Fix New-AzRoleAssignment error message to include service error details

[MaddyMicrosoft]

Description

This PR fixes error message clarity issues in role assignment and role definition cmdlets by surfacing service error details that were previously buried in exception properties.

Fixes #19605: New-AzRoleAssignment and Set-AzRoleAssignment now display descriptive error messages (e.g., "RoleAssignmentExists: The role assignment already exists") instead of generic HTTP status codes.

Fixes #19374: New-AzRoleDefinition and Set-AzRoleDefinition now surface service error details for validation failures and permission errors.

Additional fix: Replaced dead Hyak.Common.CloudException exception handler in CreateOrUpdateRoleDefinition that prevented the friendly "TenantNotAllowed" message from appearing since the SDK migration from Hyak to AutoRest.

Root Cause

The SDK-generated ErrorResponseException only includes HTTP status codes in its message (e.g., "Operation returned an invalid status code 'Conflict'"). The actual service error details (error code and message) are buried in ex.Body.Error or ex.Response.Content, making it difficult for users to diagnose issues.

Changes:

• Created AuthorizationErrorResponseExceptionHelper in src/Resources/Resources/Helper/ to extract error details from ErrorResponseException and wrap them in AzPSCloudException with both user-facing and telemetry-safe messages
• Applied error enrichment to:
  • CreateRoleAssignment (used by New-AzRoleAssignment)
  • UpdateRoleAssignment (used by Set-AzRoleAssignment)
  • FilterRoleDefinitions (used internally when -RoleDefinitionName is specified in role assignment cmdlets)
  • CreateOrUpdateRoleDefinition (used by New-AzRoleDefinition and Set-AzRoleDefinition)
• Added 4 unit tests in AuthorizationErrorResponseExceptionHelperTests.cs covering all error extraction code paths
• Telemetry uses desensitized error codes (PII-safe per GDPR requirements)
• Updated ChangeLog.md

Example - Before this PR:

PS> New-AzRoleAssignment -ObjectId $principalId -RoleDefinitionName "Reader" -Scope "/subscriptions/bad-guid" New-AzRoleAssignment: Operation returned an invalid status code 'Conflict'. RoleAssignmentExists: The role assignment already exists.

Testing

• Added 4 unit tests (all passing)
• Manually validated against live Azure subscription with various error scenarios
• Existing 27 role assignment scenario tests pass
• Build and static analysis pass

Mandatory Checklist

• Please choose the target release of Azure PowerShell.

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Updated src/Resources/Resources/ChangeLog.md under ## Upcoming Release header with description of error message improvements
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
  • Not applicable - no cmdlet API changes, error message improvements only
• SHOULD have proper test coverage for changes in pull request.
  • Added AuthorizationErrorResponseExceptionHelperTests.cs with 4 unit tests covering all code paths
  • Manually validated error scenarios against live Azure subscription
  • Existing 27 scenario tests for role assignments continue to pass
• SHOULD NOT adjust version of module manually in pull request
  • No version changes made

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

[Copilot]

Pull request overview

This PR improves user-facing error messages in the Az.Resources authorization cmdlets by extracting and surfacing service-provided error details (code/message) from ErrorResponseException, rather than only showing generic HTTP status-code exceptions.

Changes:

• Added AuthorizationErrorResponseExceptionHelper to convert Authorization SDK ErrorResponseException into AzPSCloudException with more descriptive messages.
• Updated role assignment/definition flows in AuthorizationClient to catch ErrorResponseException and rethrow enriched exceptions (including fixing a dead Hyak exception handler).
• Added unit tests for the helper and updated ChangeLog.md with the user-visible behavior change and issue references.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/Resources/Resources/Models.Authorization/AuthorizationClient.cs	Wraps specific Authorization SDK calls to rethrow enriched, user-friendly exceptions; replaces obsolete Hyak exception handling.
src/Resources/Resources/Helper/AuthorizationErrorResponseExceptionHelper.cs	New helper to extract error details from ErrorResponseException and build an AzPSCloudException.
src/Resources/Resources/ChangeLog.md	Documents the improved error messages and references issues [#19605] and [#19374].
src/Resources/Resources.Test/UnitTests/AuthorizationErrorResponseExceptionHelperTests.cs	Adds unit tests validating the helper’s message shaping and preservation of request/response.

[notyashhh]

Also, can you update the PR title?

[MaddyMicrosoft]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.