`@odata.id` and resource/relationship/operation URIs returned are all invalid

For many AAD objects, the returned value for the @odata.id field is invalid. This affects at least the following APIs:

• GET /v1.0/groups/{id}
• GET /v1.0/groups/{id}
• GET /v1.0/servicePrincipals/{id}
• GET /beta/servicePrincipals/{id}
• GET /v1.0/users/{id}
• GET /beta/users/{id}

For the above object types, the value returned is in the format groups('00000000-0000-0000-0000-000000000000'), servicePrincipals('11111111-1111-1111-1111-111111111111') and users('22222222-2222-2222-2222-222222222222') respectively, whereas the value used to contain the canonical URI for the resource, e.g. https://graph.microsoft.us/servicePrincipals/11111111-1111-1111-1111-111111111111.

This format change seems to be against the recommendation of the OData spec (although admittedly not a violation), which states:

The odata.id annotation contains the entity-id; see [OData-Protocol]. By convention the entity-id is identical to the canonical URL of the entity, as defined in [OData-URL].

It's pertinent for these particular object types because they are widely used in relationships with other objects, such as groups having owners, or directory roles having members. These relationships are specified using the canonical URI for the object, and so the value returned is then not accepted as a value.

Equally, the various resource / relationship / operation URIs that are returned for a given object type, are also badly formed and invalid due to having the malformed odata.id embedded within them. This makes it impossible to walk the graph using the responses from the various APIs.

This is observed with both the v1.0 and beta APIs.

Example response:

HTTP/1.1 200 OK
Cache-Control: no-cache
Transfer-Encoding: chunked
Content-Type: application/json;odata.metadata=full;odata.streaming=true;IEEE754Compatible=false;charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 89843e26-a5e2-4e84-88ad-0b08cb454530
client-request-id: 89843e26-a5e2-4e84-88ad-0b08cb454530
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"LN2PEPF0000595F"}}
x-ms-resource-unit: 1
OData-Version: 4.0
Date: Wed, 19 Apr 2023 20:17:17 GMT
Connection: close

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals/$entity",
  "@odata.type": "#microsoft.graph.servicePrincipal",
  "@odata.id": "servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')",
  "@odata.editLink": "servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')",
  "id": "84fabd63-bcc5-4d2f-9d73-c504976faed8",
  "deletedDateTime": null,
  "accountEnabled": true,
  "alternativeNames@odata.type": "#Collection(String)",
  "alternativeNames": [],
  "appDisplayName": "acctestServicePrincipal-230419211549516813",
  "appDescription": null,
  "appId": "a29c0cb9-bd74-4b17-82c5-5a27bb412f7e",
  "applicationTemplateId": null,
  "appOwnerOrganizationId@odata.type": "#Guid",
  "appOwnerOrganizationId": "6df54acb-f3cd-4734-85e3-7511ade57a02",
  "appRoleAssignmentRequired": false,
  "createdDateTime": "2023-04-19T20:16:21Z",
  "description": "TERRAFORM_UPDATE_7104e0a9-b4c7-0004-d7bf-d9f8a27d141d",
  "disabledByMicrosoftStatus": null,
  "displayName": "acctestServicePrincipal-230419211549516813",
  "homepage": null,
  "loginUrl": null,
  "logoutUrl": null,
  "notes": null,
  "notificationEmailAddresses@odata.type": "#Collection(String)",
  "notificationEmailAddresses": [],
  "preferredSingleSignOnMode": null,
  "preferredTokenSigningKeyThumbprint": null,
  "replyUrls@odata.type": "#Collection(String)",
  "replyUrls": [],
  "servicePrincipalNames@odata.type": "#Collection(String)",
  "servicePrincipalNames": [
    "a29c0cb9-bd74-4b17-82c5-5a27bb412f7e"
  ],
  "servicePrincipalType": "Application",
  "signInAudience": "AzureADMyOrg",
  "tags@odata.type": "#Collection(String)",
  "tags": [],
  "tokenEncryptionKeyId": null,
  "addIns@odata.type": "#Collection(microsoft.graph.addIn)",
  "addIns": [],
  "appRoles@odata.type": "#Collection(microsoft.graph.appRole)",
  "appRoles": [],
  "info": {
    "@odata.type": "#microsoft.graph.informationalUrl",
    "logoUrl": null,
    "marketingUrl": null,
    "privacyStatementUrl": null,
    "supportUrl": null,
    "termsOfServiceUrl": null
  },
  "keyCredentials@odata.type": "#Collection(microsoft.graph.keyCredential)",
  "keyCredentials": [],
  "oauth2PermissionScopes@odata.type": "#Collection(microsoft.graph.permissionScope)",
  "oauth2PermissionScopes": [],
  "passwordCredentials@odata.type": "#Collection(microsoft.graph.passwordCredential)",
  "passwordCredentials": [],
  "resourceSpecificApplicationPermissions@odata.type": "#Collection(microsoft.graph.resourceSpecificPermission)",
  "resourceSpecificApplicationPermissions": [],
  "samlSingleSignOnSettings": {
    "@odata.type": "#microsoft.graph.samlSingleSignOnSettings",
    "relayState": null
  },
  "verifiedPublisher": {
    "@odata.type": "#microsoft.graph.verifiedPublisher",
    "displayName": null,
    "verifiedPublisherId": null,
    "addedDateTime": null
  },
  "appManagementPolicies@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/appManagementPolicies/$ref",
  "appManagementPolicies@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/appManagementPolicies",
  "appRoleAssignedTo@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/appRoleAssignedTo/$ref",
  "appRoleAssignedTo@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/appRoleAssignedTo",
  "appRoleAssignments@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/appRoleAssignments/$ref",
  "appRoleAssignments@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/appRoleAssignments",
  "claimsMappingPolicies@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/claimsMappingPolicies/$ref",
  "claimsMappingPolicies@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/claimsMappingPolicies",
  "createdObjects@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/createdObjects/$ref",
  "createdObjects@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/createdObjects",
  "delegatedPermissionClassifications@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/delegatedPermissionClassifications/$ref",
  "delegatedPermissionClassifications@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/delegatedPermissionClassifications",
  "endpoints@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/endpoints/$ref",
  "endpoints@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/endpoints",
  "federatedIdentityCredentials@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/federatedIdentityCredentials/$ref",
  "federatedIdentityCredentials@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/federatedIdentityCredentials",
  "homeRealmDiscoveryPolicies@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/homeRealmDiscoveryPolicies/$ref",
  "homeRealmDiscoveryPolicies@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/homeRealmDiscoveryPolicies",
  "memberOf@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/memberOf/$ref",
  "memberOf@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/memberOf",
  "oauth2PermissionGrants@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/oauth2PermissionGrants/$ref",
  "oauth2PermissionGrants@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/oauth2PermissionGrants",
  "ownedObjects@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/ownedObjects/$ref",
  "ownedObjects@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/ownedObjects",
  "owners@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/owners/$ref",
  "owners@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/owners",
  "tokenIssuancePolicies@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/tokenIssuancePolicies/$ref",
  "tokenIssuancePolicies@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/tokenIssuancePolicies",
  "tokenLifetimePolicies@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/tokenLifetimePolicies/$ref",
  "tokenLifetimePolicies@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/tokenLifetimePolicies",
  "transitiveMemberOf@odata.associationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/transitiveMemberOf/$ref",
  "transitiveMemberOf@odata.navigationLink": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/transitiveMemberOf",
  "#microsoft.graph.addKey": {
    "title": "microsoft.graph.addKey",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.addKey"
  },
  "#microsoft.graph.addPassword": {
    "title": "microsoft.graph.addPassword",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.addPassword"
  },
  "#microsoft.graph.removeKey": {
    "title": "microsoft.graph.removeKey",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.removeKey"
  },
  "#microsoft.graph.removePassword": {
    "title": "microsoft.graph.removePassword",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.removePassword"
  },
  "#microsoft.graph.addTokenSigningCertificate": {
    "title": "microsoft.graph.addTokenSigningCertificate",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.addTokenSigningCertificate"
  },
  "#microsoft.graph.checkMemberGroups": {
    "title": "microsoft.graph.checkMemberGroups",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.directoryObject/microsoft.graph.checkMemberGroups"
  },
  "#microsoft.graph.checkMemberObjects": {
    "title": "microsoft.graph.checkMemberObjects",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.directoryObject/microsoft.graph.checkMemberObjects"
  },
  "#microsoft.graph.getMemberGroups": {
    "title": "microsoft.graph.getMemberGroups",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.directoryObject/microsoft.graph.getMemberGroups"
  },
  "#microsoft.graph.getMemberObjects": {
    "title": "microsoft.graph.getMemberObjects",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.directoryObject/microsoft.graph.getMemberObjects"
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/v1.0/servicePrincipals('84fabd63-bcc5-4d2f-9d73-c504976faed8')/microsoft.graph.directoryObject/microsoft.graph.restore"
  }
}

Start by comparing the listed Microsoft Graph endpoints with the example response, focusing on the @odata.id, relationship, and operation URI values. No repository files or tests are named, so trace the metadata source or generation entry point before defining the change. Done means the affected v1.0 and beta responses expose canonical, usable URIs and graph traversal works.