使用身份 ADO API 找不到 AAD 组

Question

我正在尝试复制 this process 将审阅者添加到我的 ADO PR 的方法，并希望专门使其适用于 AAD 组。据我了解，this endpoint of adding reviewers to a PR 需要一个单独的 ID，它不是用户/组的对象 ID（我称之为 ADO ID）。我正在尝试使用 this endpoint 通过提供 AAD 组的对象 ID 来提取 ADO ID。我已经成功地为某些群体找到了它，但没有为其他群体找到它，我不确定为什么会这样。我也成功地使用它通过指定他们的电子邮件来找到用户，但对于组来说它有点棘手。我尝试指定组的名称，但得到的结果与使用对象 ID 相同。我无权访问该组的身份 ID、身份描述符或主题描述符。请指教，谢谢。

Answer 1

注意：在执行以下方法之前，请确保您的组织已连接到您要添加的组所在的正确 AAD。

直接搜索AAD组并将其添加到Pull Request中，步骤如下：

1. 执行以下 API 以搜索并获取要添加的 AAD 组的详细信息。
   • 请求 URI：

     POST https://dev.azure.com/{organization}/_apis/IdentityPicker/Identities?api-version=5.0-preview.1
     

   • 请求正文：

     {
         "query": "{AAD group name}",
         "identityTypes": ["user", "group"],
         "operationScopes": ["ims", "source"],
         "options": {
             "MinResults": 5,
             "MaxResults": 40
         },
         "properties": [
             "DisplayName",
             "IsMru",
             "ScopeName",
             "SamAccountName",
             "Active",
             "SubjectDescriptor",
             "Department",
             "JobTitle",
             "Mail",
             "MailNickname",
             "PhysicalDeliveryOfficeName",
             "SignInAddress",
             "Surname",
             "Guest",
             "TelephoneNumber",
             "Manager",
             "Description"
         ]
     }
     

   • 响应正文：

     {
         "results": [
             {
                 "queryToken": "addtovsts",
                 "identities": [
                     {
                         "entityId": "{entityId}",
                         "entityType": "Group",
                         "originDirectory": "aad",
                         "originId": "{AAD group ID}",
                         "localDirectory": null,
                         "localId": null,
                         "displayName": "{AAD group name}",
                         "scopeName": "{AAD name}",
                         "samAccountName": null,
                         "active": null,
                         "subjectDescriptor": null,
                         "department": null,
                         "jobTitle": null,
                         "mail": "{mail}",
                         "mailNickname": "{mailNickname}",
                         "physicalDeliveryOfficeName": null,
                         "signInAddress": null,
                         "surname": null,
                         "guest": false,
                         "telephoneNumber": null,
                         "description": null,
                         "isMru": false
                     }
                 ],
                 "pagingToken": ""
             }
         ]
     }
     

2. 使用之前 API 返回的详细信息，执行以下 API 以将 AAD 组添加到拉取请求中。
   • 请求 URI：

     PUT https://dev.azure.com/{organization}/{project}/_apis/git/repositories/{repositoryId}/pullRequests/{pullRequestId}/reviewers?api-version=5.0
     

   • 请求正文：

     {
         "entityId": "{entityId}",
         "entityType": "Group",
         "active": null,
         "department": null,
         "description": null,
         "displayName": "{AAD group name}",
         "guest": false,
         "id": "{AAD group ID}",
         "isAadIdentity": true,
         "isContainer": true,
         "isHosted": true,
         "isMru": false,
         "isRequired": false,  // 'true' will set the group as the Required Reviewer, 'false' is Optional Reviewer
         "jobTitle": null,
         "localDirectory": null,
         "localId": null,
         "mail": "{mail}",  // if you did not set mail, set the value same as 'mailNickname'
         "mailNickname": "{mailNickname}",
         "originDirectory": "aad",
         "originId": "{AAD group ID}",
         "physicalDeliveryOfficeName": null,
         "samAccountName": null,
         "scopeName": "{AAD name}",
         "signInAddress": null,
         "subjectDescriptor": null,
         "surname": null,
         "telephoneNumber": null,
         "vote": 0
     }