Switch ExecuteAzCommandRobustly calls to Invoke-Az with native array format

[Copilot]

Replace all ExecuteAzCommandRobustly string-format calls with Invoke-Az (array format, native az execution). Eliminate direct az calls outside of initialization/login contexts.

Changes

• permissions.ps1: Convert 12 call sites — string-based ExecuteAzCommandRobustly, direct az calls, and -callAzNatively calls → Invoke-Az with array params. Retain ExecuteAzCommandRobustly -callAzNatively only where -principalId/-appRoleId/-GraphBaseUri params are needed.
• app-service.ps1: Convert 10 call sites including two bare az calls in CreateSCEPmanDeploymentSlot. Retain ExecuteAzCommandRobustly only for two calls needing -noSecretLeakageWarning.
• appregistrations.ps1: Convert 8 call sites including the bare az ad app list call in RegisterAzureADApp.
• key-vault.ps1: Convert 4 call sites (3 keyvault set-policy + 1 REST call).
• log-analytics.ps1: Convert role assignment create call.
• subscriptions.ps1: Replace bare az account set with Invoke-Az.
• Sync-IntuneCertificate.ps1: Convert ad app update call.

Before:

ExecuteAzCommandRobustly -azCommand "az webapp deployment slot list --name $name --resource-group $rg --query '[].name'"
$azOutput = az webapp deployment slot create --name $name ...

After:

Invoke-Az @("webapp", "deployment", "slot", "list", "--name", $name, "--resource-group", $rg, "--query", "[].name")
$null = Invoke-Az @("webapp", "deployment", "slot", "create", "--name", $name, ...)

Test updates

• app-service.Tests.ps1: Fix GetDeploymentSlots call to use correct parameter names (-appServiceName/-resourceGroup) — previously masked by string interpolation of nulls.
• subscriptions.Tests.ps1: Add account set handler to Invoke-Az mock since this call now routes through Invoke-Az instead of bare az.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• aka.ms
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli extension add --name resource-graph --only-show-errors ader (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli extension add --name resource-graph --only-show-errors (dns block)
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli extension add --name resource-graph --only-show-errors user.email (dns block)
• azcliprod.blob.core.windows.net
  • Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli ad app list --filter displayname eq 'new-app' --query [0] --only-show-errors (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)