]]; then
   echo -e "    ${GREEN}✓ GitHub connector: Connected${NC}"
   VERIFY_PASS=$((VERIFY_PASS + 1))
 else

labs/starter-lab/scripts/post-provision.sh

@@ -340,7 +340,7 @@ echo ""
 echo "🚨 Step 3/5: Enabling Azure Monitor incident platform..."
 SUBSCRIPTION_ID=$(az account show --query id -o tsv 2>/dev/null)
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 
 # Enable Azure Monitor as the incident platform (ARM PATCH)
   if az rest --method PATCH \
@@ -398,18 +398,15 @@ echo ""
 if [ -n "$GITHUB_REPO" ]; then
 echo "🔗 Step 4/5: GitHub integration..."
 
-# Create GitHub OAuth connector via data plane API (no PAT needed)
-echo "   Creating GitHub OAuth connector..."
-TOKEN=$(get_token)
-RESULT=$(curl -s -o /dev/null -w "%{http_code}" \
-  -X PUT "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"github","type":"AgentConnector","properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}')
-if [ "$RESULT" = "200" ] || [ "$RESULT" = "201" ]; then
-  echo "   ✅ GitHub OAuth connector created"
+# Create the GitHub OAuth connector through the stable ARM child resource.
+echo "   Creating GitHub OAuth connector through ARM..."
+if az rest --method PUT \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
+  --output none 2>/dev/null; then
+  echo "   ✅ GitHub OAuth connector created through ARM"
 else
-  echo "   ⚠️  GitHub connector returned HTTP ${RESULT}"
+  echo "   ⚠️  GitHub connector creation failed"
 fi
 
 # Get OAuth login URL for user to authorize
@@ -423,15 +420,6 @@ try:
 except: print('')
 " 2>/dev/null)
 
-# Create GitHub OAuth connector via ARM (needed for OAuth flow to fully work)
-echo "   Creating GitHub OAuth connector via ARM..."
-TOKEN=$(get_token)
-ARM_RESULT=$(az rest --method PUT \
-  --url "https://management.azure.com${AGENT_RESOURCE_ID}/DataConnectors/github?api-version=${API_VERSION}" \
-  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
-  -o none 2>&1 || true)
-echo "   ✅ GitHub OAuth connector (ARM)"
-
 # Upload triage runbook
 TOKEN=$(get_token)
 curl -s -o /dev/null \

labs/starter-lab/scripts/setup-github.sh

@@ -48,7 +48,7 @@ if [ -z "$AGENT_ENDPOINT" ] || [ -z "$AGENT_NAME" ]; then
 fi
 
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2025-05-01-preview"  # Stable API does not support subagent child resources.
 
 get_token() {
   az account get-access-token --resource https://azuresre.dev --query accessToken -o tsv 2>/dev/null

labs/vm-cosmosdb/scripts/post-deploy.sh

@@ -232,7 +232,7 @@ fi
 
 # ---- Step 4: Configure Azure Monitor as incident platform ----
 echo -e "\n${YELLOW}[4/7] Configuring Azure Monitor as incident platform...${NC}"
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 AGENT_RESOURCE_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.App/agents/${AGENT_NAME}"
 
 az rest --method patch \
@@ -286,16 +286,17 @@ if [ -z "$GITHUB_USER" ]; then
 else
 GITHUB_REPO="${GITHUB_USER}/sre-agent"
 
-# Create GitHub OAuth connector (dataplane)
-TOKEN=$(get_agent_token)
-curl -s -o /dev/null -w "" \
-  -X PUT "${AGENT_ENDPOINT}/api/v2/extendedAgent/connectors/github" \
-  -H "Authorization: Bearer ${TOKEN}" \
-  -H "Content-Type: application/json" \
-  -d '{"name":"github","type":"AgentConnector","properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}'
-echo -e "${GREEN}  ✓ GitHub OAuth connector created${NC}"
+# Create the GitHub OAuth connector through the stable ARM child resource.
+if az rest --method PUT \
+  --url "https://management.azure.com${AGENT_RESOURCE_ID}/connectors/github?api-version=${API_VERSION}" \
+  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
+  --output none 2>/dev/null; then
+  echo -e "${GREEN}  ✓ GitHub OAuth connector created through ARM${NC}"
+else
+  echo -e "${YELLOW}  GitHub connector creation failed${NC}"
+fi
 
-# Get OAuth URL — fetch BEFORE ARM connector creation
+# Get the OAuth URL generated for the connector.
 TOKEN=$(get_agent_token)
 GITHUB_CONFIG=$(curl -s "${AGENT_ENDPOINT}/api/v1/github/config" -H "Authorization: Bearer ${TOKEN}" 2>/dev/null)
 OAUTH_URL=$(echo "$GITHUB_CONFIG" | $PYTHON -c "
@@ -306,13 +307,6 @@ try:
 except: print('')
 " 2>/dev/null)
 
-# Create GitHub OAuth connector via ARM
-az rest --method PUT \
-  --url "https://management.azure.com${AGENT_RESOURCE_ID}/DataConnectors/github?api-version=${API_VERSION}" \
-  --body '{"properties":{"dataConnectorType":"GitHubOAuth","dataSource":"github-oauth"}}' \
-  --output none 2>/dev/null || true
-echo -e "${GREEN}  ✓ GitHub OAuth connector (ARM)${NC}"
-
 # Show OAuth URL — always show even if parsing failed
 if [ -z "$OAUTH_URL" ]; then
   # Try extracting directly with grep

labs/zava-aks-postgres/scripts/_aks-helpers.ps1

@@ -43,7 +43,7 @@ function Invoke-AksCommandViaRest {
     if (-not $clusterToken) { throw "Failed to acquire AKS cluster token." }
 
     $body = @{ command = $Command; clusterToken = $clusterToken } | ConvertTo-Json -Compress
-    $uri = "https://management.azure.com/subscriptions/$sub/resourceGroups/$ResourceGroup/providers/Microsoft.ContainerService/managedClusters/$ClusterName/runCommand?api-version=2024-09-01"
+    $uri = "https://management.azure.com/subscriptions/$sub/resourceGroups/$ResourceGroup/providers/Microsoft.ContainerService/managedClusters/$ClusterName/runCommand?api-version=2026-06-01"
     $headers = @{ Authorization = "Bearer $armToken"; 'Content-Type' = 'application/json' }
 
     $resp = Invoke-WebRequest -Method Post -Uri $uri -Headers $headers -Body $body -SkipHttpErrorCheck
@@ -227,7 +227,7 @@ function Reset-DemoAlertRule {
     if (-not $token) { throw "Could not acquire an Azure Resource Manager token. Run 'az login'." }
     $headers = @{ Authorization = "Bearer $token" }
 
-    $url = "https://management.azure.com/subscriptions/$sub/providers/Microsoft.AlertsManagement/alerts?api-version=2019-05-05-preview&timeRange=30d&pageCount=250"
+    $url = "https://management.azure.com/subscriptions/$sub/providers/Microsoft.AlertsManagement/alerts?api-version=2019-03-01&timeRange=30d&pageCount=250"
     $response = Invoke-RestMethod -Method Get -Uri $url -Headers $headers
     $alerts = @($response.value | Where-Object {
         $essentials = $_.properties.essentials
@@ -249,7 +249,7 @@ function Reset-DemoAlertRule {
 
     if ($essentials.alertState -ne 'Closed') {
         $alertId = [string]$latest.id
-        $changeStateUrl = "https://management.azure.com${alertId}/changestate?api-version=2018-05-05&newState=Closed"
+        $changeStateUrl = "https://management.azure.com${alertId}/changestate?api-version=2019-03-01&newState=Closed"
         try {
             Invoke-RestMethod -Method Post -Uri $changeStateUrl -Headers $headers | Out-Null
         } catch {

labs/zava-aks-postgres/scripts/setup-sre-agent.ps1

@@ -55,7 +55,7 @@ if (-not $SubscriptionId) {
     $SubscriptionId = az account show --query id -o tsv
 }
 $agentArmId = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.App/agents/$AgentName"
-$apiVersion = "2025-05-01-preview"
+$apiVersion = "2026-01-01"
 
 # --- Step 0: Verify agent exists -------------------------------------------
 Write-Host "Step 0: Verifying agent exists..." -ForegroundColor Yellow

labs/zava-learning/scripts/configure-agent.mjs

@@ -227,7 +227,7 @@ function applyToolsSkillsAndAgentsWithSrectl() {
 // configured as ARM child resources / properties. The azmcp `incidents plans_create`
 // targets a data-plane route that is read-only on current agent builds (HTTP 405),
 // so we apply these two pieces declaratively over ARM instead.
-const API_VERSION = "2025-05-01-preview";
+const API_VERSION = "2026-01-01";
 const ARM = "https://management.azure.com";
 const DATAPLANE_AUDIENCE = "https://azuresre.ai";
 const AZ = os.platform() === "win32" ? "az.cmd" : "az";

labs/zava-learning/simulator/demo.py

@@ -401,7 +401,7 @@ def poll_azmon_alert(sub: str, rule_name: str, since: datetime) -> bool:
     if not sub:
         return False
     url = (f"https://management.azure.com/subscriptions/{sub}/providers/"
-           f"Microsoft.AlertsManagement/alerts?api-version=2019-05-05-preview"
+           f"Microsoft.AlertsManagement/alerts?api-version=2019-03-01"
            f"&timeRange=1h")
     out = _az(f'az rest --method GET --url "{url}"')
     if not out:
@@ -496,7 +496,7 @@ def _agent_dataplane_endpoint(cfg: dict):
     ep = None
     if sub and rg and name:
         arm = (f"https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}"
-               f"/providers/Microsoft.App/agents/{name}?api-version=2025-05-01-preview")
+               f"/providers/Microsoft.App/agents/{name}?api-version=2026-01-01")
         out = _az(f'az rest --method GET --url "{arm}"')
         if out:
             try:

sreagent-templates/bicep/Apply-Extras.ps1

@@ -97,7 +97,7 @@ if (-not (Test-Path $ExtrasFile)) {
 # many optional keys on $extras that may be absent for minimal recipes.
 Set-StrictMode -Off
 
-$ApiVersion = "2025-05-01-preview"
+$ApiVersion = "2026-01-01"
 $ArmBase = "https://management.azure.com/subscriptions/$Subscription/resourceGroups/$ResourceGroup/providers/Microsoft.App/agents/$AgentName"
 
 # ── Resolve agent endpoint and UAMI ────────────────────────────────────────
@@ -156,29 +156,6 @@ function Get-DpToken {
     return $tok
 }
 
-# ── Helper: ARM PUT sub-resource with base64-encoded value envelope ─────────
-# Used for incidentFilters, scheduledTasks, commonPrompts.
-function Arm-PutSubresource {
-    param([string]$Type, [string]$Name, [string]$SpecJson)
-    $url = "$ArmBase/$Type/$Name`?api-version=$ApiVersion"
-    $encoded = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($SpecJson))
-    $body = @{ properties = @{ value = $encoded } } | ConvertTo-Json -Compress -Depth 10
-    $tmp = [System.IO.Path]::GetTempFileName()
-    try {
-        Set-Content -Path $tmp -Value $body -NoNewline
-        Write-Host "  ARM PUT $Type/$Name"
-        $result = az rest -m PUT --url $url --body "@$tmp" --headers "Content-Type=application/json" -o json 2>&1
-        if ($LASTEXITCODE -eq 0) {
-            Write-Host "    ok"
-        } else {
-            $msg = ($result | Out-String) -replace '(?s).*"message":"([^"]*)".*', '$1'
-            Write-Host "    FAILED - $msg"
-        }
-    } finally {
-        Remove-Item $tmp -ErrorAction SilentlyContinue
-    }
-}
-
 # ── Helper: ARM PUT connector sub-resource (native properties, no base64) ──
 function Arm-PutConnector {
     param([string]$Name, [string]$BodyJson)

sreagent-templates/bicep/apply-extras.sh

@@ -57,7 +57,7 @@ command -v jq    >/dev/null || { echo "jq is required"    >&2; exit 1; }
 command -v tar   >/dev/null || { echo "tar is required"   >&2; exit 1; }
 command -v curl  >/dev/null || { echo "curl is required"  >&2; exit 1; }
 
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 ARM_BASE="https://management.azure.com/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.App/agents/${AGENT}"
 
 # Look up the data-plane endpoint and the agent's user-assigned MI (we use it
@@ -86,30 +86,6 @@ else
   echo "                To apply later: az login --scope \"https://azuresre.dev/.default\" && re-run"
 fi
 
-# ---------------------------------------------------------------------------
-# Helper: PUT an ARM sub-resource with base64-encoded value envelope.
-# Used for incidentFilters, scheduledTasks, commonPrompts.
-# Body: { properties: { value: "<base64 of JSON spec>" } }
-# ---------------------------------------------------------------------------
-arm_put_subresource() {
-  local type="$1" name="$2" spec_json="$3"
-  local url="${ARM_BASE}/${type}/${name}?api-version=${API_VERSION}"
-  local encoded
-  encoded=$(printf '%s' "$spec_json" | base64)
-  local tmp
-  tmp=$(mktemp)
-  printf '{"properties":{"value":"%s"}}' "$encoded" > "$tmp"
-  echo "  ARM PUT ${type}/${name}"
-  local result
-  result=$(az rest -m PUT --url "$url" --body "@${tmp}" \
-       --headers "Content-Type=application/json" -o json 2>&1) && {
-    echo "    ok"
-  } || {
-    echo "    FAILED — $(echo "$result" | grep -o '"message":"[^"]*"' | head -1 | cut -d'"' -f4)"
-  }
-  rm -f "$tmp"
-}
-
 # ---------------------------------------------------------------------------
 # Helper: PUT an ARM connector sub-resource (native properties, no base64).
 # Used for MCP connectors, KnowledgeFile connectors.

sreagent-templates/bin/clone-agent.sh

@@ -217,7 +217,7 @@ else
 fi
 
 # 2d. Check if agent already exists in target
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 EXISTING=$(az rest -m GET \
   --url "https://management.azure.com/subscriptions/${NEW_SUB}/resourceGroups/${NEW_RG}/providers/Microsoft.App/agents/${NEW_AGENT}?api-version=${API_VERSION}" \
   -o json 2>/dev/null || echo "null")

sreagent-templates/bin/deploy.sh

@@ -300,7 +300,7 @@ fi
 # ── Connector health check (reused in multiple paths) ──
 check_connector_health() {
   local sub="$1" rg="$2" ag="$3"
-  local api_url="https://management.azure.com/subscriptions/${sub}/resourceGroups/${rg}/providers/Microsoft.App/agents/${ag}/connectors?api-version=2025-05-01-preview"
+  local api_url="https://management.azure.com/subscriptions/${sub}/resourceGroups/${rg}/providers/Microsoft.App/agents/${ag}/connectors?api-version=2026-01-01"
   local conn_json
   conn_json=$(az rest --method GET --url "$api_url" 2>/dev/null || true)
   local count

sreagent-templates/bin/diff-agent.sh

@@ -19,7 +19,7 @@ RG="${2:?resource-group required}"
 AGENT="${3:?agent-name required}"
 CONFIG_DIR="${4:?config-directory required}"
 
-API_VERSION="2025-05-01-preview"
+API_VERSION="2026-01-01"
 ARM_BASE="https://management.azure.com/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.App/agents/${AGENT}"
 
 # Check if agent exists