Adding an AAD group to Azure DevOps using the rest api

Question

I am attempting to do a put on

https://team.vssps.visualstudio.com/_apis/Graph/Memberships/{aadgp.GroupDescriptor}/vssgp.{GroupDescriptor}

I can come up with the ADO group starting with vssgp. but I have been unable to come up with the AAD descriptor.

Calling AAD graph with

https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'groupName'

doesnt appear to provide me anything that looks like that and calling

https://team.visualstudio.com/_apis/IdentityPicker/Identities?api-version=6.0-preview

with body

{
"query": "groupName",
"identityTypes": ["group"],
"operationScopes": ["ims", "source"]
}

doesnt give me anything that starts with aadgp.

I am running out of ideas and was hoping one of you may have done this already. I am unable to get all of the groups that have access to the org or team project as it will likely be a new group being added.

tia

Answer 1

You have to make a bunch of calls.

• Get Azure graph to get Guid of group
  • GET https://graph.microsoft.com/v1.0/groups?$filter=displayName eq ‘GroupName’
• Get projects to determine id of project I need
  • GET https://dev.azure.com/{organization}/_apis/projects?api-version=6.0
• Post to group entitlements to add the new group in
  • POST https://vsaex.dev.azure.com/{organization}/_apis/groupentitlements?api-version=6.0-preview.1
• Get all groups from the org to get the aadgp value
  • GET https://vssps.dev.azure.com/{organization}/_apis/graph/groups?api-version=6.1-preview.1
• Put on graph membership to add the group
  • PUT https://vssps.dev.azure.com/{organization}/_apis/graph/memberships/{subjectDescriptor}/{containerDescriptor}?api-version=6.0-preview.1
• Delete on group entitlements to eliminate unneeded group entitlement
  • DELETE https://vsaex.dev.azure.com/{organization}/_apis/groupentitlements/{groupId}?api-version=6.0-preview.1