You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn about the Microsoft Graph migration of Azure CLI.
4
-
author: jiasli
5
-
ms.author: jiasli
6
-
ms.date: 09/19/2024
2
+
title: Impact of Microsoft Graph migration in Azure CLI
3
+
description: Learn about the Microsoft Graph migration of Azure CLI
7
4
ms.service: azure-cli
8
5
ms.custom: devx-track-azurecli
9
6
keywords: microsoft graph, ms graph, active directory graph, ad graph, azure cli
10
7
---
11
8
12
9
# Impact of Microsoft Graph migration in Azure CLI
13
10
14
-
Because of [the deprecation of Azure Active Directory (Azure AD) Graph](/graph/migrate-azure-ad-graph-overview), the underlying Active Directory Graph API is replaced by [Microsoft Graph API](/graph/api/overview) in Azure CLI 2.37.0.
11
+
Because of [the deprecation of Azure Active Directory (Azure AD) Graph][04], the underlying Active
12
+
Directory Graph API is replaced by [Microsoft Graph API][03] in Azure CLI 2.37.0.
15
13
16
14
## Breaking changes
17
15
18
-
For differences of the underlying API and output JSON breaking changes, refer to [Property differences between Azure AD Graph and Microsoft Graph](/graph/migrate-azure-ad-graph-property-differences).
16
+
For differences in the underlying API and output JSON breaking changes, refer to
17
+
[Property differences between Azure AD Graph and Microsoft Graph][05].
19
18
20
-
For example, the most outstanding change is that `id` replaces the `objectId` property in the output JSON of a Graph object.
19
+
For example, the most notable change is that `id` replaces the `objectId` property in the output
20
+
JSON of a Graph object.
21
21
22
22
Command argument and behavior breaking changes are listed in the next section.
23
23
@@ -29,7 +29,8 @@ Command argument and behavior breaking changes are listed in the next section.
29
29
- Replace `--native-app` with `--is-fallback-public-client`
30
30
- Replace `--oauth2-allow-implicit-flow` with `--enable-access-token-issuance`
31
31
- Add `--enable-id-token-issuance` to set `web/implicitGrantSettings/enableIdTokenIssuance`
32
-
- Remove `--password` and `--credential-description`. Use `az ad app credential reset` to let Graph service create a password for you (https://github.com/Azure/azure-cli/issues/20675)
32
+
- Remove `--password` and `--credential-description`. Use `az ad app credential reset` to let Graph
33
+
service create a password for you (https://github.com/Azure/azure-cli/issues/20675)
33
34
- Add `--key-display-name` to set `keyCredential`'s `displayName`
34
35
35
36
### `az ad app permission grant`
@@ -39,22 +40,29 @@ Command argument and behavior breaking changes are listed in the next section.
39
40
40
41
### `az ad app credential reset`
41
42
42
-
- Replace `--credential-description` with `--display-name` (https://github.com/Azure/azure-cli/issues/20561)
43
-
- Remove `--password`. Without specifying certificate arguments, Graph service creates a password for you (https://github.com/Azure/azure-cli/issues/20675)
43
+
- Replace `--credential-description` with `--display-name`
44
+
(https://github.com/Azure/azure-cli/issues/20561)
45
+
- Remove `--password`. Without specifying certificate arguments, Graph service creates a password
46
+
for you (https://github.com/Azure/azure-cli/issues/20675)
44
47
45
48
### `az ad sp delete`
46
49
47
-
- This command no longer deletes the corresponding application. Use `az ad app delete` to explicitly delete the application (https://github.com/Azure/azure-cli/issues/8467)
48
-
- This command no longer deletes corresponding role assignments of the service principal. Use `az role assignment delete` to explicitly delete role assignments (https://github.com/Azure/azure-cli/issues/20805)
50
+
- This command no longer deletes the corresponding application. Use `az ad app delete` to explicitly
51
+
delete the application (https://github.com/Azure/azure-cli/issues/8467)
52
+
- This command no longer deletes corresponding role assignments of the service principal. Use
53
+
`az role assignment delete` to explicitly delete role assignments
54
+
(https://github.com/Azure/azure-cli/issues/20805)
49
55
50
56
### `az ad sp credential`
51
57
52
-
- This command group now operates on service principal, not application (https://github.com/Azure/azure-cli/issues/11458)
58
+
- This command group now operates on service principal, not application
59
+
(https://github.com/Azure/azure-cli/issues/11458)
53
60
54
61
### `az ad sp credential reset`
55
62
56
63
- Replace `--name` with `--id`
57
-
- Remove `--password`. Without specifying certificate arguments, Graph service creates a password for you (https://github.com/Azure/azure-cli/issues/20675)
64
+
- Remove `--password`. Without specifying certificate arguments, Graph service creates a password
65
+
for you (https://github.com/Azure/azure-cli/issues/20675)
58
66
59
67
### `az ad user create`
60
68
@@ -74,25 +82,49 @@ Command argument and behavior breaking changes are listed in the next section.
74
82
75
83
## Known issues
76
84
77
-
- Regarding generic update arguments, the only supported operation is `--set` on the root level of a Graph object. Due to the underlying infrastructure change, the use of `--add`, `--remove` or `--set` on sublevels currently doesn't work. For unsupported scenarios, you may use `az rest` to directly call [Microsoft Graph API](/graph/api/overview). Examples can be found at https://github.com/Azure/azure-cli/issues/22580.
78
-
- Microsoft Graph related commands like `az ad` and `az role` fail in Azure Stack environments that don't have Microsoft Graph support. Use Azure CLI 2.36.0 or earlier versions for Azure Stack environments.
85
+
- Regarding generic update arguments, the only supported operation is `--set` on the root level of a
86
+
Graph object. Due to the underlying infrastructure change, the use of `--add`, `--remove`, or
87
+
`--set` on sublevels currently doesn't work. For unsupported scenarios, you could use `az rest` to
88
+
directly call [Microsoft Graph API][03]. Examples can be found at
89
+
https://github.com/Azure/azure-cli/issues/22580.
90
+
- Microsoft Graph related commands like `az ad` and `az role` fail in Azure Stack environments that
91
+
lack Microsoft Graph support. Use Azure CLI 2.36.0 or earlier versions for Azure Stack
92
+
environments.
79
93
80
94
## Install a previous version
81
95
82
-
If you aren't ready for the migration yet, such as lacking Microsoft Graph permissions, you may keep using Azure CLI versions <= 2.36.0. If you have already installed 2.37.0, you may roll back to a previous version following the "Install specific version" section under the [installation documents](./install-azure-cli.md) (except for Homebrew, which doesn't support installing previous versions).
96
+
If you aren't ready for the migration yet, such as lacking Microsoft Graph permissions, you can
97
+
continue using Azure CLI versions <= 2.36.0. If you already installed version 2.37.0, you can roll
98
+
back to a previous version by following the "Install specific version" section in the
99
+
[installation documents][01] (except for Homebrew, which doesn't support installing previous
100
+
versions).
83
101
84
102
## Troubleshooting
85
103
86
104
### Graph command fails with `AADSTS50005` or `AADSTS53000`
87
105
88
-
Your tenant may have Conditional Access policies that block using device code flow to access Microsoft Graph. In such cases, use authorization code flow or a service principal to sign in instead. For more information about sign in methods, see [Sign in with Azure CLI](authenticate-azure-cli.md).
106
+
Your tenant might have Conditional Access policies that block the use of device code flow to access
107
+
Microsoft Graph. In such cases, use authorization code flow or a service principal to sign in
108
+
instead. For more information about sign-in methods, see [Sign in with Azure CLI][06].
89
109
90
-
Microsoft tenant (72f988bf-86f1-41af-91ab-2d7cd011db47) has such Conditional Access policies configured.
110
+
Microsoft tenant (72f988bf-86f1-41af-91ab-2d7cd011db47) has such Conditional Access policies
111
+
configured.
91
112
92
113
## More information
93
114
94
-
You can find more information about the Microsoft Graph migration on https://github.com/Azure/azure-cli/issues/22580.
115
+
You can find more information about the Microsoft Graph migration on
116
+
https://github.com/Azure/azure-cli/issues/22580.
95
117
96
118
## Give feedback
97
119
98
-
If you have any questions, reply to https://github.com/Azure/azure-cli/issues/22580 or create a new issue with the [`az feedback`](/cli/azure/reference-index#az-feedback) command.
120
+
If you have any questions, reply to https://github.com/Azure/azure-cli/issues/22580 or create a new
0 commit comments