openBIM for AEC understanding

Within the AEC industry, standards are necessary to ensure that all project stakeholders are speaking the same language, thereby improving collaboration.  We can also process data to automate various processes if the data is standardised.

BIM (Building Information Modelling) is used to improve collaboration on infrastructure projects.  BIM is essentially ISO 19650, and it has various levels.  BIM is a Process! Not a technology vendor, the technology merely helps you with your BIM process.

Building Models contain 3D information that shows how assets fit together.  Each of these assets may contain properties that can be used to look for clash detections.  Think of a CAD diagram, it lays out the plans for a building so all parties can see the proposed plan.  As CAD technology advances, you can add more information about the project.  For example, as an electrician, I only want to see the layers that affect my work.  CAD can be further utilised to display product and material information.

closedBIM: These were the original big BIM systems, including AutoCAD, Revit, and Bentley ProjectWise.  These tools feature visual editors and viewers, enabling them to securely store the files required for a project and ensure that the appropriate individuals have access.  These all have their own proprietary standards.

openBIM: Read other parties' data, improves collaboration and consensus.  Easier to switch tools to reduce costs or get better features.  Consists of:

1. IFC (common language)
2. bSDD (industry common language)
3. IDS (Requirement specification)
4. BCF (check)
5. openCDE (sharing with APIS)

Industry Foundation Classes (IFC) serve as the basis for standardising how information is handled.  Has standards for location, such as geographic information.  Materials, Geometry, and Spatial Structures are covered by IFC classes.  In each industry, these base IFCs are added to.  The BuildingSmart bSDD is an extension of IFC for specialised industries and sectors, published to provide more specific, agreed-upon standards.  

Project Requirements: These can vary, but having an agreed-upon format, such as an Information Delivery Specification (IDS), is helpful. Although it is not necessary or widely used, it ensures that precise details are provided.  Therefore, collaboration allows all parties to clearly understand what is needed using IDS.

IDS uses bSDD, which is based on IFC, so that the requirement specifications are precisely laid out.

openCDE defines technical interfaces, .....

The History of BIM

I learnt a lot about BIM from a great BIM leader, Steph Neath.  Here is a diagram of the evolution of BIM from Steph:

Evolution of BIM (Building Information Modelling) as explained to me.

Introduction to ProjectWise and BIM

ProjectWise from Bentley - extend with Powershell

Postman Collection to connect to Bentley's REST API for ProjectWise (WSG)

Power BI reporting against ProjectWise (Project Insights) 

openBIM for AEC understanding & the History of BIM (this post)

AI Vendor Management - Formiti

AI is going crazy, and you can build your own but generally you need to look at a supplier, so it's worth understand management of Vendors, you as the controller using their service are at risk of them not making their AI operations transparent.  It's a big business risk to my clients.  

GDPR is closely linked to AI, and if you use a service/vendor, the reputation and fine risk may fall on you as the provider.  Need visibility into each vendor, how they are using AI, in turn they are using vendors so it's a nice complex dependency problem.  You need to be aware of what you are relying on.

Ensure contracts with vendors consider AI, how the process your data and how their sub process vendors do the same.

Track website customer behaviour, we use a vendor to clean up the data.  In turn, I have no idea that they are using AI outside of the UK or EU.  Follow the dependency chains as all this needs to be transparent to the end customer if needed.

Copilot Studio 2025 Notes

Copilot Studio is fantastic, the licensing is complex, and the AI integration is excellent. Architects really need to understand Licensing and billing, or AI will get out of control.  The Purview and governance look very good.  Copilot Studio Cost Estimator (preview June 2025)

MS Build 2025: 

MCP Server in Preview - possible to collect data from other AI services or write back.

Connector Kit - So, you can add custom connectors from Power Platform Connectors, including Copilot Studio - great stuff.

Agent Flow - Added functionality to Power Automate flows (Copilot Studio aware), deployed via solutions.

Note: The M365 Agent Toolkit appears to be an interesting tool that allows agents to perform tasks using Office add-ins with VS Code.

Licensing

You need to be aware:

• M365 agents - require all end users to have M365 Copilot licences, retailing at $20/user.  Alternatively, users can consume the agents using a PAYG model per message (it racks up quickly).  I can add these to MS Teams, and it appears that people with licences can ask the M365 agent, while others can view the results (some more testing and understanding are needed here by me).
• Copilot Studio - Requires a Copilot Studio AI Studio/maker licence at $30/retail. Users don't need a licence to use it, but you pay per message, and this can rack up quickly, so watch your usage. Buying bulk message credits can help reduce costs.
• Each prompt generates multiple messages, which are all billable (complex to calculate)
• (If you use Copilot Studio and it calls Azure AI Foundry, it also bills Tokens (also complex to estimate)
• Copilot Studio utilises the AI Foundry connector through its Premium connector.

My AI Posts

Microsoft Copilot Studio 2025 Simple Notes

Artificial Intelligence as a mega trend

Microsoft's Copilots Explained as the naming kills me

Prompt Engineering with Microsoft Copilot 

AI Model Comparison

Ignite 2023 - Keynotes - big push to AI Summary

Playwright Post 6 - Automating Canvas App MFA login for Playwright unattended for Canvas apps

Overview:  Modern security makes automating logins requiring MFA rather difficult.  This post looks at possible approaches to automate the login.

Option 1. Turn off MFA—not really, but you can set a conditional rule in EntraId to not perform MFA. This is not an option in many enterprises.

Option 2. Time-based One-Time Password (TOTP)—Microsoft Authenticator makes this pretty difficult. At least I can't do it, as the APIS are relatively limited. This is kind of expected, as it's a security measure.

Option 3. Programmatically acquire an access token without browser automation, use MSAL with a client secret or certificate (for confidential clients). 

Option 4.  Use Playwright to record the login and intercept the access token once logged in.  Then you can store it and use it.  There are a few easy options to get the session:

4.1. Retrieve the access token from the response once logged in

4.2. Retrieve from your local storage:

  const token = await page.evaluate(() => {

    return window.localStorage.getItem('adal.idtoken') || window.sessionStorage.getItem('adal.idtoken');

  });

4.3. Retrieve the token using Playwright at the command run level

Note: This adds the token to my repository. Don't save the token to your repository if you don't realise that the Access/Bearer token will expire depending on what your EntraId sets. The default is 1 hour.

Option 4.3.1. Like option 4.3, use the refresh token to silently generate a new Access token. You store the refresh token during the recorded login (by default, it lasts for 90 days) to generate a new access token when needed.

Option 4.3.2.  Take it further back to generate the refresh token using the access code you get at the original login, renew the "refresh token", and generate a new access token to run your tests.

If you decide to store your access token, refresh token or code, don't store them in your code repo.  You know why, if you've made it this far.

Thought: as a refresh token works for 90 days on a sliding scale, I've never used the option 4.3.2, as by storing the refresh token, all I need to do is to extend the refresh token by using it to get an access token, and the refresh token has 90 days from that point. 

This is the plan I'm thinking of using:

1. Store the refresh token in Azure Key Vault (AKV).
2. Your app retrieves the refresh token from AKV.
3. Uses the refresh token to get a new access token.
4. Store the new access token to run my ALM/CI/CD playwright tests

Playwright Series

Playwright Post 1 - Overview of E2E testing using Playwright

Playwright Post 2 - Continuously Test/Monitor Canvas apps and website with MFA enabled

Playwright Post 3 - Add App Insights logging inside your Playwright tests 

Playwright Post 4 - 6 Min walkthru of Playwright testing with Azure Monitor

Playwright Post 5 - Understanding how Playwright works

Playwright Post 6 - Unattended testing when secured with MFA (this post)

Entra AAD Security Groups - Remember

Overview: I have lost count of the number of poor Active Directory and Azure Active Directory environments I have encountered.  I don't think I've ever seen a good Active Directory, actually.  Certainly nothing significant over 5K 15k users. 

I'm working with a multinational, and we need to enhance our security measures.  Things are a bit all over the place, with oddly named and inconsistent elements, which is basically the norm for a 300k internal user enterprise with a history of multiple acquisitions.

I've identified a couple of properties that will create a nice hierarchy, but the issue is that I'm using more than the allowed 5k Dynamic AAD Security Groups.  

Summary of Entra, Microsoft 365 groups, and Distribution Lists work

Group Types to be aware of relating to Entra

1. Static AAD Security Groups

• Need to add users manually or automate the process for anything but the smallest Entra users.
• Static AAD Security groups can be nested.

2. Dynamic AAD Security Groups

• Up to 5,000 dynamic groups. Updated Oct 2025: 15,000 
• You can inherit Security groups or be inherited (no nesting).

3. Distribution AAD Groups

• Used for email and calendars, not security.  
• Only use distribution lists if the user does not have a P1 Entra licence.  
• Simpler and better to email-enable Static Security Groups.

4. O365 Groups/Teams Groups called Microsoft 365 Group

• A Microsoft 365 Group can inherit from O365 groups or AAD Security groups.  
• They are managed within the org, so it's not the best idea to place heavy security on manually managed teams. 

Resolution:

I have a whole hierarchy of users within divisions and subdivisions, and I add users statically via automation to their lowest-level AAD Security Group.  Then I can add the child groups.  This gives me multiple groups that have an increasing number of users as we go up the hierarchy.  Additive groups with positive security provide the best options for me.  Stop using Distribution lists and make the AAD Security Groups email-enabled.

Alternative option on Email:

Create an O365/Teams group, then add the Security groups to the team, and this will now be email-enabled.  This is more for a collaboration-type approach or if you want to use dynamic groups.

Future Wishes:

If only Entra supported more dynamic AAD Groups per tenant or allowed Dynamic groups to be nested in static AAD groups.

Playwright Post 5 - Understanding how Playwright Works

Playwright as a tool consists of two main parts.

Part 1: Playwright Library: This is the automation of a browser using the Page Object Model (POM). It provides a uniform API to run against the 3 main browser engines, automating tasks like navigating, clicking, filling in form data, and validating content on a web page. Classes include APIRequest, APIResponse, and BrowserContext. The worker process runs the API calls sequentially. Unified library API calls are sent to the browser context, which runs unaware of the calling context.  

Top link runs in Node.js and makes API library calls, there is no timing between the Node.js (Controller) and the browser instance (running Chromium instance)

Part 2: Test Runner: This part runs the Playwright tests.

Playwright Series

Playwright Post 1 - Overview of E2E testing using Playwright (this post)

Playwright Post 2 - Continuously Test/Monitor Canvas apps and website with MFA enabled 

Playwright Post 3 - Add App Insights logging inside your Playwright tests 

Playwright Post 4 - 6 Min walkthru of Playwright testing with Azure Monitor

Playwright Post 5 - Understanding how playwright works (this post)

Playwright Post 6 - Unattended testing when secured with MFA 

Other Posts

Upgrading two C# Blazor web applications and verifying using Playwright - super fast 

Mendix - Part 2 - Diving deeper (E2E automation testing of Mendix using Playwright)

Low-code testing with playwright walkthru

Continiously Monitor Apps using Playwright with TS

Testing Canvasa apps with Playwright using C# (rather use TS, it's better)

App Insights for Power Platform - Part 4 - Managed Environment Logging

Overview: You can setup logging on Managed Environments to send logs into Azure Monitor via Application Insights. This video shows the setup in under 2 minutes. 

Series:

App Insights for Power Platform - Part 1 - Series Overview 

App Insights for Power Platform - Part 2 - App Insights and Azure Log Analytics 

App Insights for Power Platform - Part 3 - Canvas App Logging (Instrumentation key)

App Insights for Power Platform - Part 4 - Managed Environment Logging (New 2025-05-09)

App Insights for Power Platform - Part 5 - Logging for APIM 

App Insights for Power Platform - Part 6 - Power Automate Logging

App Insights for Power Platform - Part 7 - Monitoring Azure Dashboards 

App Insights for Power Platform - Part 8 - Verify logging is going to the correct Log analytics

App Insights for Power Platform - Part 9 - Power Automate Licencing

App Insights for Power Platform - Part 10 - Custom Connector enable logging

App Insights for Power Platform - Part 11 - Custom Connector Behaviour from Canvas Apps Concern