Invoke-RestMethod ：远程服务器返回错误：（400）错误请求。 Azure AAD 添加组成员

Question

我遵循 azure 文档并创建了以下请求，以使用 powershell 脚本将成员添加到 AD 组。 但收到错误错误请求。

    $clientId = "d4b2ca57-yyyy-yyyy-zzzz-50a4ca126390"
$clientSecret = "nnr7Q~zzzzz"
$tenantID = "4f6eyyyy-yyyy-yyyy-yyyy-0981d022yyyy"


$ReqTokenBody = @{
    Grant_Type    = "client_credentials"
    Scope         = "https://graph.microsoft.com/.default"
    client_Id     = $clientId
    Client_Secret = $clientSecret
}
$TokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/domain.onmicrosoft.com/oauth2/v2.0/token" -Method POST -Body $ReqTokenBody

$TokenResponse
$token = $TokenResponse.access_token
$token
$Headers = @{"Authorization" = "Bearer $token"}
$Headers
#Get group List -> working fine
$AadGroupListRequestParams = @{
    Method  = 'GET'
    Uri     = 'https://graph.microsoft.com/v1.0/groups'
    Headers = @{
        'Authorization' = "Bearer $token" 
    }
}
$AadGroupRequestzzz = Invoke-RestMethod @AadGroupListRequestParams
$AadGroupRequestzzz.value

#Add member to group -> not working
$AadGroupMemberAddRequestParams = @{
    Method  = 'POST'
    Uri     = 'https://graph.microsoft.com/v1.0/groups/fb30b950-yyyy-yyyy-yyyy-6015f411ec3c/members/$ref'
    Headers = @{
        'Authorization' = "Bearer $token" 
    }
    Body = @{
     '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/673cf709-yyyy-yyyy-yyyy-c5c476d6yyyy"
}
}

#尝试单独传递参数以下，仍然没有用 $params = @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/673cf709-yyyy-yyyy-yyyy-c5c476d6yyyy" }

$AadGroupAddMemberRequest = Invoke-RestMethod @AadGroupMemberAddRequestParams -ContentType "application/json" -Verbose
$AadGroupAddMemberRequest.value

错误：

Invoke-RestMethod ：远程服务器返回错误：（400）错误请求。

Answer 1

请求正文需要采用 JSON 格式，因为您将参数ContentType作为application/json传递

添加成员 - 请求正文

在请求正文中，提供要添加的目录对象、用户、组或组织联系人对象的 JSON 表示。

在正文上使用ConvertTo-Json

Body = @{
     '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/673cf709-yyyy-yyyy-yyyy-c5c476d6yyyy"
} | ConvertTo-Json