Cannot change the signInAudience using the Microsoft Graph API

[jiasli]

Can you clarify how to do this using the REST API?
I can not change the signInAudience using the azure ad graph api. The calls always fails with ValidationError: Bad Request

I created a question here. Basically the API tells me that the JSON is invalid. Is there a working example anywhere how to set the signInAudience?

Originally posted by @Console32 in #14086 (comment)

[jiasli]

@Console32, judging from the content you posted on Stackoverflow:

$body='{"signInAudience":"AzureADAndMicrosoftAccounts"}'
echo $body
Test-Json -Json $body
az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/$application_object_id --body $body --headers "Content-Type=application/json"

ValidationError: Bad Request({
  "error": {
     "code": "BadRequest",
     "message": "Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format.",
     "innerError": {
     "date": "2020-10-13T10:48:48",
      "request-id": "f29fd020-33aa-4cda-b98e-130d1434cd85",
      "client-request-id": "f29fd020-33aa-4cda-b98e-130d1434cd85"
     }
   }
 })

It looks like you are using PowerShell and hitting the quoting issue of PowerShell. Double quotes in the JSON string should be escaped as \".

Also you are not specifying the correct value for signInAudience. According to application resource type, it can only be:

• AzureADMyOrg
• AzureADMultipleOrgs
• AzureADandPersonalMicrosoftAccount
• PersonalMicrosoftAccount

So these lines should be

$body='{\"signInAudience\":\"AzureADandPersonalMicrosoftAccount\"}'
$application_object_id='f71973eb-8d62-40ef-bf27-324f9ee5c115'
az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/$application_object_id --body $body

FYI,

• --headers "Content-Type=application/json" is not necessary if the body is a valid JSON
• This post regarding identifierUris may be helpful: https://stackoverflow.com/questions/41580865/why-switch-to-azure-web-app-api-to-multi-tenanted-is-not-working/41595708#41595708

[raphaelschnaitl]

Hi @jiasli

You are correct this was just a quoting issue on my side. After fixing the JSON, the updates work. Strange that the other Update in my SO Posts worked without a valid JSON 🙈 .

Thanks

[jiasli]

Perhaps because you are using Cloud Shell or Bash? This issue only happens in PowerShell. You may use --debug to check

• the actual JSON argument Azure CLI receives
• the REST request and response on the wire

For example:

> az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/$application_object_id --body $body --debug
Command arguments: ['rest', '--method', 'PATCH', '--uri', 'https://graph.microsoft.com/v1.0/applications/f71973eb-8d62-40ef-bf27-324f9ee5c115', '--body', '{"signInAudience":"AzureADandPersonalMicrosoftAccount"}', '--debug']
...
Request URL: 'https://graph.microsoft.com/v1.0/applications/f71973eb-8d62-40ef-bf27-324f9ee5c115'
Request method: 'PATCH'
Request headers:
    'User-Agent': 'AZURECLI/2.13.0 (PIP)'
    'Accept-Encoding': 'gzip, deflate'
    'Accept': '*/*'
    'Connection': 'keep-alive'
    'x-ms-client-request-id': '2c56b1a3-8f99-419d-a677-161a414d9a7d'
    'Content-Type': 'application/json'
    'CommandName': 'rest'
    'ParameterSetName': '--method --uri --body --debug'
    'Authorization': 'Bearer eyJ0eXAiOiJKV...'
    'Content-Length': '55'
Request body:
{"signInAudience":"AzureADandPersonalMicrosoftAccount"}
urllib3.connectionpool : Starting new HTTPS connection (1): graph.microsoft.com:443
urllib3.connectionpool : https://graph.microsoft.com:443 "PATCH /v1.0/applications/f71973eb-8d62-40ef-bf27-324f9ee5c115 HTTP/1.1" 204 0
Response status: 204
Response headers:
    'Cache-Control': 'private'
    'Content-Type': 'text/plain'
    'request-id': 'f97cf129-2768-4628-988c-5320a03e659c'
    'client-request-id': 'f97cf129-2768-4628-988c-5320a03e659c'
    'x-ms-ags-diagnostic': '{"ServerInfo":{"DataCenter":"Southeast Asia","Slice":"SliceC","Ring":"5","ScaleUnit":"001","RoleInstance":"AGSFE_IN_6"}}'
    'Strict-Transport-Security': 'max-age=31536000'
    'Date': 'Wed, 14 Oct 2020 09:01:39 GMT'
Response content:

[worldspawn]

$body = '{\"accessTokenAcceptedVersion\": 2, \"signInAudience\": \"AzureADandPersonalMicrosoftAccount\"}'

@jiasli ☝️ I can't send that payload. Documentation states that in order to set the sign in audience to AzureADandPersonalMicrosoftAccount the token version must be set to 2. If I try the above payload I get

One or more property values specified are invalid.

If I try to set either individually I get the same result.

If I edit my manifest in the portal and set accessTokenAcceptedVersion to 2 there, I am then able to set the signInAudience to AzureADandPersonalMicrosoftAccount via REST. So currently it seems to be impossible to use the cli exclusively to set AzureADandPersonalMicrosoftAccount sign in audience.