active-directory - Write requests are only supported on contained entities, Microsoft Graph API when trying to PATCH/POST to assign AD App role to user

Question

I'm trying to assign app-specific roles to a user in our AD group using Microsoft Graph.

The link I'm sending the request to:

https://graph.microsoft.com/beta/users/{oID of the user I want to assign the role to}/appRoleAssignments/{Object ID of the AD enterprise app}

Inside the request:

{"id": "ID of the role I'm trying to assign to the user"}

The error:

"code": "BadRequest", "message": "Write requests are only supported on contained entities",

The documentation doesn't define parameters in the example well and I've tried various possibilities but this is the only meaningful result I've gotten.

标签： active-directoryazure-active-directorymicrosoft-graph-api

Answer 1

Microsoft Graph 当前不支持此功能。要创建应用角色分配，您需要使用 Azure AD Graph：

POST https://graph.windows.net/myorganization/users/{user-object-id}/appRoleAssignments

{
    "principalId": "{user-object-id}",
    "resourceId": "{service-principal-object-id}",
    "id": "{app-role-id}"
}