devops: materialize Azure AD Security group

0
votes

I'm trying to add an Azure AD security group (without mail/upn) to a Devops Permission with the rest api.
Is this possible?

In this page https://docs.microsoft.com/en-us/rest/api/azure/devops/graph/users/create?view=azure-devops-rest-6.0#add-an-aad-user-by-oid I see the following

The body of the request must be a derived type of GraphUserCreationContext:

GraphUserMailAddressCreationContext - Create a new user using the mail address as a reference to an existing user from an external AD or AAD backed provider.
GraphUserOriginIdCreationContext - Create a new user using the OriginID as a reference to an existing user from an externalAD or AAD backed provider. GraphUserPrincipalNameCreationContext - Create a new user using the principal name as a reference to an existing user from an external AD or AAD backed provider.

The groups are created as universal security groups on our onprem AD, and synced to Azure AD.
I don't have a mailadress nor a UPN; but I can't find more info on what exactly OriginID is.

Edit; OriginID seems to work for a user, but not for a group.

2
azureazure-devopsazure-active-directory
The OriginID looks should be the Object Id of the group, navigate to the Azure Active Directory in the azure portal -> Groups -> find the group -> Properties -> try the Object Id. – Joy Wang
Hi there, I haven't got your latest news. Are you still working on this? For this issue, I think you need to call a REST API to get the Object ID first, and then use another REST API to create group. Please feel free to comment. Just a remind of this. – Jane Ma-MSFT

2 Answers

1
votes

To add an Azure AD group to Azure DevOps, you need to use the REST API Groups - Create.

POST https://vssps.dev.azure.com/{organization}/_apis/graph/groups?api-version=6.0-preview.1

Click this link for an example. The originId in the request body is the Object id of your Azure AD group.

The REST API link your provide in the question is to create a user, not a group.

0
votes

I ended up connecting with the Azure commandlets to get my ObjectID, as @jane-ma-msft suggested.