[App Config] `az appconfig enhanced-feature-flag`: Add command group for enhanced feature flags by ChristineWanjau · Pull Request #34043 · Azure/azure-cli

Christine Wanjau (ChristineWanjau) · 2026-09-08T10:26:02Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️appconfig

rule cmd_name rule_message suggest_message

⚠️ 1011 - SubgroupAdd appconfig enhanced-feature-flag sub group appconfig enhanced-feature-flag added

Related command

az appconfig enhanced-feature-flag

Description

Adds a new az appconfig enhanced-feature-flag command group backed by the new App Configuration data-plane FeatureFlagClient (from azure-appconfiguration==1.10.0b1).

Commands:

az appconfig enhanced-feature-flag set (required: --feature-name)
az appconfig enhanced-feature-flag show (required: --feature-name)
az appconfig enhanced-feature-flag list
az appconfig enhanced-feature-flag delete (required: --feature-name)
az appconfig enhanced-feature-flag enable (required: --feature-name)
az appconfig enhanced-feature-flag disable (required: --feature-name)

Highlights:

Enhanced feature flags are identified by name + label; the reserved .appconfig.featureflag/ --key property is intentionally not exposed (the dedicated /ff/ endpoint manages the key server-side).
Supports --telemetry-enabled, --requirement-type, --description, and --tags on set.
set also accepts --flag, which replaces the entire feature flag using the same property names, casing and types as the data-plane /ff API and az appconfig enhanced-feature-flag show (name, enabled, description, conditions, allocation, variants, telemetry, tags). --flag accepts a JSON object, an AAZ shorthand-syntax object, a file path with @ prefix (e.g. @flag.json), or @- to read from stdin. Because it is a full-object replacement, --flag cannot be combined with --enable, --description, --requirement-type or --telemetry-enabled.
--fields supports name, enabled, label, description, conditions, variants, allocation, tags, last_modified.
set performs a get-then-update so unspecified fields (e.g. enabled, description, telemetry, tags) are preserved on update.

Examples

Set an enhanced feature flag from a full flag object using shorthand syntax (no JSON quoting needed; values with spaces/commas are wrapped in single quotes):

az appconfig enhanced-feature-flag set --endpoint https://contoso.azconfig.io --auth-mode login \
  --flag "{name:Beta,enabled:true,description:'Set via --flag',conditions:{requirement_type:All,filters:[{name:Microsoft.TimeWindow,parameters:{Start:'Wed, 01 Jan 2025 00:00:00 GMT'}}]}}"

The shorthand object is equivalent to this JSON (also accepted via --flag '<json>', --flag @flag.json, or --flag @-):

{"name":"Beta","enabled":true,"description":"Set via --flag","conditions":{"requirement_type":"All","filters":[{"name":"Microsoft.TimeWindow","parameters":{"Start":"Wed, 01 Jan 2025 00:00:00 GMT"}}]}}

On PowerShell the shorthand form is the most convenient because it contains no double quotes — just wrap the whole value in "...". For raw JSON, prefer --flag @flag.json to avoid shell-quoting issues.

Testing

Added test_azconfig_enhanced_feature scenario test (with recording) covering create/update/show/list/enable/disable/delete plus not-found error paths, including setting a flag via --flag (both raw JSON and shorthand syntax), the --flag/content-argument mutual-exclusivity checks, and the --flag/--feature-name name-mismatch validation.

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description conform to the Azure CLI PR guidelines.
I adhere to the Command Guidelines.
I have added a HISTORY.rst entry.

Yong Zhang (yonzhan) · 2026-09-08T10:32:00Z

App Config

Copilot

🟡 Changes recommended

The enhanced feature flag serializer returns last_modified without normalizing datetime values, which can break downstream formatting/output handling.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new az appconfig enhanced-feature-flag command group to manage “enhanced feature flags” via the App Configuration data-plane FeatureFlagClient, wiring it into the App Config module’s command table, args, help, output formatting, and scenario tests.

Changes:

Introduces appconfig enhanced-feature-flag commands (set/show/list/delete/enable/disable) backed by FeatureFlagClient.
Extends App Config command plumbing: new args/validators, help text, output formatting, and constants.
Adds a new scenario test + recording; refactors shared data-plane client auth helper for --auth-mode login.

File summaries

File	Description
src/azure-cli/HISTORY.rst	Release note entry for the new command group
src/azure-cli/azure/cli/command_modules/appconfig/enhanced_feature.py	Implements enhanced feature flag CRUD/enable/disable and serialization
src/azure-cli/azure/cli/command_modules/appconfig/commands.py	Registers the new `appconfig enhanced-feature-flag` command group
src/azure-cli/azure/cli/command_modules/appconfig/_params.py	Adds parameters for enhanced feature flags (fields, tags, etc.)
src/azure-cli/azure/cli/command_modules/appconfig/_validators.py	Adds validator for enhanced feature `--fields`
src/azure-cli/azure/cli/command_modules/appconfig/_utils.py	Adds `FeatureFlagClient` factory + refactors login credential resolution
src/azure-cli/azure/cli/command_modules/appconfig/_help.py	Adds help + examples for the new commands
src/azure-cli/azure/cli/command_modules/appconfig/_format.py	Adds table output formatting for enhanced feature flags
src/azure-cli/azure/cli/command_modules/appconfig/_constants.py	Adds constants used in enhanced feature flag serialization
src/azure-cli/azure/cli/command_modules/appconfig/tests/latest/test_appconfig_enhanced_feature_commands.py	Adds scenario coverage for enhanced feature flags
src/azure-cli/azure/cli/command_modules/appconfig/tests/latest/recordings/test_azconfig_enhanced_feature.yaml	Adds recording for the new scenario test

Review details

Files reviewed: 11/11 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+def _serialize_feature_flag(feature_flag, fields=None):
+    result = {
+        FeatureFlagConstants.NAME: feature_flag.name,
+        FeatureFlagConstants.ENABLED: feature_flag.enabled,
+        FeatureFlagConstants.LABEL: feature_flag.label,
+        FeatureFlagConstants.DESCRIPTION: feature_flag.description,
+        FeatureFlagConstants.CONDITIONS: feature_flag.conditions.as_dict() if feature_flag.conditions is not None else None,
+        FeatureFlagConstants.VARIANTS: [variant.as_dict() for variant in feature_flag.variants] if feature_flag.variants is not None else None,
+        FeatureFlagConstants.ALLOCATION: feature_flag.allocation.as_dict() if feature_flag.allocation is not None else None,
+        FeatureFlagConstants.TELEMETRY: feature_flag.telemetry.as_dict() if feature_flag.telemetry is not None else None,
+        FeatureFlagConstants.TAGS: feature_flag.tags,
+        FeatureFlagConstants.LAST_MODIFIED: feature_flag.last_modified,
+    }
+
+    if fields:
+        return {field: result[field] for field in fields if field in result}
+
+    return result


Add set/show/list/delete/enable/disable commands backed by the new data-plane FeatureFlagClient. Supports --telemetry-enabled and --fields (including variants and allocation); drops the --key property. Includes help, output formatting, params, a scenario test with recording, and a HISTORY entry.

…d top-level set arguments Support defining the entire enhanced feature flag with --flag using full JSON or shorthand syntax (mirroring the data-plane API schema), and add top-level --enable/--description/--tags/--telemetry-enabled arguments. --flag is a full replacement and is mutually exclusive with the per-property arguments. Re-recorded the scenario test cassette. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…to `--feature-name` and tidy validators/registration Use feature_name as the parameter/dest for the enhanced feature flag name across params, handlers and tests (option is now --feature-name only). Split validation into validate_feature (classic feature commands) and validate_enhanced_feature_flag, and rename the --flag validator to validate_enhanced_feature_flag_input. Register the command group via a dedicated configstore_enhanced_featureflag_util CliCommandType. Update help examples and re-record the scenario test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Matthew Metcalf (mrm9084) · 2026-10-07T22:43:58Z

+        - name: List all enhanced feature flags.
+          text:
+            az appconfig enhanced-feature-flag list -n MyAppConfiguration


This shows how to list all enhanced feature flags, but do we show how to list all feature flags without labels. i.e. \0

Good call — added an example using --label \0 to list flags with null labels.

Matthew Metcalf (mrm9084) · 2026-10-07T22:46:00Z

+        - name: Enable an enhanced feature flag using App Configuration store name.
+          text:
+            az appconfig enhanced-feature-flag enable -n MyAppConfiguration --feature-name color --label test
+        - name: Force enabling an enhanced feature flag using connection string.


Why do we use the word Force here and in disable. We don't use that word for the other items. Is it because you are also adding in --yes, but we use without confirmation in the other items.

Used "Force" to match the existing az appconfig feature enable/disable help, which already phrases the --yes example that way (L592) — happy to switch everything to "without confirmation" if you prefer.

Separately: the classic feature module has no --enable on set, only standalone enable/disable. Should I drop --enable from enhanced-feature-flag set to match that pattern, or keep it for convenience? Jimmy Campbell (@jimmyca15)

I think we should keep the stand alone Enable/Disable, these are meant to be better feature flags.

Matthew Metcalf (mrm9084) · 2026-10-07T22:54:30Z

+                        "--requirement-type or --telemetry-enabled.")
+
+    with self.argument_context('appconfig enhanced-feature-flag show') as c:
+        c.argument('fields', arg_type=enhanced_feature_fields_arg_type)


Is there a reason this one doesn't have help?

The help text is defined on the shared enhanced_feature_fields_arg_type (help='Customize output fields for Enhanced Feature Flags.'), so the fields argument inherits it here rather than specifying help inline.

Matthew Metcalf (mrm9084) · 2026-10-07T23:08:53Z

+    if auth_mode == "anonymous":
+        try:
+            feature_flag_client = FeatureFlagClient(
+                base_url=endpoint,
+                credential=AzureKeyCredential(key=""),
+                id_credential="",
+                user_agent=HttpHeaders.USER_AGENT,
+                transport=AuthHeaderRequestsTransport(),
+                retry_policy=retry_policy)
+        except (ValueError, TypeError) as ex:
+            raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))
+
+    if auth_mode == "key":
+        connection_string = resolve_connection_string(cmd, name, connection_string)
+        try:
+            feature_flag_client = FeatureFlagClient.from_connection_string(connection_string=connection_string,
+                                                                           user_agent=HttpHeaders.USER_AGENT,
+                                                                           retry_policy=retry_policy)
+        except ValueError as ex:
+            raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))
+
+    if auth_mode == "login":
+        credential, endpoint = resolve_login_credential(cmd, name, endpoint)
+        try:
+            feature_flag_client = FeatureFlagClient(credential=credential,
+                                                    base_url=endpoint,
+                                                    user_agent=HttpHeaders.USER_AGENT,
+                                                    retry_policy=retry_policy)
+        except (ValueError, TypeError) as ex:
+            raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))


Suggested change

if auth_mode == "anonymous":

try:

feature_flag_client = FeatureFlagClient(

base_url=endpoint,

credential=AzureKeyCredential(key=""),

id_credential="",

user_agent=HttpHeaders.USER_AGENT,

transport=AuthHeaderRequestsTransport(),

retry_policy=retry_policy)

except (ValueError, TypeError) as ex:

raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))

if auth_mode == "key":

connection_string = resolve_connection_string(cmd, name, connection_string)

try:

feature_flag_client = FeatureFlagClient.from_connection_string(connection_string=connection_string,

user_agent=HttpHeaders.USER_AGENT,

retry_policy=retry_policy)

except ValueError as ex:

raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))

if auth_mode == "login":

credential, endpoint = resolve_login_credential(cmd, name, endpoint)

try:

feature_flag_client = FeatureFlagClient(credential=credential,

base_url=endpoint,

user_agent=HttpHeaders.USER_AGENT,

retry_policy=retry_policy)

except (ValueError, TypeError) as ex:

raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))

try:

if auth_mode == "anonymous":

feature_flag_client = FeatureFlagClient(

base_url=endpoint,

credential=AzureKeyCredential(key=""),

id_credential="",

user_agent=HttpHeaders.USER_AGENT,

transport=AuthHeaderRequestsTransport(),

retry_policy=retry_policy)

elif auth_mode == "key":

connection_string = resolve_connection_string(cmd, name, connection_string)

feature_flag_client = FeatureFlagClient.from_connection_string(connection_string=connection_string,

user_agent=HttpHeaders.USER_AGENT,

retry_policy=retry_policy)

elif auth_mode == "login":

credential, endpoint = resolve_login_credential(cmd, name, endpoint)

feature_flag_client = FeatureFlagClient(credential=credential,

base_url=endpoint,

user_agent=HttpHeaders.USER_AGENT,

retry_policy=retry_policy)

except (ValueError, TypeError) as ex:

raise CLIError("Failed to initialize FeatureFlagClient due to an exception: {}".format(str(ex)))

Is there a reason that we just do multiple ifs and just just have the single except?

No real reason — collapsed it into a single try/except with if/elif. Thanks!

Matthew Metcalf (mrm9084) · 2026-10-07T23:17:16Z

+    if unknown_keys:
+        raise InvalidArgumentValueError(
+            "Unsupported feature flag properties: {}. Allowed properties: {}.".format(
+                ", ".join(sorted(unknown_keys)),
+                ", ".join(sorted(FEATURE_FLAG_PROPERTIES))))


Is there a reason we don't allow unknown fields? This is usually how we had new features. We don't block them in the data plane I believe.

Agreed — dropped the allow-list check so unknown properties flow through to the data plane.

Matthew Metcalf (mrm9084) · 2026-10-07T23:22:06Z

+    if feature_flag is None:
+        raise CLIErrors.ResourceNotFoundError("Enhanced feature flag '{}' with label '{}' does not exist.".format(feature_name, label))


Why is this here feature flag client can't return None should it just be up in the resource not found error?

Good point. Updated the delete function so there is no redundant None handling in delete anymore.

Matthew Metcalf (mrm9084) · 2026-10-07T23:23:57Z

+    confirmation_message = "Are you sure you want to delete the enhanced feature flag '{}' with label '{}'?".format(feature_name, label)
+    user_confirmation(confirmation_message, yes)
+
+    try:
+        deleted_feature_flag = feature_flag_client.delete_feature_flag(name=feature_name, label=label)
+    except HttpResponseError as exception:
+        raise CLIErrors.AzureResponseError(str(exception))


I doubt it is actually an issue, but what happens if a feature flag is deleted while waiting for this conformation. I assume it would raise a weird cli error on line 176?

Just verified that deletes only happen after user_confirmation, and each one is etag-guarded (If-Match via IfNotModified). So if a flag is removed while we wait, the service returns 412 and we surface it as an a error in line 176. This mirrors az appconfig kv delete and az appconfig feature delete.

Yong Zhang (yonzhan) · 2026-10-08T06:20:45Z

Please fix CI issues

- Consolidate FeatureFlagClient auth-mode init into a single try/except - Allow unknown properties in --flag for forward compatibility - Support deleting multiple enhanced feature flags via name/label/tag filters - Add list example for null labels and update delete help/examples - Re-record scenario test for the new multi-delete behavior Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…onsistency with feature set Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Matthew Metcalf <mrm9084@gmail.com>

Copilot AI lite review requested due to automatic review settings September 8, 2026 10:26

Christine Wanjau (ChristineWanjau) requested review from a team as code owners September 8, 2026 10:26

azure-client-tools-bot-prd Bot added this to the October 2026 (2026-10-06) milestone Sep 8, 2026

microsoft-github-policy-service Bot requested review from Avani Gupta (avanigupta), Yu Chen (jsntcy), Julie Zhu (yanzhudd) and Yong Zhang (yonzhan) September 8, 2026 10:26

microsoft-github-policy-service Bot added App Configuration Auto-Assign Auto assign by bot act-codegen-extensibility-squad labels Sep 8, 2026

Copilot started reviewing on behalf of Christine Wanjau (ChristineWanjau) September 8, 2026 10:26 View session

Christine Wanjau (ChristineWanjau) changed the title ~~{App Config} az appconfig enhanced-feature-flag: Add command group for enhanced feature flags~~ [App Config] az appconfig enhanced-feature-flag: Add command group for enhanced feature flags Sep 8, 2026

Yong Zhang (yonzhan) assigned Ethan Yang (necusjz) Sep 8, 2026

Yong Zhang (yonzhan) requested a review from Ethan Yang (necusjz) September 8, 2026 10:31

Copilot AI reviewed Sep 8, 2026

View reviewed changes

Christine Wanjau (ChristineWanjau) marked this pull request as draft September 21, 2026 16:45

Christine WANJAU and others added 2 commits October 4, 2026 07:45

Christine Wanjau (ChristineWanjau) force-pushed the cwanjau/enhancedFeatureFlags branch from 8ccc9dd to 2999399 Compare October 4, 2026 04:45

Christine Wanjau (ChristineWanjau) marked this pull request as ready for review October 5, 2026 09:54

Matthew Metcalf (mrm9084) reviewed Oct 7, 2026

View reviewed changes

Matthew Metcalf (mrm9084) approved these changes Oct 8, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/appconfig/_help.py Outdated

Christine WANJAU and others added 2 commits October 8, 2026 19:12

{appconfig} enhanced-feature-flag set: Remove --enable argument for c…

9009cda

…onsistency with feature set Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update src/azure-cli/azure/cli/command_modules/appconfig/_help.py

a362ad1

Co-authored-by: Matthew Metcalf <mrm9084@gmail.com>

		if feature_flag is None:
		raise CLIErrors.ResourceNotFoundError("Enhanced feature flag '{}' with label '{}' does not exist.".format(feature_name, label))

Conversation

Christine Wanjau (ChristineWanjau) commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Related command

Description

Examples

Testing

Uh oh!

Yong Zhang (yonzhan) commented Sep 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Christine Wanjau (ChristineWanjau) Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Christine Wanjau (ChristineWanjau) Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Christine Wanjau (ChristineWanjau) Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Christine Wanjau (ChristineWanjau) Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Yong Zhang (yonzhan) commented Oct 8, 2026

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Christine Wanjau (ChristineWanjau) commented Sep 8, 2026 •

edited

Loading

Christine Wanjau (ChristineWanjau) Oct 8, 2026 •

edited

Loading

Christine Wanjau (ChristineWanjau) Oct 8, 2026 •

edited

Loading

Christine Wanjau (ChristineWanjau) Oct 8, 2026 •

edited

Loading

Christine Wanjau (ChristineWanjau) Oct 8, 2026 •

edited

Loading