How to enumerate Groups from Users with Microsoft Graph Client

Question

I am using the GraphHttpClient class to try and retrieve all groups that a user is a member of in Visual Studio Team Services. I can connect fully to VSTS and the following code runs, but I often get errors with the VSTS built-in accounts. I am not sure what I am doing wrong or how to correct this so that the code runs without exception.

What is the best way to loop all the users and produce a list of the groups they are a member of?

GraphHttpClient graphClient = connection.GetClient<GraphHttpClient>();
PagedGraphUsers users = graphClient.ListUsersAsync().Result;

foreach (var user in users.GraphUsers)
{
    if (user.Origin.Equals("aad"))
    {                    
        var ent = graphClient.ListMembershipsAsync(user.Descriptor).Result.ToList();
        foreach (var graphMembership in ent)
        {
            var group = graphClient.GetGroupAsync(graphMembership.ContainerDescriptor).Result;

            Console.Out.WriteLine("{0},{1}",
                user.PrincipalName.PadRight(20),
                group.PrincipalName);
        }
    }
    else
    {
        Console.Out.WriteLine("{0},Service Accounts",
            user.DisplayName.PadRight(20));
    }
}

When I remove the IF statement and let all users go through the ListMememberhships, I get this error:

Unhandled Exception: System.AggregateException: One or more errors occurred. ---> Microsoft.VisualStudio.Services.Graph.InvalidSubjectTypeException: acs``

Without the IF statement, I get: Unhandled Exception: System.AggregateException: One or more errors occurred. ---> Microsoft.VisualStudio.Services.Graph.InvalidSubjectTypeException: acs — Paul Duer, Mar 20 '18 at 11:53
https://stackoverflow.com/questions/48663588/get-users-in-group-from-azure-ad-via-microsoft-graph https://stackoverflow.com/questions/35343369/get-a-list-of-groups-that-azure-ad-user-belongs-to-in-claims — Shridhar R Kulkarni, Mar 20 '18 at 11:57

score 1 · Answer 1 · answered Mar 21 '18 at 03:04

1

The Descriptor start with acs are service account, such as Hosted VS2017 agent service, TeamFoundationService.

So you can change condition like this:

if (!user.Descriptor.ToString().StartsWith("acs"))

answered Mar 21 '18 at 03:04

starian chen-MSFT

33,174
2
29
53

How to enumerate Groups from Users with Microsoft Graph Client

1 Answers1