microsoftgraph / microsoftgraph/msgraph-sdk-dotnet

Assign app role to newly created/invited user results in 400 BadRequest

Open
#2,508 8 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Needs: Attention :wave: type:bug
Dominant language
C#
Stars
789
Forks
264
Avg merge
15h 17m
Merged PRs (30d)
3

Description

Describe the bug

I am successfully creating an invite to a b2b guest user using Invitations.PostAsync, I'm then trying to set an app role using AppRoleAssignedTo.PostAsync on that user but it fails with statusCode 400, errorCode 'Request_BadRequest' and errorMessage 'Not a valid reference update'.

I'm even able to query the newly created user with Users[userObjectId].GetAsync prior to trying to set role.

Trying to set the role on that user a few minutes later works.

Expected behavior

Being able to set user app role on the newly created invited user? Or get a more explaning message (retry-after or similiar)? Something more actionable, there's nothing wrong with the request (it's not a bad request).

How to reproduce
// request bodies removed for brevity 
var userObjectId= await _client.Invitations.PostAsync(requestBody);
var result = await _client.Users[userObjectId].GetAsync();
var roleAssignment = await _client.ServicePrincipals[Environment.GetEnvironmentVariable("EntraEAObjectId")].AppRoleAssignedTo.PostAsync(roleRequestBody);
SDK Version

5.53

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output
Click to expand log ```
</details>


### Configuration

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the sequence using Invitations.PostAsync, Users[userObjectId].GetAsync, and AppRoleAssignedTo.PostAsync, then compare the immediate 400 response with the later successful call. Done means the SDK or service scope is confirmed and the behavior has a targeted fix, test, or actionable retry guidance.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.