Issue creating a Device using Graph API

Question

Hi,
I raised an issue on the documentation of github but was suggest that I raise it here.

Issue is that I'm trying to create devices for some test scenarios, found the following references:

• https://learn.microsoft.com/en-us/graph/api/device-post-devices?view=graph-rest-1.0&tabs=http

But when I follow the example I get the following error back:

"code": "Request_BadRequest",
"message": "Cannot convert the literal 'base64Y3YxN2E1MWFlYw==' to the expected type 'Edm.Binary'.",

The response on the github issue:

The key value in the documentation is just a sample and has been truncated. Please use your own key instead for this operation.

But there is no example or reference that I can see to how I create/obtain the key value..

Any thoughts/suggestions?

Thanks

Answer 1

I was also looking into this, and found that the documentation for that alternativeSecurityIds field is defined here. Granted that document also outlines the correct way to go about joining a machine, rather than simply creating the device object. I was able to successfully generate a test device object by setting alternativeSecurityIds based on the description in that document.
To quote the document:

The Alt-Security-Identities attribute ([MS-ADA1] section 2.61) is a multi-valued UNICODE_STRING attribute (see [MS-ADTS] section 3.1.1.2.2.2, the String(Unicode) syntax). The value is formatted as follows: "X509:<SHA1-TP-PUBKEY>[thumbprint]+[publickeyhash]" where [thumbprint] is the SHA1 hash of a certificate and [publickeyhash] is the base64-encoded SHA1 hash of the X.509 certificate public key [RFC5280].

Answer 2

A better answer to this question is to Join a device, not to create one. Take a look at this post here: https://aadinternals.com/post/prt/#creating-your-own-prt

And the actual source that he's using: https://github.com/Gerenios/AADInternals

So, install the commandlet:

Install-Module AADInternals

Then authenticate and join the object:

Get-AADIntAccessTokenForAADJoin -SaveToCache
Join-AADIntDeviceToAzureAD -DeviceName "My computer" -DeviceType "Commodore" -OSVersion "C64"

This will create the device in Azure AD, like you're looking for, and will add a signed certificate to that alternativeSecurityIds field that you can authenticate your device with.