Invalid object identifier when filtering users by appRoleAssignments

Question

I am trying to filter users using GraphAPI v1.0, providing the following filter to https://graph.microsoft.com/v1.0/users endpoint:

$filter=appRoleAssignments/any(a:a/id eq 'app_role_assignment_id')

where app_role_assignment_id is a value obtained from https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRolesAssignedTo endpoint.

This filter is described here: https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http#user-properties as the supported by default.

But I receive the following error in response:

 "error": {
        "code": "Request_BadRequest",
        "message": "Invalid object identifier 'my value for app_role_assignment_id'.",
        "innerError": {
            ...
        }
    }

If I pass some User.Id (GUID) value as a right hand part of the filter, I receive the user with this ID.

Answer 1

Hi @Stanislav Alekminskii

Based on my testing, it doesn't seem to be possible to filter the user set by giving the "appRoleAssignment_id". Because appRoleAssignments is a navigation property, not a built-in property, you can't get it directly, only through an extended property.

However, $expand parameters do not currently support nested $filter parameters, which means that you can't filter when extending the appRoleAssignments property.

I recommend that you filter the user set locally after extending the appRoleAssignments property:

GET /users?$expand=appRoleAssignments

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.