使用Microsoft.Graph 5.69调用memberOf接口时Azure B2C返回500错误

我们的网站使用Microsoft.Graph 5.69.0 NuGet包调用Microsoft Graph API，获取Azure B2C目录中用户的成员身份时返回500错误。该功能此前正常运行，本周无代码变更，从Microsoft.Graph v4版本开始出现错误，升级至最新版本后问题依旧。

错误信息 #

Microsoft.Graph.Models.ODataErrors.ODataError: Resource 'memberOf' does not exist or one of its queried reference-property objects are not present.
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.ThrowIfFailedResponseAsync(HttpResponseMessage response, Dictionary`2 errorMapping, Activity activityForAttributes, CancellationToken cancellationToken)
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
   at Microsoft.Graph.Users.Item.MemberOf.MemberOfRequestBuilder.GetAsync(Action`1 requestConfiguration, CancellationToken cancellationToken)
   at profile.usafa.org.Controllers.APIController.AzureGroups(String objectId)
   at lambda_method189(Closure , Object )
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableObjectResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at profile.usafa.org.Startup.ProtectStaticFilesMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

调用代码 #

var graphClient = new GraphServiceClient(clientSecretCredential);

var tempresult = await graphClient.Users[objectId].GetAsync();

DirectoryObjectCollectionResponse result = null;
           
result = await graphClient.Users[objectId].MemberOf
    .GetAsync();

注：tempresult测试调用可成功获取用户信息，无异常。

已完成的检查 #

• 权限检查：应用已配置User.Read.All和Directory.Read.All权限，配置正确；
• API端点检查：调用由SDK封装，无法确认是否使用/users/{id}/memberOf端点；
• 空结果处理：错误在调用阶段抛出，非结果返回后触发；
• 测试情况：尝试使用Graph Explorer测试，但因Azure B2C目录非主目录无法切换；主目录中用户的memberOf调用可正常执行。

排查思路与解决方案 #

1. 确认SDK实际调用的端点 #

通过启用请求日志或抓包工具（如Fiddler）查看SDK实际发送的请求URL，确认是否为https://graph.microsoft.com/v1.0/users/{objectId}/memberOf。若端点异常，可尝试手动指定版本或端点路径（如测试beta版本端点https://graph.microsoft.com/beta/users/{objectId}/memberOf）。

2. 验证应用权限的有效性 #

• 确认配置的是应用权限（而非委托权限），因为使用ClientSecretCredential属于应用身份验证；
• 确认权限已获得管理员同意，未同意的应用权限无法生效；
• 尝试添加Group.Read.All权限，虽然Directory.Read.All理论上包含组访问权限，但部分场景下显式添加可解决权限覆盖问题。

3. 绕过SDK直接调用REST API #

使用curl或Postman直接调用Graph API，验证问题是否来自SDK：

curl --request GET \
  --url 'https://graph.microsoft.com/v1.0/users/{objectId}/memberOf' \
  --header 'Authorization: Bearer {access_token}'

获取access_token时，确保使用B2C租户ID，权限范围包含https://graph.microsoft.com/.default。若直接调用也返回500，说明问题出在Graph API或B2C租户配置；若直接调用正常，则需排查SDK版本或配置问题。

4. 检查B2C租户与用户的配置 #

• 在Azure B2C门户中查看目标用户的组成员身份，确认是否存在异常（如组对象损坏）；
• 测试其他B2C用户的memberOf调用，判断是单个用户问题还是全局问题；
• 检查B2C租户近期是否有配置变更（如禁用组相关API访问）。

5. 排查SDK版本兼容性 #

尝试降级到Microsoft.Graph v4的稳定版本（如v4.53.0），确认是否为新版本SDK的兼容性问题；若问题依旧，可考虑提交SDK的官方Issue反馈。

内容的提问来源于stack exchange，提问作者nejohannsen