Quantum: add az quantum workspace user list command

[Konstantin Averkiev (kaverkiev)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️quantum

rule	cmd_name	rule_message	suggest_message
⚠️ 1001 - CmdAdd	quantum workspace user list	cmd quantum workspace user list added

Summary

Adds az quantum workspace user list to list the users (user principals) with access to an Azure Quantum workspace. To match the Azure Quantum portal, only user principals are listed — groups and service principals are excluded. Supports --role (defaults to Quantum Workspace Data Contributor) and --include-inherited (to also include access inherited from the parent resource group/subscription).

Details

Lists Azure RBAC role assignments scoped to the workspace.
Supports --assignee, --assignee-object-id, and --role filters (reuses the existing workspace user params).
Adds an opt-in --include-inherited flag to also surface access inherited from the parent resource group and subscription (assignments granted above the workspace scope).

Testing

New unit tests: scope construction, --include-inherited pass-through, and table transformer.
Added a live user list check to the test_workspace_user scenario.
Manually verified against a live workspace (default vs --include-inherited).

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-client-tools-bot-prd]

Hi Konstantin Averkiev (@kaverkiev),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR adds a new az quantum workspace user list command to the Quantum extension to enumerate Azure RBAC role assignments relevant to an Azure Quantum workspace, with optional inclusion of inherited (parent-scope) assignments, and updates tests/help/versioning accordingly.

Changes:

• Added quantum workspace user list command wired to a new list_users operation and a transform_users table transformer.
• Introduced --include-inherited support and updated help text for the new command.
• Added unit tests + a live scenario check; bumped extension version and updated HISTORY.rst.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/quantum/setup.py	Bumps extension version to 1.0.0b21.
src/quantum/HISTORY.rst	Adds release notes entry for the new workspace user list command.
src/quantum/azext_quantum/tests/latest/test_quantum_workspace.py	Adds unit tests for scope/flags/transformer and a live scenario assertion for listing users.
src/quantum/azext_quantum/operations/workspace.py	Implements list_users() using role assignment listing + filtering.
src/quantum/azext_quantum/commands.py	Adds transform_users and registers az quantum workspace user list.
src/quantum/azext_quantum/_params.py	Adds --include-inherited argument; updates --role help to cover list behavior.
src/quantum/azext_quantum/_help.py	Adds help + examples for quantum workspace user list.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Zulfat Nutfullin (rigidit)]

fill_principal_name=False removed the duplicate Graph calls, but workspace.py:515-521 still loops and calls list_role_assignments twice, and fill_role_definition_name still defaults to True. That enumerates every role definition visible at the workspace scope (hundreds of built-ins) — twice. azure-cli's own help calls this out: "Fill roleDefinitionName property in addition to roleDefinitionId. This operation is expensive."

A single call filtered client-side halves the ARM traffic, consider to changing to:

def list_users(cmd, resource_group_name=None, workspace_name=None, include_inherited=True):
    from azure.cli.command_modules.role.custom import list_role_assignments

    info = WorkspaceInfo(cmd, resource_group_name, workspace_name)
    scope = _get_workspace_resource_id(info)
    assignments = list_role_assignments(cmd, scope=scope, include_inherited=include_inherited)
    quantum_roles = (QUANTUM_WORKSPACE_DATA_CONTRIBUTOR_ROLE_ID, QUANTUM_WORKSPACE_OWNER_ROLE_ID)
    users = [a for a in assignments
             if a.get("principalType") == "User"
             and a.get("roleDefinitionId", "").rsplit("/", 1)[-1].lower() in quantum_roles]
    _fill_user_display_names(cmd, users)
    return users
    ```

[Konstantin Averkiev (kaverkiev)]

1. This change broke order (Data contributor first) that you are requested before. Single call returns ARM's order, so we'd need an explicit client-side sort to keep Contributor-first. Extra logic. Please confirm.
2. You dropped fill_principal_name=False. Without it you will re-introduce the Graph redundancy that I just removed
3. Potentially unfiltered call returns all roles at scope before filtering. With a busy subscription scope the response is might be huge.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Zulfat Nutfullin (rigidit)]

Can we change that to "Time Added"?

[Konstantin Averkiev (kaverkiev)]

What is the reason for this rename? It will break consistency with OS shell. Currently, we mirroring OS Shell structure, just as we discussed.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).