尝试通过Microsoft Graph创建组时，“权限不足，无法完成操作”

Question

期望的行为

在具有group API权限的single tenant application中，使用JavaScript SDK和MSAL通过Microsoft Graph创建delegated。

实际行为

{
  "statusCode": 403,
  "code": "Authorization_RequestDenied",
  "message": "Insufficient privileges to complete the operation.",
  "requestId": "6e865d96-ef8b-408e-a905-5393b4adcfdc",
  "date": "2020-05-16T20:20:15.000Z",
  "body": "{\"code\":\"Authorization_RequestDenied\",\"message\":\"Insufficient privileges to complete the operation.\",\"innerError\":{\"request-id\":\"6e865d96-ef8b-408e-a905-5393b4adcfdc\",\"date\":\"2020-05-17T06:20:15\"}}"
}

我尝试过的事情

要创建代码，我使用了以下API参考说明：

• Create group
• Group properties

登录/注销和所有其他API请求均有效。

订阅

Microsoft 365 Business Standard Trial

API权限

Directory.AccessAsUser.All +++
Directory.ReadWrite.All ***
Group.ReadWrite.All  
GroupMember.ReadWrite.All ***
openid
profile
Sites.Read.All
Tasks.ReadWrite
User.Read

***我在阅读this answer之后添加了这些内容，但仍然收到相同的错误。
+++我在下面的建议中添加了此内容。

我单击了Azure应用注册区域中的“授予管理员同意”按钮。

index.html

<!-- msal -->
<!-- from:  https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-core -->
<script type="text/javascript" src="https://alcdn.msauth.net/lib/1.3.0/js/msal.js" integrity="****" crossorigin="anonymous"></script>

<!-- javascript sdk -->
<!-- from:  https://github.com/microsoftgraph/msgraph-sdk-javascript -->
<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/@microsoft/microsoft-graph-client/lib/graph-js-sdk.js"></script>

config.js

// msal options
const msalConfig = {
    auth: {
        clientId: "client-id-here",
        redirectUri: "http://localhost:8080",
        authority: "https://login.microsoftonline.com/tenant-id-here"
    },
  cache: {
    cacheLocation: "sessionStorage",
    storeAuthStateInCookie: false,
    forceRefresh: false
  }
};

// define application permissions   
const scopes = ['directory.accessasuser.all', 'directory.readwrite.all', 'group.readwrite.all', 'groupmember.readwrite.all', 'openid', 'profile', 'sites.read.all', 'user.read', 'tasks.readwrite' ]; 

auth.js

const msalApplication = new Msal.UserAgentApplication(msalConfig);

const loginRequest = {
    scopes: scopes
}

async function sign_in() {
    try {
        await msalApplication.loginPopup(loginRequest);
        if (msalApplication.getAccount()) {
            console.log("sign in success");
        }
    } catch (error) {
        console.log("sign in error");
        console.log(error);
    }
}

function sign_out() {
    msalApplication.logout();
}

graph.js

var path = "/groups"; 
var group = {
  description: "Here is a description.",
  displayName: "test_test_test",
  groupTypes: [
    "Unified",
    "DynamicMembership"
  ],
  mailEnabled: true,
  mailNickname: "test_test_test",
  securityEnabled: false, // initially i had this as true, doesn't seem to make a difference either way  
  visibility: "Hiddenmembership",
  "owners@odata.bind": [
    "https://graph.microsoft.com/v1.0/users/my-user-id-here"
  ],
    "members@odata.bind": [
        "https://graph.microsoft.com/v1.0/users/my-user-id-here"
  ]
};

var response = await client.api(path)
                            .post(group);

相关阅读内容：

Compare groups

Learn about Microsoft 365 Groups

Overview of Microsoft 365 Groups for administrators

Working with groups in Microsoft Graph

Create, edit, or delete a security group in the Microsoft 365 admin center

Creating teams and managing members using Microsoft Graph

Overview of Office 365 groups in Microsoft Graph

有关可能导致错误的其他提示...

仅统一组支持可见性；安全组不支持此功能。

Source

也许securityEnabled: true和visibility:Hiddenmembership的组合不兼容？

我尝试将其更改为securityEnabled: false并收到相同的消息。

令牌是否有问题？

我从Chrome开发工具控制台复制了Authorisation: Bearer值，并粘贴到https://jwt.io上，令牌中还提供了两个另外的范围-但其他所有范围也都存在：

Answer 1

在您的图形调用中，我看到您尝试创建动态组并将成员分配给该组，该动态组不支持添加成员，这就是在组类型下删除"dynamicMemberShip“的原因可以解决此问题，下面是通过图形API调用创建动态组的示例：

{
    "description": "test1",
    "displayName": "test1",
    "groupTypes": [
        "Unified",
        "DynamicMembership"
    ],
    "mailEnabled": true,
    "membershipRule": "user.displayname -contains A",
    "membershipRuleProcessingState":"On",
    "mailNickname": "library",
    "securityEnabled": false,
}

Answer 2

我可以看到您没有在权限集中授予 Group.Create 权限。 授予创建组的权限。

对于 应用程序权限类型 ，所有这些权限都是必需的：

• Group.Create
• Group.ReadWrite.All
• Directory.ReadWrite.All

对于 委派的用户权限类型 ：

• Group.ReadWrite.All
• Directory.ReadWrite.All
• Directory.AccessAsUser.All

Answer 3

我可以通过更改Group中的以下内容来创建graph.js：

groupTypes: ["Unified","DynamicMembership"]  

到

groupTypes: ["Unified"]`   

我不知道为什么DynamicMembership会导致错误。

这是下面链接中列出的Group> groupTypes的有效属性值，没有警告：

https://docs.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties

作为参考，以上代码创建：

• 组
• SharePoint'团队站点'
• Outlook电子邮件组

它不会自动创建相应的内容：

• 团队
• 计划

您可以在以下位置看到列出的新组：

https://admin.microsoft.com/AdminPortal/Home#/groups

https://outlook.office365.com/people

https://portal.azure.com/#blade/Microsoft_AAD_IAM/GroupsManagementMenuBlade/AllGroups

您可以在以下位置看到“团队站点”组：

https://your_account-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/siteManagement