How to add members to a Group using Microsoft Graph API - azure-active-directory

How do I add Members to a Group via Microsoft Graph API?
According to documentation for adding Member to a particular Group, it requires the call below:
POST https://graph.microsoft.com/v1.0/groups/{id}/members/$ref
Content-type: application/json
Content-length: 30
{
"#odata.id": "https://graph.microsoft.com/v1.0/users/{id}"
}
My questions lies in this API:
https://graph.microsoft.com/v1.0/groups/{id}/members/$ref
{id} => the group id,
members => adding members to the group
Now where is the users/members data/parameter to be added or posted?
Is it "#odata.id": "https://graph.microsoft.com/v1.0/users/{id}"?
Do I post #odata.id values as a member/users parameter when adding a member to a group?

That is correct. What you're technically passing is an ODATA Reference (ref$) to the user object within Active Directory rather than just an id.
To illustrate, lets take this fictitious user:
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
"id": "48d31887-5fad-4d73-a9f5-3c356e68a038",
"businessPhones": [
"+1 412 555 0109"
],
"displayName": "Megan Bowen",
"givenName": "Megan",
"jobTitle": "Auditor",
"mail": "MeganB#M365x214355.onmicrosoft.com",
"mobilePhone": null,
"officeLocation": "12/1110",
"preferredLanguage": "en-US",
"surname": "Bowen",
"userPrincipalName": "MeganB#M365x214355.onmicrosoft.com"
}
If we wanted to add Megan to the a Group with an id of 02bd9fd6-8f93-4758-87c3-1fb73740a315 the call would look like this:
POST https://graph.microsoft.com/v1.0/groups/02bd9fd6-8f93-4758-87c3-1fb73740a315/members/$ref
Content-type: application/json
{
"#odata.id": "https://graph.microsoft.com/v1.0/users/MeganB#M365x214355.onmicrosoft.com"
}

It is also working when passing user Id:
POST url: https://graph.microsoft.com/v1.0/groups/{group_id}/members/$ref
Content-type: application/json
Content string: {"#odata.id": "https://graph.microsoft.com/v1.0/users/{user_id}"}
group_id - group object id
user_id - user object id

Related

Salesforce Bulk API Delete by externalIdFieldName

Note I am not using Bulk Api 2.0
Is there way to delete salesforce objects using the external salesforce Id?
When I set up the job I sent the following:
{
"operation" : "delete",
"object" : "Subscription",
"contentType" : "JSON",
"externalIdFieldName": "ExternalId"
}
But when I post the batch with the external Id it fails;
Request:
[{"externalId":"123456789"}]
Response:
[
{
"success": false,
"created": false,
"id": null,
"errors": [
{
"message": "bad id 123456789",
"fields": [],
"statusCode": "MALFORMED_ID",
"extendedErrorDetails": null
}
]
}
]
Other combinations also fail:
[{"Id":"123456789"}]
[{"externalIdFieldName":"123456789"}]
It does delete if I use the salesforce ID
[{"Id":"xu97987oUv"}]
But I want to delete using the external ID if that is possible.
This is not possible. You have to query the salesforce record with the external id field to get the salesforce id of the record and use it to delete the record.

How to add service principal as an Owner to the Azure AD group through Graph API

My requirement is to create a group in Azure AD and add a service principal as an owner of that group through Graph API - While creating the group.
Reference Doc:
https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http
With reference to the above document, i am able to create group but the response object shown is not allowing service principal to be added as an Owner.
Body :
{
"description": "Testing 123",
"displayName": "SG-test-ei",
"mailEnabled": false,
"mailNickname": "SGP-test-ei",
"securityEnabled": true,
"owners#odata.bind": [
"https://graph.microsoft.com/v1.0/users/qwbhty-cdd0-4c42-b857-5b8ce0ae6a9e"
],
"members#odata.bind": [
"https://graph.microsoft.com/v1.0/users/7f3f587a-c40a-4a63-82b1-202f35c828ee"
]
}
Seems like, https://graph.microsoft.com/v1.0/users does not recognize ObjectID for a service principal.
My question is, what owners#odata.bind or API i should use in the body to add service principal as an Owner to the security group in Azure AD.
The example in the link uses /users.
POST https://graph.microsoft.com/v1.0/groups
Content-Type: application/json
{
"description": "Group with designated owner and members",
"displayName": "Operations group",
"groupTypes": [
"Unified"
],
"mailEnabled": true,
"mailNickname": "operations2019",
"securityEnabled": false,
"owners#odata.bind": [
"https://graph.microsoft.com/v1.0/users/26be1845-4119-4801-a799-aea79d09f1a2"
],
"members#odata.bind": [
"https://graph.microsoft.com/v1.0/users/ff7cb387-6688-423c-8188-3da9532a73cc",
"https://graph.microsoft.com/v1.0/users/69456242-0067-49d3-ba96-9de6f2728e14"
]
}
Replace this with /servicePrincipals like bellow:
"owners#odata.bind": [
"https://graph.microsoft.com/v1.0/servicePrincipals/00964c82-a7c2-4675-bbed-54bcf16328b3"
]

How to update user in auth0 with react?

This is what I have access to from the user:
email_verified
family_name
given_name
name
nickname
picture
sub
updated_at
The api wants an id /api/v2/users/{id}. I tried using the sub but it did not work. How do I get access to the user id? Or what else do I pass in?
When creating a user by posting to /api/v2/users the response contains the user_id as a field. The response you get looks e.g. like this:
{
"email": "john.doe#gmail.com",
"email_verified": false,
"username": "johndoe",
"phone_number": "+199999999999999",
"phone_verified": false,
"user_id": "usr_5457edea1b8f33391a000004", <-- this is the user id
"created_at": "",
"updated_at": "",
"identities": [
{
"connection": "Initial-Connection",
"user_id": "5457edea1b8f22891a000004",
"provider": "auth0",
"isSocial": false
}
],
"app_metadata": {},
"user_metadata": {},
"picture": "",
"name": "",
"nickname": "",
"multifactor": [
""
],
"last_ip": "",
"last_login": "",
"logins_count": 0,
"blocked": false,
"given_name": "",
"family_name": ""
}
You need that id in order to request user data via /api/v2/users/{id}.
If you don't the user_id you can try to get it via the /api/v2/users-by-email endpoint. The information you have according to your question is not enough. What happened to the other information?
EDIT:
What if I am using the lock widget to create users? How can I access
their id , and if not how can I update their information?
You can't create users using the lock widget. The user is registered on a social platform like facebook or google. The lock widget does only authenticate them via that platform any gives you some information about them which you of course can't edit because you do not own that data

Microsoft Azure AD graph API: How do I retrieve a user's email address?

I am able to get access to a user's accessToken, and am making a call to GET https://graph.microsoft.com/v1.0/me with an Authorization: Bearer <token> header.
However, in the response body I'm getting something like this:
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users",
"value": [
{
"givenName": "Foo",
"surname": "Bar",
"displayName": "Foo Bar",
"id": "b41efha115adcca29",
"userPrincipalName": "email.address#outlook.com",
"businessPhones": [],
"jobTitle": null,
"mail": null,
"mobilePhone": null,
"officeLocation": null,
"preferredLanguage": null
}
]
}
The mail property is null, and the userPrincipalName in this response body happens to the be the user's email address. However, there's this from Microsoft's docs:
Although the UPN and email share the same format, the value of the UPN for a user might or might not be the same as the email address of the user.
When initiating the login request of the user, we're requesting for the "user.read" and "email" scopes. We're using the MSAL.js library to obtain the access token, and our code reads something like this:
login (): ng.IPromise<IMicrosoftOAuthResponse> {
const prom = this.userAgentApplication.loginPopup(["user.read", "email"])
.then((idToken) => {
return this.userAgentApplication.acquireTokenSilent(["user.read", "email"]);
})
.then((accessToken) => {
// at this point, we have the accessToken and make a call to the graph api
});
return this.$q.when(prom);
}
How do I get the actual email address of the user here?
The mail property is set in one of 2 ways:
It's been set on on-premises AD, and then synchronized to Azure AD using AD Connect
The cloud user has been assigned an Office 365 license (and a mailbox), at which point the mail property is set for this licensed user.
If the user does not have an O365 mailbox/license, you could also search for the user by userPrincipalName, displayName, etc. $filter supports the OR operator.
Hope this helps,
Even though this is an old question, I thought I would share my solution to getting the email of a signed-in user. Be aware that this solution requires access to the user's id_token.
The response from calling the /me endpoint looks as follows:
Object {
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
"businessPhones": Array [],
"displayName": "John Doe",
"givenName": "John",
"id": "xxxxxx",
"jobTitle": null,
"mail": null,
"mobilePhone": null,
"officeLocation": null,
"preferredLanguage": null,
"surname": "Doe",
"userPrincipalName": "johndoe_gmail.com#EXT##johndoegmail.onmicrosoft.com",
}
As we can see, the mail property of this response is null. I am however able to get the user email by decoding the jwt id_token passed along with the access_token when calling the /token endpoint.
By applying the decodeJwtToken() function (attached at the end of this post) to the id_token, I am able to get the user email from the result
Object {
"aio": "xxxxxxxx",
"amr": Array [
"pwd",
],
"aud": "xxxxx",
"email": "johndoe#gmail.com",
"exp": xxxxxx,
"family_name": "Doe",
"given_name": "John",
"iat": xxxxxx,
"idp": "live.com",
"ipaddr": "xxx.xxx.xxx.xxx",
"iss": "https://sts.windows.net/xxxx/",
"name": "John Doe",
"nbf": xxxx,
"nonce": "xxx",
"oid": "xxxxxxx",
"sub": "xxxxx",
"tid": "xxxxx",
"unique_name": "live.com#johndoe#gmail.com",
"uti": "xxxx",
"ver": "1.0",
}
The decoding function looks as follows:
decodeIdToken = (token) => {
var base64Url = token.split('.')[1];
var base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
var jsonPayload = decodeURIComponent(Buffer.from(base64, 'base64').toString().split('').map(function(c) {
return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
}).join(''));
return JSON.parse(jsonPayload);
};
For me, https://graph.microsoft.com/v1.0/users/<userid>/authentication/emailMethods endpoint worked. For this, the client must have UserAuthenticationMethod.Read.All permission. One can find more documentation here.
Sample reponse:
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#users('8225f1cd-8025-4f8b-bf94-c595e02e3403')/authentication/emailMethods",
"value": [
{
"id": "3ddfcfc8-9383-446f-83cc-3ab9be4be18f",
"emailAddress": "kim#contoso.com"
}
]
}
var user = graphServiceClient.Users[UserId].Request().Select(x=>x.Identities).GetAsync();
var email = user.Identities.FirstOrDefault().IssuerAssignedId;
create a trial account in microsoft office 365 business premium using the below link:
https://signup.microsoft.com/Signup?OfferId=467eab54-127b-42d3-b046-3844b860bebf&dl=O365_BUSINESS_PREMIUM&culture=en-IN&country=IN&ali=1
Follow the steps while creating the account. It will allow us to create users in office 365. These users are like internal users of an organization. Now open azure portal with the above credential. All users of office 365 will be imported in active azure directory.
Now register an application with Read users basic profile delegated permission in active azure directory. note down client id , client secret and tenant domain to get access token for service to service authentication. This access token can be used to get user records which will be containing mail field as abc#.onmicrosoft.com

UNKNOWN_ENVELOPE_RECIPIENT When making Embedded Signing API Call

I am making an API Call to Docusign to try to get a link for a recipient to sign his document without him having to go into his e-mail. I am doing this in APEX in a Visualforce page.
I am sending the following request to the endpoint: "https://demo.docusign.net/restapi/v2/accounts/661863/envelopes/21F02F6C-E156-46E0-BCDE-778D18DB4592/views/recipient"
My Request is:
{
"authenticationMethod": "email",
"email": "test#outlook.com",
"returnUrl": "www.docusign.net",
"userName": "LB -1 Demo 2"
}
The response I am getting is:
{
"errorCode": "UNKNOWN_ENVELOPE_RECIPIENT",
"message": "The recipient you have identified is not a valid recipient of the specified envelope. Envelope recipient could not be determined. 'clientUserId', 'email', or 'userName' in request and envelope may not match."
}
The envelope request is:
{
"signers": [
{
"name": "LB -1 Demo 2",
"email": "test#outlook.com",
"recipientId": "1",
"requireIdLookup": "false",
"userId": "05b324da-8ebb-4d4b-a58b-0ef019530214",
"routingOrder": "1",
"roleName": "Signer 1",
"status": "completed",
"signedDateTime": "2014-06-24T11:30:09.4630000Z",
"deliveredDateTime": "2014-06-24T11:29:58.5100000Z"
}
],
"agents": [],
"editors": [],
"intermediaries": [],
"carbonCopies": [],
"certifiedDeliveries": [],
"inPersonSigners": [],
"recipientCount": "1",
"currentRoutingOrder": "1"
}
The recipient information seems to match my request but the API call is still not working. Is this because I am missing a clientUserId and that is required for am embedded signing call? And if so, would I need to create the Envelope AND Recipients AND ONLY THEN can I make the embedded signer call?
This question is a duplicate, please search the DocuSignApi tag for existing answers before posting new questions. As Andrew has mentioned, this is a duplicate of this question:
Docusign Embedded Signing
You need to set the clientUserId property for any recipient who you want to be an embedded recipient. It's up to you what value to use, but make sure you include the same exact value when requesting the signing URL token.
There's also a detailed explanation of this on the DocuSign Developer Center under Features -> Embedding
https://www.docusign.com/developer-center/explore/features/embedding-docusign

Resources