From 39796eec9f87697c128c770da55161f603636cbd Mon Sep 17 00:00:00 2001
From: rmca14 <10053959+rmca14@users.noreply.github.com>
Date: Tue, 23 Jun 2026 16:37:18 -0700
Subject: [PATCH 1/2] New approval functionality

---
 .github/CODEOWNERS                            |  6 --
 .../workflows/MSecD-RequireWriterReview.yml   | 57 +++++++++++++++++++
 authorized-approvers.txt                      | 21 +++++++
 3 files changed, 78 insertions(+), 6 deletions(-)
 delete mode 100644 .github/CODEOWNERS
 create mode 100644 .github/workflows/MSecD-RequireWriterReview.yml
 create mode 100644 authorized-approvers.txt

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
deleted file mode 100644
index ff6cae36..00000000
--- a/.github/CODEOWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-@MicrosoftDocs/identity-sdk-cca-engineering-team
-
-# API documentation does not have code owners, but that is OK.
-# Anyone can create a PR to the `main` branch and we will review
-# the changes on the one-off basis.
-python/
diff --git a/.github/workflows/MSecD-RequireWriterReview.yml b/.github/workflows/MSecD-RequireWriterReview.yml
new file mode 100644
index 00000000..54c371fb
--- /dev/null
+++ b/.github/workflows/MSecD-RequireWriterReview.yml
@@ -0,0 +1,57 @@
+name: Approver Review
+
+permissions:
+  pull-requests: write
+  contents: read
+  statuses: write
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
+  issue_comment:
+    types:
+      - created
+      - edited
+
+concurrency:
+  # Separate groups per event type so that issue_comment runs do not cancel
+  # pull_request_target runs (and vice versa). The required check_run is only
+  # produced by pull_request_target runs, so cross-event cancellation can leave
+  # the required check stuck at "cancelled" even though policy ran successfully.
+  group: require-writer-review-${{ github.event.pull_request.number || github.event.issue.number }}-${{ github.event_name }}
+  # Only cancel high-frequency issue_comment runs. pull_request_target events
+  # queue (at most 1 running + 1 pending per group), so supersession does not
+  # produce a misleading red "cancelled" check on the PR's visible head SHA.
+  cancel-in-progress: ${{ github.event_name == 'issue_comment' }}
+
+jobs:
+  policy:
+    # Job-skip policy — the two trigger families are treated differently:
+    #
+    # pull_request_target events MUST never be skipped at the job level. They
+    # are the only events that publish the required check on the PR head SHA.
+    # A skipped reusable-workflow caller job surfaces as "Approver Review /
+    # policy", whereas a job that runs surfaces "Approver Review / policy /
+    # gate" — skipping some PR events would produce two different required-check
+    # names. The gate derives label qualification from live PR state (not the
+    # event payload), so running on non-qualifying PR events is an idempotent
+    # no-op and keeps a single check name.
+    #
+    # issue_comment events fire for EVERY comment on EVERY issue/PR in the repo
+    # (and again on every edit). The vast majority are not PRMerger commands,
+    # and the gate's own confirmation/hold-off comments would otherwise re-
+    # trigger it in a feedback loop. These runs never publish the required
+    # head-SHA check, so filtering them out is safe for branch protection. Only
+    # start an issue_comment run when a human posts a '#'-command on a PR.
+    if: >-
+      (github.repository_owner == 'MicrosoftDocs' || github.repository_owner == 'microsoftgraph')
+      && (
+        github.event_name != 'issue_comment'
+        || (
+          github.event.issue.pull_request != null
+          && startsWith(github.event.comment.body, '#')
+          && github.event.comment.user.type != 'Bot'
+        )
+      )
+    uses: MicrosoftDocs/defender-docs/.github/workflows/MSecD-Shared-RequireWriterReview.yml@workflows-test
+    secrets: inherit
diff --git a/authorized-approvers.txt b/authorized-approvers.txt
new file mode 100644
index 00000000..97335384
--- /dev/null
+++ b/authorized-approvers.txt
@@ -0,0 +1,21 @@
+# Authorized Approvers
+# Format: CODEOWNERS syntax — last matching rule wins per file.
+# Teams are resolved to individual members at runtime.
+#
+# Usage:
+#   <pattern>  @user1 @org/team @user2
+#
+# Rules:
+#   - The * catch-all should be first as the default/fallback.
+#   - Later rules override earlier ones for matching files.
+#   - To keep default owners on a specific folder, include them on that line too.
+
+# Default owners for everything unless a later match takes precedence
+* @MicrosoftDocs/msecd-org
+
+@MicrosoftDocs/identity-sdk-cca-engineering-team
+
+# API documentation does not have code owners, but that is OK.
+# Anyone can create a PR to the `main` branch and we will review
+# the changes on the one-off basis.
+python/
\ No newline at end of file

From 17eda9bef4c0c562c65d9d0e74f9e0df31c6ac23 Mon Sep 17 00:00:00 2001
From: rmca14 <10053959+rmca14@users.noreply.github.com>
Date: Tue, 23 Jun 2026 16:46:29 -0700
Subject: [PATCH 2/2] Test PR - do not merge

---
 msal-python-conceptual/advanced/aad-b2c.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/msal-python-conceptual/advanced/aad-b2c.md b/msal-python-conceptual/advanced/aad-b2c.md
index 1e99e89d..03113e63 100644
--- a/msal-python-conceptual/advanced/aad-b2c.md
+++ b/msal-python-conceptual/advanced/aad-b2c.md
@@ -19,7 +19,7 @@ You can use MSAL Python to sign-in users with social identities, acquire tokens,
 > [!IMPORTANT]
 > Effective May 1, 2025, Azure AD B2C will no longer be available to purchase for new customers. To learn more, please see [Is Azure AD B2C still available to purchase?](/azure/active-directory-b2c/faq?tabs=app-reg-ga#azure-ad-b2c-end-of-sale) in our FAQ.
 
-Azure AD B2C is built around the notion of [User Flows](/azure/active-directory-b2c/active-directory-b2c-reference-policies) (formerly known as policies). In MSAL Python, specifying a user flow translates to providing an authority.
+Azure AD B2C is built around the notion of [User Flows](/azure/active-directory-b2c/active-directory-b2c-reference-policies) (formerly known as policies). In MSAL Python, specifying a user flow translates to providing an authority. test PR
 
 * When you instantiate the client application, you need to specify the user flow in authority as
   `https://{tenant_name}.b2clogin.com/{tenant_name}.onmicrosoft.com/{user_flow}`.