`az ad group member list` does not list service principals

[kevinharing]

Related command
az ad group member list

Describe the bug
az ad group member list does not list service principals.

To Reproduce
Run az ad group member list --group <group_name> on a group with members of type Service Principal.

Expected behavior
Returns all members of the group, including Service Principals.

Additional context

{
  "azure-cli": "2.37.0",
  "azure-cli-core": "2.37.0",
  "azure-cli-telemetry": "1.0.6",
  "extensions": {
    "account": "0.2.1",
    "aks-preview": "0.5.10",
    "application-insights": "0.1.13",
    "datafactory": "0.5.0"
  }
}

[yonzhan]

Jiashuo Li (@jiasli) for awareness

[jiasli]

Please also see #16123 (comment)

According to List members API's documentation:

https://docs.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0&tabs=http

Currently service principals are not listed as group members due to staged roll-out of service principals on Graph V1.0 endpoint.

This is a feature gap between AD Graph and Microsoft Graph.

As a workaround, you may use az rest to call beta API: https://docs.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-beta&tabs=http

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

[ncook-hxgn]

bump

We've discovered that if we log into azure cloud shell (azure-cli v2.48.1) as the service principal behind our Azure DevOps service connection, we can't use az cli to add, list, or check group members of a security group, even though our service principal owns the group. (Yields Insufficient privileges to complete the operation.)

We've also discovered that if we add a managed identity to said group manually, the managed identity isn't listed as a group member by az ad group list --group '...' (no matter who you run as)

#!/bin/bash
# running as the service principal behind an ADO service connection
principal="xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # where $principal is a system managed identity from a linux web app
group="yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" # where $group is an AAD security group with nobody in it owned by a service principal

echo "##[command]az ad group member check --group \"$group\" --member-id \"$principal\""
is_member=$(az ad group member check --group "$group" --member-id "$principal" | jq -r '.value')
if [ "$is_member" = "false" ]; then
    echo "##[command]az ad group member add --group \"$group\" --member-id \"$principal\""
    az ad group member add --group "$group" --member-id "$principal"
else
    echo "##[warning]principal \"$principal\" is already a member of group \"$group\""
fi

echo "##[command]az ad group member list --group \"$group\""
az ad group member list --group "$group"