Add a365 network vnet for linking an Azure VNet to Agent 365

CHANGELOG.md

@@ -23,6 +23,7 @@ Agents provisioned before this release need `Agent365.Observability.OtelWrite` g
 **Option B — CLI** (`a365 setup admin`) has been removed in this release. Use Option A above, or copy the PowerShell instructions printed in the `a365 setup all` summary output.
 
 ### Added
+- `a365 network vnet link|unlink|status` — links an Azure virtual network to Agent 365 through a Power Platform NetworkInjection enterprise policy, replacing `Enable-SubnetInjection` (#494). Requires Global Administrator or Power Platform Administrator. See [docs/commands/network.md](docs/commands/network.md).
 - Setup and bootstrap now use Microsoft's first-party Agent 365 CLI application when it is present in your tenant, validating it without changing Microsoft's app registration, and fall back to a tenant-owned "Agent 365 CLI" app when it is not (#489).
 - Log separator written at the start of each CLI invocation now redacts values for secret-bearing options (e.g. `--idp-client-secret`) so they are not written to the log file in plain text.
 - Authentication context (tenant and user) is now logged at the `Information` level whenever the resolved sign-in identity changes, giving operators a clear audit trail in the log file of who the CLI is acting as, without exposing credentials.

docs/commands/README.md

@@ -27,6 +27,10 @@ There is reference documentation for each command.
 | [develop-mcp list-servers](https://learn.microsoft.com/microsoft-agent-365/developer/reference/cli/develop-mcp#develop-mcp-list-servers) | List MCP servers in a specific Dataverse environment. |
 | [develop-mcp publish](https://learn.microsoft.com/microsoft-agent-365/developer/reference/cli/develop-mcp#develop-mcp-publish) | Publish an MCP server to a Dataverse environment. |
 | [develop-mcp unpublish](https://learn.microsoft.com/microsoft-agent-365/developer/reference/cli/develop-mcp#develop-mcp-unpublish) | Unpublish an MCP server from a Dataverse environment. |
+| [network](network.md) | Configure tenant networking for Agent 365. |
+| [network vnet link](network.md#link) | Link a NetworkInjection enterprise policy to your Agent 365 environment. |
+| [network vnet unlink](network.md#unlink) | Remove the virtual network link from your Agent 365 environment. |
+| [network vnet status](network.md#status) | Show whether a virtual network policy is linked to your Agent 365 environment. |
 | [publish](https://learn.microsoft.com/microsoft-agent-365/developer/reference/cli/publish) | Update manifest.json ID values and publish the package. Configure federated identity and app role assignments. |
 | [query-entra](https://learn.microsoft.com/microsoft-agent-365/developer/reference/cli/query-entra) | Query Microsoft Entra ID for agent information including scopes, permissions, and consent status. |
 | [query-entra blueprint-scopes](https://learn.microsoft.com/microsoft-agent-365/developer/reference/cli/query-entra#query-entra-blueprint-scopes) | List configured scopes and consent status for the agent blueprint. |

docs/commands/network.md

@@ -0,0 +1,111 @@
+# `a365 network vnet`
+
+Links an Azure virtual network to Agent 365 via a Power Platform **NetworkInjection enterprise
+policy**, without needing the id of the Power Platform environment.
+
+## Why this command exists
+
+The documented subnet-injection flow
+([Set up virtual network support](https://learn.microsoft.com/power-platform/admin/vnet-support-setup-configure))
+ends with `Enable-SubnetInjection` from the `Microsoft.PowerPlatform.EnterprisePolicies` module,
+which takes an `-environmentId`. Agent 365 provisions a managed Power Platform environment for the
+tenant and does not publish its id, so that final step cannot be run.
+
+`a365 network vnet` replaces only that last step. The CLI reads the policy's `systemId` from Azure
+using your existing `az login`, then asks the Agent 365 platform to perform the link against the
+environment it resolves for your tenant.
+
+Everything before the final step is unchanged — keep using the PowerShell module to create the
+subnets, delegate them to `Microsoft.PowerPlatform/enterprisePolicies`, and create the policy with
+`New-SubnetInjectionEnterprisePolicy`.
+
+## Prerequisites
+
+- **Global Administrator** or **Power Platform Administrator** in the tenant. The platform rejects
+  anyone else.
+- An active `az login` session. It supplies two defaults: the tenant to operate on, and the
+  signed-in account to authenticate as. `--tenant-id` overrides the first; the account still comes
+  from `az login`. Tokens are not borrowed from Azure CLI -- both the ARM policy read and the
+  Agent 365 call acquire their own tokens through the CLI's sign-in.
+- A NetworkInjection enterprise policy already created by `New-SubnetInjectionEnterprisePolicy`,
+  with subnets delegated to `Microsoft.PowerPlatform/enterprisePolicies`.
+- Public cloud only. Sovereign clouds are not supported.
+
+## Subcommands
+
+| Command | Description |
+| --- | --- |
+| `a365 network vnet link` | Link a NetworkInjection enterprise policy to the tenant's Agent 365 environment. |
+| `a365 network vnet unlink` | Remove the virtual network link. |
+| `a365 network vnet status` | Show the current link, or check a running operation. |
+
+### `link`
+
+```bash
+a365 network vnet link --policy-arm-id <arm-id> [--swap] [--tenant-id <guid>] [--wait] [--yes]
+```
+
+| Option | Description |
+| --- | --- |
+| `--policy-arm-id`, `-p` | **Required.** ARM resource id of the policy, as returned by `New-SubnetInjectionEnterprisePolicy`. |
+| `--swap` | Replace an existing link to a *different* policy. Without it, a different existing link is reported as a conflict instead of being silently replaced. |
+| `--tenant-id` | Tenant to authenticate against. Defaults to the tenant of your current `az login`. |
+| `--wait` | Poll until the operation settles instead of returning an operation id. |
+| `--yes`, `-y` | Skip the confirmation prompt shown for `--swap`. |
+
+Linking the policy that is already linked is a no-op and succeeds without `--swap`.
+
+### `unlink`
+
+```bash
+a365 network vnet unlink [--tenant-id <guid>] [--wait] [--yes]
+```
+
+Unlink needs no policy id — the platform remembers which policy it linked. It prompts before
+removing the link; pass `--yes` in automation.
+
+### `status`
+
+```bash
+a365 network vnet status [--operation-id <id>] [--tenant-id <guid>]
+```
+
+Without `--operation-id`, reports the environment's current link. With one, reports that specific
+operation.
+
+## Statuses and exit codes
+
+| Status | Meaning |
+| --- | --- |
+| `Linked` | A policy is linked; `Policy` names it. |
+| `NotLinked` | No policy is linked. |
+| `Running` / `NotStarted` | The operation is still in flight; `Operation` is the handle to poll. |
+| `Failed` | The operation failed; `Reason` explains why. |
+
+Exit code is `1` on `Failed` or on any request error, and `0` otherwise — including a still-running
+operation, which is a legitimate outcome when `--wait` is not passed.
+
+## Typical flow
+
+```bash
+# 1. Create the policy with the PowerShell module (unchanged).
+./SubnetInjection/NewSubnetInjectionEnterprisePolicy.ps1 `
+    -subscription <sub> -resourceGroup <rg> -enterprisePolicyName <name> `
+    -enterprisePolicyLocation <region> -virtualNetworkId <vnetId> -subnetName <subnet>
+
+# 2. Link it — this replaces Enable-SubnetInjection.
+a365 network vnet link --policy-arm-id /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.PowerPlatform/enterprisePolicies/<name> --wait
+
+# 3. Confirm.
+a365 network vnet status
+```
+
+## Troubleshooting
+
+| Symptom | Cause |
+| --- | --- |
+| `Could not determine your Azure tenant` | No `az login` session. Run `az login`, or pass `--tenant-id`. |
+| `--tenant-id was supplied but is empty` | `--tenant-id` was passed with a blank value. Pass a tenant id, or omit the option entirely. |
+| `403` from the platform | Caller is not a Global or Power Platform Administrator, or the CLI app lacks consent for the `AgentTools.VNet.*` scopes. |
+| Conflict reported on `link` | A *different* policy is already linked. Re-run with `--swap`, or `unlink` first. |
+| Policy read fails | The policy ARM id is wrong, or your `az login` identity cannot read it. |