How To Update MS Graph Client Service Principal AppRoleAssignments

Question

I am attempting to update a user's AppRole assignments via the Graph Client. As per MS documents I am attempting to do it from the service principal side rather than the user side.

                var sp = await _graphServiceClient.ServicePrincipals[objectId].Request().GetAsync();
                ServicePrincipal newSp = new ServicePrincipal
                {
                    Id = objectId,
                    AppId = _configuration["AzureAd:AppId"]
                };

                newSp.AppRoleAssignedTo = new ServicePrincipalAppRoleAssignedToCollectionPage();

                    newSp.AppRoleAssignedTo.Add(new AppRoleAssignment 
                    { 
                        PrincipalId = new Guid(u.Id), 
                        ResourceId = new Guid(objectId), 
                        AppRoleId = new Guid(r) 
                     });
                

                await _graphServiceClient.ServicePrincipals[objectId].Request().UpdateAsync(newSp);

I am getting 'One or more property values specified are invalid' but of course no real info on what property or even which object is the problem.

Anyone see anything obvious? I'm guessing on the syntax for the client usage bc I don't see much documentation or examples for it.

Answer 1

I test with same code with yours and met same issue and do some modification but still can't solve the issue. For your requirement of update user's AppRole assignment, I'm not sure if we can do it by the code you provided, but I can provide another solution which is more directly.

The code you provided is new a service principal and add the role assignment into it, then update the service principal. Here provide another solution, it can add the app role assignment directly:

var appRoleAssignment = new AppRoleAssignment
{
    PrincipalId = Guid.Parse("{principalId}"),
    ResourceId = Guid.Parse("{resourceId}"),
    AppRoleId = Guid.Parse("{appRoleId}")
};

await graphClient.Users["{userId}"].AppRoleAssignments
    .Request()
    .AddAsync(appRoleAssignment);

The code above request this graph api in backend.