azureazure-active-directory

get all AAD groups in which service principal is added as member

I have a scenario, I need to write functional tests for my API(s). API uses Azure AD authentication. There are multiple roles in system and role of a user is decided on the basis of membership of different AD groups. so for functional test I need different users with in different groups.

I created a service principals with contributor rights in subscription and added them in groups and granted following Microsoft graph Application type API permissions. - Application.Read.All - Directory.Read.All

Now I used these apis to complete my use case.

1- https://login.microsoftonline.com/{tenant-Id}/oauth2/token

to get the access token against service principal.

2- GET https://graph.microsoft.com/v1.0/me/memberOf

to get the list of user's groups. but i got following response with authentication token of service principal.

{
    "error": {
        "code": "Request_ResourceNotFound",
        "message": "Resource 'xxxx471-bxxxa-45a2-b61b-18xxxxx42af88' does not exist or one of its queried reference-property objects are not present.",
        "innerError": {
            "request-id": "fxxxxc41-319e-xxxx-xxxx-360xxxx58077",
            "date": "2020-04-13T11:41:01"
        }
    }
}

I also have tried this

3- https://graph.microsoft.com/v1.0/users/{princialId}/memberOf

and get the following response

    "error": {
        "code": "Request_ResourceNotFound",
        "message": "Resource 'xxxxx-xxxx-xxxx-b61b-18421142af88' does not exist or one of its queried reference-property objects are not present.",
        "innerError": {
            "request-id": "fxxxxc41-319e-xxxx-xxxx-360xxxx58077",
            "date": "2020-04-14T05:59:03"
        }
    }
}

I have used object id of app registered in azure AD. when i searched service principal using power shell using following command I found different Object_Id than which is written on AD app on azure portal

command : get-AzureADServicePrincipal

with this Object_Id I was able to get service principal's groups using beta services.

https://graph.microsoft.com/beta/servicePrincipals/{object ID}/memberOf

anybody can explain why i was not able to get the groups of service principal using v1.0 service. Thanks

Solution

  • anybody can explain why i was not able to get the groups of service principal using v1.0 service.

    Because the v1.0 version does not support this API GET /servicePrincipals/{id}/memberOf , it just could be availale in the Beta version currently.

    You could check this doc - List servicePrincipal memberOf, select the Version with 1.0, then it will give a prompt message like below.

    enter image description here

    enter image description here

    I have used object id of app registered in azure AD. when i searched service principal using power shell using following command I found different Object_Id than which is written on AD app on azure portal

    The Object Id of the service principal is not the same with that of the App Registration, the one you got from the powershell is correct, also, you can find it in the portal in the Enterprise applications like below.

    enter image description here