microsoftgraph / microsoftgraph/msgraph-sdk-dotnet
Assign app role to newly created/invited user results in 400 BadRequest
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 789
- Forks
- 264
- Avg merge
- 15h 17m
- Merged PRs (30d)
- 3
Description
Describe the bug
I am successfully creating an invite to a b2b guest user using Invitations.PostAsync, I'm then trying to set an app role using AppRoleAssignedTo.PostAsync on that user but it fails with statusCode 400, errorCode 'Request_BadRequest' and errorMessage 'Not a valid reference update'.
I'm even able to query the newly created user with Users[userObjectId].GetAsync prior to trying to set role.
Trying to set the role on that user a few minutes later works.
Expected behavior
Being able to set user app role on the newly created invited user? Or get a more explaning message (retry-after or similiar)? Something more actionable, there's nothing wrong with the request (it's not a bad request).
How to reproduce
// request bodies removed for brevity
var userObjectId= await _client.Invitations.PostAsync(requestBody);
var result = await _client.Users[userObjectId].GetAsync();
var roleAssignment = await _client.ServicePrincipals[Environment.GetEnvironmentVariable("EntraEAObjectId")].AppRoleAssignedTo.PostAsync(roleRequestBody);
SDK Version
5.53
Latest version known to work for scenario above?
No response
Known Workarounds
No response
Debug output
Click to expand log
```</details>
### Configuration
_No response_
### Other information
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the sequence using Invitations.PostAsync, Users[userObjectId].GetAsync, and AppRoleAssignedTo.PostAsync, then compare the immediate 400 response with the later successful call. Done means the SDK or service scope is confirmed and the behavior has a targeted fix, test, or actionable retry guidance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100