Azure Entra(AD)用户创建REST端点报错：无法解析GraphServiceClient

错误原因 #

控制器构造函数依赖GraphServiceClient，但该服务未在ASP.NET Core的依赖注入（DI）容器中注册，导致框架无法实例化控制器。

解决步骤 #

1. 清理控制器内的冗余代码 #

你当前在CreateUser方法里手动创建了GraphServiceClient实例，同时构造函数又注入了一个未注册的实例，逻辑冲突。保留构造函数注入，移除方法内的客户端创建代码：

修改后的控制器代码：

using System;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Graph;
using Microsoft.Graph.Models;

namespace Entra_SPIKE.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class CreateUserController : Controller
    {
        private readonly GraphServiceClient _graphServiceClient;

        public CreateUserController(GraphServiceClient graphServiceClient)
        {
            _graphServiceClient = graphServiceClient;
        }

        [HttpPost(Name = "PostCreateUser")]
        public async Task<IActionResult> CreateUser([FromBody] CreateUserRequest request)
        {
            try
            {
                var user = new User
                {
                    AccountEnabled = request.AccountEnabled,
                    DisplayName = request.DisplayName,
                    MailNickname = request.MailNickname,
                    UserPrincipalName = request.UserPrincipalName,
                    PasswordProfile = new PasswordProfile
                    {
                        ForceChangePasswordNextSignIn = request.ForceChangePasswordNextSignIn,
                        Password = request.Password
                    }
                };

                var result = await _graphServiceClient.Users.PostAsync(user);
                return Ok("User created successfully");
            }
            catch (Exception ex)
            {
                return StatusCode(500, $"An error occurred: {ex.Message}");
            }
        }
    }

    public class CreateUserRequest
    {
        public string DisplayName { get; set; }
        public string MailNickname { get; set; }
        public string UserPrincipalName { get; set; }
        public string Password { get; set; }
        public bool AccountEnabled { get; set; }
        public bool ForceChangePasswordNextSignIn { get; set; }
    }
}

2. 在DI容器中注册GraphServiceClient #

打开Program.cs（如果是.NET 5及之前版本则是Startup.cs的ConfigureServices方法），添加以下代码注册GraphServiceClient：

先配置appsettings.json（避免硬编码敏感信息）

在appsettings.json中添加Azure Entra配置：

{
  "AzureAd": {
    "TenantId": "你的租户ID",
    "ClientId": "你的应用注册ID",
    "ClientSecret": "你的应用密钥"
  }
}

然后在Program.cs中注册服务

using Microsoft.Graph;
using Azure.Identity;

var builder = WebApplication.CreateBuilder(args);

// 注册控制器
builder.Services.AddControllers();

// 注册GraphServiceClient
var azureAdSettings = builder.Configuration.GetSection("AzureAd");
var tenantId = azureAdSettings["TenantId"];
var clientId = azureAdSettings["ClientId"];
var clientSecret = azureAdSettings["ClientSecret"];

var scopes = new[] { "https://graph.microsoft.com/.default" };
var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);

builder.Services.AddSingleton<GraphServiceClient>(sp => 
    new GraphServiceClient(credential, scopes));

var app = builder.Build();

// 配置中间件
app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();

app.Run();

3. 验证权限配置 #

确保你的Azure Entra应用注册已添加User.ReadWrite.All应用权限，并且已由管理员授予同意。

额外注意事项 #

• 不要硬编码租户ID、客户端ID和密钥，始终使用配置文件或Azure Key Vault管理敏感信息
• 生产环境中建议添加更详细的错误处理，避免返回具体异常信息给前端
• 后续添加"验证用户是否在组内"的接口时，可直接使用注入的_graphServiceClient调用Graph API的组相关接口

内容的提问来源于stack exchange，提问作者Debugger