RELOPS-2495: Manage Firefox WNS Entra identity

[jwmossmoz]

Summary

• Create a Mozilla-owned, multi-tenant Entra application for Firefox WNS work.
• Create its local service principal.
• Make the existing RelOps group members the owners.
• Export the application client ID and service principal object ID that the Windows App SDK requires.

Context

FIDE-3247 proposes an experiment for web push delivery while Firefox is closed. Its first experiment can use a scheduled Firefox background task. WNS remains the preferred low-latency architecture for a later production implementation.

Bug 1803416 used a personal Azure identity for the original pushproxy.exe prototype. This change provides the Mozilla-owned identity that the investigation needs. It does not approve or deploy the WNS product architecture.

Microsoft requires Windows App SDK push notification applications to use a multi-tenant Entra registration. The application client ID, Mozilla tenant ID, and local service principal object ID are required by the client and sender. The tenant ID already exists in the provider configuration, so this change does not add a duplicate output.

Security

The application client ID and service principal object ID are identifiers, not credentials.

This change does not create a client secret or another credential. A later change must choose a production credential only after the WNS sender and its credential store are defined. The credential must not be committed or exposed as a Terraform output.

This change does not grant Azure subscription RBAC. WNS uses the Entra directory identity and does not require access to Mozilla Azure resources.

Validation

• terraform -chdir=terraform/azure_ad validate
• uvx --from pre-commit pre-commit run --files terraform/azure_ad/sp_firefox_wns.tf
• git diff --check
• Autoreview after the ownership change: clean, with no accepted or actionable findings

Before merge or apply

• Merge or reconcile PR #313. Its Azure AD resources are already in Terraform state but are not in master; a plan from master currently proposes deleting them.
• Run a new plan and confirm that it only creates the Firefox WNS application and service principal.

References: RELOPS-2495, Microsoft Windows App SDK WNS quickstart