通过PowerShell调用Graph API无法将设备添加到Entra ID安全组

我编写了一个PowerShell脚本，通过注册表检测设备上的应用存在情况，将Intune设备添加到Entra ID安全组。脚本能正常检测并获取设备信息，但调用Graph API添加设备到组时出现405 Method Not Allowed错误，Fiddler显示错误为Request_BadRequest，提示请求目标不允许指定HTTP方法。相关函数代码如下：

# Function to add device to security group
function Add-DeviceToGroup {
    param (
        [string]$DeviceID
    )
    $token = Get-GraphToken
    $headers = @{ Authorization = "Bearer $token"; "Content-Type" = "application/json" }
    
    $body = @{
        "@odata.id" = "https://graph.microsoft.com/v1.0/devices/$DeviceID"
    } | ConvertTo-Json -Depth 2

    $url = "https://graph.microsoft.com/v1.0/groups/$SecurityGroupID/members/'$ref"
    $response = Invoke-RestMethod -Method Post -Uri $url -Headers $headers -Body $body

    Write-Host "Device successfully added to security group." -ForegroundColor Green
}

问题根源 #

代码中URL格式错误是触发405错误的核心原因：

• 错误URL包含多余单引号：members/'$ref，Graph API的正确端点应为members/$ref
• PowerShell双引号字符串中，$ref会被解析为变量，必须转义$符号避免错误解析

修正后的代码 #

# Function to add device to security group
function Add-DeviceToGroup {
    param (
        [string]$DeviceID
    )
    $token = Get-GraphToken
    $headers = @{ 
        Authorization = "Bearer $token"
        "Content-Type" = "application/json"
    }
    
    $body = @{
        "@odata.id" = "https://graph.microsoft.com/v1.0/devices/$DeviceID"
    } | ConvertTo-Json -Depth 2

    # 修正URL：转义$符号，移除多余单引号
    $url = "https://graph.microsoft.com/v1.0/groups/$SecurityGroupID/members/`$ref"
    try {
        $response = Invoke-RestMethod -Method Post -Uri $url -Headers $headers -Body $body -ErrorAction Stop
        Write-Host "Device successfully added to security group." -ForegroundColor Green
    }
    catch {
        Write-Host "Error adding device to group: $_" -ForegroundColor Red
        # 输出详细错误信息辅助排查
        Write-Host "Response content: $($_.Exception.Response.Content.ReadAsStringAsync().Result)" -ForegroundColor Red
    }
}

额外排查要点 #

• 权限验证：确保Get-GraphToken获取的令牌包含GroupMember.ReadWrite.All或Directory.ReadWrite.All权限（应用权限需管理员提前同意）
• ID正确性：确认$SecurityGroupID是Entra安全组的Object ID（GUID），$DeviceID是Entra设备的Object ID（而非Intune设备ID）
• API版本：使用v1.0版本端点是正确的，无需切换到beta版本

内容的提问来源于stack exchange，提问作者Gacrux