调用Graph API添加Azure AD成员到组时返回Bad Request问题

核心问题 #

你的脚本构造请求体时，@odata.id 使用了 directoryObjects/$userId 路径，但通过 groups/{id}/members/$ref 添加用户时，正确路径应指向用户资源而非通用的directoryObjects，这是触发Bad Request的主要原因。

额外确认项：

• 传入的$UserId必须是用户的对象ID（不能是用户主体名称UPN）
• 应用注册需已授予GroupMember.ReadWrite.All或Group.ReadWrite.All应用权限并完成管理员同意（你提到已有全部权限，此步骤可忽略）

修正后的脚本 #

function AddUserToGroup {
    param (
        [string] $TenantId,
        [string] $GroupId,
        [string] $UserId,
        [string] $ClientId,
        [string] $ClientSecret
    )

    try {
        # Azure AD token endpoint
        $tokenEndpoint = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

        # Azure AD API endpoint to add members to the group
        $apiEndpoint = "https://graph.microsoft.com/v1.0/groups/$GroupId/members/$ref"

        # Request access token
        $tokenBody = @{
            client_id     = $ClientId
            client_secret = $ClientSecret
            grant_type    = "client_credentials"
            scope         = "https://graph.microsoft.com/.default"
        }

        $tokenResponse = Invoke-RestMethod -Method Post -Uri $tokenEndpoint -Body $tokenBody
        $accessToken = $tokenResponse.access_token

        # 修正：@odata.id指向users资源而非directoryObjects
        $body = @{
            "@odata.id" = "https://graph.microsoft.com/v1.0/users/$userId"
        }

        $headers = @{
            Authorization  = "Bearer $accessToken"
            "Content-Type" = "application/json"
        }

        # 添加用户到组
        $response = Invoke-RestMethod -Method Post -Uri $apiEndpoint -Headers $headers -Body ($body | ConvertTo-Json)
        Write-Host "已将ID为$UserId的用户添加到组中。"
    }
    catch {
        Write-Host "添加用户$UserId到组时出错：$($_.Exception.Message)"
        if ($_.Exception.Response) {
            $errorResponse = $_.Exception.Response.GetResponseStream()
            $reader = New-Object System.IO.StreamReader($errorResponse)
            $reader.BaseStream.Position = 0
            $reader.DiscardBufferedData()
            $responseBody = $reader.ReadToEnd()
            Write-Host "详细错误响应：$responseBody"
        }
    }
    
}

# 调用示例：
$tenantId = ""
$groupId = ""
$userId = ""
$clientId = ""
$clientSecret = ""

AddUserToGroup -TenantId $tenantId -GroupId $groupId -UserId $userId -ClientId $clientId -ClientSecret $clientSecret

补充说明 #

使用$ref端点添加组成员时，@odata.id必须指向目标资源的完整Graph API具体路径：

• 添加用户：https://graph.microsoft.com/v1.0/users/{user-id}
• 添加其他组：https://graph.microsoft.com/v1.0/groups/{group-id}
• 添加服务主体：https://graph.microsoft.com/v1.0/servicePrincipals/{sp-id}

尽管directoryObjects是这些资源的父类型，但members/$ref的POST请求要求明确指定具体资源类型路径，否则会返回400 Bad Request。

内容的提问来源于stack exchange，提问作者user23335783