Open jonfuller opened 2 years ago
@jiasli for awareness
Actually, I am little bit curious why your result has "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity"
. Running az ad group member list
on my machine shows
> az ad group member list --group 796cd246-84fa-468d-a8ef-97b80b0943da
[
{
"@odata.type": "#microsoft.graph.user",
"businessPhones": [],
"displayName": "Admin",
"givenName": "Admin",
"id": "7a938a30-4226-420e-996f-4d48bca6d537",
"jobTitle": null,
"mail": null,
"mobilePhone": null,
"officeLocation": null,
"preferredLanguage": null,
"surname": null,
"userPrincipalName": "admin@AzureSDKTeam.onmicrosoft.com"
}
]
Even the raw HTTP response of az ad user list --verbose
only has "@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users"
.
Anyway, az ad user list
also has this behavior change
> az ad user list
[
{
"businessPhones": [],
"displayName": "2021-12-02-08-52-55-azps-demo-user1",
"givenName": null,
"id": "549e5db4-5f11-48c6-a646-bb515a19785d",
"jobTitle": null,
"mail": null,
"mobilePhone": null,
"officeLocation": null,
"preferredLanguage": null,
"surname": null,
"userPrincipalName": "2021-12-02-08-52-55-azps-demo-user_microsoft.com#EXT#@AzureSDKTeam.onmicrosoft.com"
},
This is described by https://docs.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http:
By default, only a limited set of properties are returned (businessPhones, displayName, givenName, id, jobTitle, mail, mobilePhone, officeLocation, preferredLanguage, surname, and userPrincipalName). To return an alternative property set, specify the desired set of user properties using the OData $select query parameter. For example, to return displayName, givenName, and postalCode, add the following to your query $select=displayName,givenName,postalCode.
I will mark this issue as a feature request to support $select
query parameter.
For now, you may directly call az rest
(https://github.com/Azure/azure-cli/issues/22580) to use $select
query parameter.
Hi there,
Which permission is required to show these properties when using the az ad group member list
command?
I can successfully get the properties when running with my account but when running it with an app principal all the properties return null values.
{ "@odata.type": "#microsoft.graph.user", "businessPhones": [], "displayName": null, "givenName": null, "id": "dc119ab6-74b6-461c-959e-bc170ece87ae", "jobTitle": null, "mail": null, "mobilePhone": null, "officeLocation": null, "preferredLanguage": null, "surname": null, "userPrincipalName": null }
PS.: it was working fine before but now the Azure AD API is deprecated and we have to use Graph API.
Thanks,
If anyone is on Azure DevOps and stuck with this issue I downgraded it with:
- script: |
AZ_REPO=$(lsb_release -cs)
echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" |
sudo tee /etc/apt/sources.list.d/azure-cli.list
sudo apt-get update
sudo apt-cache madison azure-cli
sudo apt-get install -y --allow-downgrades azure-cli=2.36.0-1~bionic
displayName: Downgrade Azure CLI
I see issues similar to @thiagottss in that Postman and the Graph Explorer work just fine, but az CLI and Azure AD PowerShell always return the same JSON object in the response. $select has no effect on the output.
using az rest
with the following URI: https://graph.microsoft.com/v1.0/users/[UPN]?$select=id,displayName,userPrincipalName,accountEnabled,onPremisesDistinguishedName
.
Maybe az CLI and PowerShell are missing some scopes when requesting the token? I see the following scopes in the access token from Graph Explorer and it's working as expected.
"scp": "DeviceManagementApps.Read.All DeviceManagementApps.ReadWrite.All DeviceManagementConfiguration.Read.All DeviceManagementConfiguration.ReadWrite.All DeviceManagementManagedDevices.PrivilegedOperations.All DeviceManagementManagedDevices.Read.All DeviceManagementManagedDevices.ReadWrite.All DeviceManagementRBAC.Read.All DeviceManagementRBAC.ReadWrite.All DeviceManagementServiceConfig.Read.All DeviceManagementServiceConfig.ReadWrite.All Directory.AccessAsUser.All Directory.ReadWrite.All IdentityRiskEvent.Read.All openid Organization.Read.All People.Read People.Read.All profile User.Read User.Read.All User.ReadBasic.All User.ReadWrite User.ReadWrite.All UserActivity.ReadWrite.CreatedByApp
az CLi version - 2.38.0
@jiasli - please advise when you can.
Just curious if anyone has gotten the az rest
workaround to work with $select
or if it's just me?
@jiasli - do you have any advice, please?
We have switched to az rest
:
previously:
$ az ad user list > users/aad.json
now:
NEXT_LINK=
counter=0
until [[ "${NEXT_LINK}" == "null" ]]; do
echo "Working on users-${counter}.json"
if [[ ${counter} == 0 ]]; then
az rest --method get --uri 'https://graph.microsoft.com/beta/users?$top=999&filter=accountEnabled+eq+true&select=accountEnabled,displayName,mail,otherMails,mailNickname' > users/users-${counter}.json
else
az rest --method get --uri "${NEXT_LINK}" > users/users-${counter}.json
fi
NEXT_LINK=$(jq -r '."@odata.nextLink"' users/users-${counter}.json)
counter=$(( counter + 1 ))
done
jq -s 'map(.value[])' users/users-?.json > users/aad.json
rm -rf users/users-${counter}.json
This is autogenerated. Please review and update as needed.
Describe the issue
We use the outputs of
az ad group member list
to drive other data-backed process within our company. Many of the attributes that used to be available as outputs from this command are longer output.What is the migration path to access those other pieces of information from the
azcli
?Command Name
az ad group member list
To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.
azcli
2.37 or higher (includes Microsoft Graph API migration)az ad group member list --group ExampleGroup
Expected Behavior
Prior to 2.37 an example output might look like:
Environment Summary
This is also happening on github actions, after upgrading to azure-cli 2.37.0
Additional Context
Any help would be much appreciated! Thanks in advance!