Microsoft Graph OneDrive invite fails when inviting group alias - microsoft-graph-api

Question

We are seeing what appears to be a change in the behavior of the Graph API. Our code, which grants access for an Excel workbook in OneDrive to a specific Security Group, is now failing where it used to succeed.
Request:
POST https://graph.microsoft.com/V1.0/groups/d4826b5d-4106-40a6-97e0-3826dff58e17/drive/root:/sageData/_verbs.xlsx:/invite HTTP/1.1
Accept: application/json
Authorization: Bearer <<token omitted>>
Content-Type: application/json; charset=utf-8
Host: graph.microsoft.com
Content-Length: 127
Expect: 100-continue
Connection: Keep-Alive
{
"recipients": [{
"alias": "d536e908-60cb-4558-8b3a-38f033d6508a"
}],
"requireSignIn": true,
"sendInvitation": false,
"roles": ["Write"]
}
Response:
HTTP/1.1 404 Not Found
Cache-Control: private
Content-Type: application/json
request-id: 48f148b6-0c15-410e-b29d-bef5880c7007
client-request-id: 48f148b6-0c15-410e-b29d-bef5880c7007
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Europe","Slice":"SliceB","Ring":"NA","ScaleUnit":"001","Host":"AGSFE_IN_14","ADSiteName":"DUB"}}
Duration: 981.5167
Date: Wed, 15 Nov 2017 13:05:50 GMT
Content-Length: 247
{
"error": {
"code": "itemNotFound",
"message": "One of the provided recipients could not be found",
"innerError": {
"request-id": "48f148b6-0c15-410e-b29d-bef5880c7007",
"date": "2017-11-15T13:05:51"
}
}
}
However, we can see that "recipient"" (which is the Security Group id) does indeed exist:
GET https://graph.microsoft.com/v1.0/groups/d536e908-60cb-4558-8b3a-38f033d6508a
Response
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups/$entity",
"id": "d536e908-60cb-4558-8b3a-38f033d6508a",
"deletedDateTime": null,
"classification": null,
"createdDateTime": "2017-11-15T12:42:01Z",
"description": "{\"datasetIdentifier\":\"4122e61b-d5c1-4a58-9068-dfdeda9e8278\",\"roleIdentifier\":\"FullAccess\",\"isSageMetadata\":true,\"type\":\"Role\"}",
"displayName": "Sage - Pete - All Apps & Add-Ins",
"groupTypes": [],
"mail": null,
"mailEnabled": false,
"mailNickname": "Sage-Pete-AllApps-Add-Ins",
"onPremisesLastSyncDateTime": null,
"onPremisesProvisioningErrors": [],
"onPremisesSecurityIdentifier": null,
"onPremisesSyncEnabled": null,
"proxyAddresses": [],
"renewedDateTime": "2017-11-15T12:42:01Z",
"securityEnabled": true,
"visibility": null
}
The documentation states the recipient property we are posting should be "email" whereas we have used "alias" up to this point. If we change to "email" then it works.
However, that seems incorrect, according to the documentation we should use alias:
"The alias of the domain object, for cases where an email address is unavailable (e.g. security groups)."
Has anyone else encountered this behaviour?

Answer 1

What you're submitting as an alias is actually an objectId. The alias in this case would be the object's mailNickname (i.e. Sage-Pete-AllApps-Add-Ins).
Either of these should work:
{
"recipients": [{
"objectId": "d536e908-60cb-4558-8b3a-38f033d6508a"
}],
"requireSignIn": true,
"sendInvitation": false,
"roles": ["Write"]
}
or
{
"recipients": [{
"alias": "Sage-Pete-AllApps-Add-Ins"
}],
"requireSignIn": true,
"sendInvitation": false,
"roles": ["Write"]
}