Graph API response field format mismatch with SDK object field format

Describe the bug

The field in question is for Conditional Access Policies (https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies): conditions.authenticationFlows.transferMethods. When specified in a policy, the graph API returns this field as a comma-separated string, e.g. "transferMethods": "deviceCodeFlow,authenticationTransfer". When parsed by this SDK in this format, ConditionalAccessPolicy.conditions.authentication_flows.transfer_methods get's incorrectly set to an empty array ([]).

The SDK expects the value of this field to be an array, rather than a comma-separated string. The following code demonstrates the incorrect and desired behaviors:

from kiota_serialization_json.json_parse_node import JsonParseNode
from msgraph_beta.generated.models.conditional_access_policy import ConditionalAccessPolicy

json_data = {
  "displayName": "Test Device Code & Authentication Transfers",
  "state": "enabled",
  "conditions": {
    ...
    "authenticationFlows": {
      "transferMethods": "deviceCodeFlow,authenticationTransfer"
    }
  },
  ...
}

msgraph_sdk_obj = JsonParseNode(json_data).get_object_value(ConditionalAccessPolicy())
# msgraph_sdk_obj.conditions.authentication_flows.transfer_methods == []

fixed_json_data = {
  ...
  "conditions": {
    ...
    "authenticationFlows": {
      "transferMethods": ["deviceCodeFlow", "authenticationTransfer"]
    }
  },
  ...
}

fixed_msgraph_sdk_obj = JsonParseNode(fixed_json_data).get_object_value(ConditionalAccessPolicy())
# fixed_msgraph_sdk_obj.conditions.authentication_flows.transfer_methods == [
#   <ConditionalAccessTransferMethods.DeviceCodeFlow: 'deviceCodeFlow'>,
#   <ConditionalAccessTransferMethods.AuthenticationTransfer: 'authenticationTransfer'>
# ]

The following screenshot shows that the API returns it in the comma-separated string format:

So the issue still exists when using the msgraph-sdk API request instead of the JSON parser. e.g.

from msgraph_beta.graph_service_client import GraphServiceClient

GraphServiceClient(...).identity.conditional_access.policies.by_conditional_access_policy_id('conditionalAccessPolicy-id').get()

And in the Entra UI it looks like the following:

I don't know whether this bug should be fixed in this SDK or in the Graph API itself.

Expected behavior

msgraph_sdk_cap_obj: ConditionalAccessPolicy

msgraph_sdk_cap_obj.conditions.authentication_flows.transfer_methods ==
[
  <ConditionalAccessTransferMethods.DeviceCodeFlow: 'deviceCodeFlow'>,
  <ConditionalAccessTransferMethods.AuthenticationTransfer: 'authenticationTransfer'>
]
# not []

How to reproduce

The code above can be used to reproduce.

SDK Version

1.31.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identity/conditionalAccess/policies/$entity",
  "@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET identity/conditionalAccess/policies('<guid>')?$select=conditions,createdDateTime",
  "templateId": null,
  "displayName": "Test Device Code & Authentication Transfers",
  "state": "enabledForReportingButNotEnforced",
  "sessionControls": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": ["all"],
    "servicePrincipalRiskLevels": [],
    "insiderRiskLevels": null,
    "platforms": null,
    "locations": null,
    "devices": null,
    "clientApplications": null,
    "applications": {
      "includeApplications": ["None"],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": ["All"],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "authenticationFlows": {
      "transferMethods": "deviceCodeFlow,authenticationTransfer"
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["block"],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identity/conditionalAccess/policies('e7a127d6-b745-47da-814e-f909748cff0d')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  }
}

Configuration

macOS, python 3.12

Other information

No response

Reproduisez l’incohérence avec JsonParseNode, ConditionalAccessPolicy et les valeurs d’exemple de transferMethods, puis comparez-la avec le chemin de requête de GraphServiceClient. Suivez l’analyse de conditions.authenticationFlows.transfer_methods lorsque l’API renvoie une chaîne séparée par des virgules ; le travail est terminé lorsque le SDK expose les méthodes renvoyées sous forme de la liste d’enums ConditionalAccessTransferMethods attendue.