GraphClient.DirectoryObjects.GetByIds throws JsonReaderError

[Helenyang2024]

Describe the bug

When using GraphClient.DirectoryObjects.GetByIds with a principal ID of a custom role, the following JsonReaderError is thrown:
'{' is invalid after a value. Expected either ',', '}', or ']'. LineNumber: 0 | BytePositionInLine: 67041.

Expected behavior

Returns DirectoryObject for the existing list of ids

How to reproduce

var result = await this.GraphClient.DirectoryObjects.GetByIds.PostAsGetByIdsPostResponseAsync(
new Microsoft.Graph.Beta.DirectoryObjects.GetByIds.GetByIdsPostRequestBody
{
Ids = principalIds,
});

where principalIds include a guid id of a custom role assignment

SDK Version

No response

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

```

</details>


### Configuration

_No response_

### Other information

_No response_

[andrueastman]

Thanks for raising this @Helenyang2024

The error would suggest an issue with json body that is returned from the API. Are you able to share the version of the SDK you are using when making this call?

Are you also able to follow the guidance below to capture the response body to help validate if the json is indeed invalid?
https://github.com/microsoftgraph/msgraph-sdk-dotnet-core/blob/main/docs/logging-requests.md

[tlrdstd]

Hey @andrueastman - I'm following up on behalf of @Helenyang2024.

I've dug deeper into repro steps here. Turns out Graph is returning valid-but-unexpected JSON here AND is inconsistently handling custom roles vs built-in roles. As an (internal) customer of Graph, we expect consistent response types and to never receive a ParserException from Graph responses.

---

Setup

# perform auth
$tenantId = "..."
Connect-MgGraph -TenantId $tenantId -Scopes "User.ReadWrite.All RoleManagement.ReadWrite.Directory" -NoWelcome

# create a fake user to assign to roles
$domainName = Get-MgBetaOrganization | %{ $_.VerifiedDomains[0].Name }
$userParams = @{
    accountEnabled = $true
    displayName = "github-2759"
    mailNickname = "github-2759"
    userPrincipalName = "github-2759@$domainName"
    passwordProfile = @{ password = "$(New-Guid)" }
}
$user = New-MgUser -BodyParameter $userParams

Custom Entra role - Get-MgDirectoryObjectById throws an error and Get-MgDirectoryObject returns DirectoryObject (but should be UnifiedRoleDefinition)

# create a custom role
$customRoleParams = @{
	displayName = "github-2759"
	rolePermissions = @( @{ allowedResourceActions = @( "microsoft.directory/applications/basic/read") })
    isEnabled = $true
}
$customRole = New-MgRoleManagementDirectoryRoleDefinition -BodyParameter $customRoleParams 

# assign a user so we can get the REAL RoleDefinitionId later (maybe there is a better way - this is what I found)
$customRoleAssignmentParams = @{
	action = "adminAssign"
	justification = "github-2759"
	roleDefinitionId = $customRole.Id
	directoryScopeId = "/"
	principalId = $user.Id
	scheduleInfo = @{
		expiration = @{
			type = "NoExpiration"
		}
	}
}
$customRoleAssignmentRequest = New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $customRoleAssignmentParams 

$customRoleAssignment = Get-MgRoleManagementDirectoryRoleAssignmentSchedule -UnifiedRoleAssignmentScheduleId $customRoleAssignmentRequest.Id

# returns error
Get-MgDirectoryObjectById -BodyParameter @{ ids = @( $customRoleAssignment.RoleDefinitionId ) } | fl * -force
# Get-MgDirectoryObjectById_Get: Expected comma, literal, or object. Was Eof: .

# returns generic DirectoryObject instead of UnifiedRoleDefinition
Get-MgDirectoryObject -DirectoryObjectId $customRoleAssignment.RoleDefinitionId | fl * -force

# DeletedDateTime      :
# Id                   : bd5555fa-bc60-418a-8dd6-7cfc08dd939d
# AdditionalProperties : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#directoryObjects/$entity], [@odata.type, #microsoft.graph.unifiedRoleDefinition], [displayName, github-2759], [isBuiltIn, False]…}

# with -Debug output:
Get-MgDirectoryObjectById -BodyParameter @{ ids = @( $customRoleAssignment.RoleDefinitionId ) } -Debug

Body:
{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#directoryObjects","value":[{"error":{"code":"InternalServerError","message":"A resource of type 'microsoft.graph.unifiedRoleDefinition' was found in a resource set that otherwise has entries of type 'microsoft.graph.directoryObject'. In OData, all entries in a resource set must have a common base type.","innerError":{"date":"2025-01-24T14:58:53","request-id":"73914c45-c15c-4509-97e3-7d3c300d6426","client-request-id":"20bf0032-771b-48e0-a677-2dea3b750652"}}}

DEBUG: [CmdletException]: Received exception with message 'ParserException - Expected comma, literal, or object. Was Eof: . : at Microsoft.Graph.PowerShell.Runtime.Json.JsonParser.ReadArray()

Built-in Entra role - Get-MgDirectoryObjectById returns empty result and Get-MgDirectoryObject returns DirectoryObject (but should be DirectoryRoleTemplate)

# assign fake user to a built-in role for consistency with the custom role example
$builtInRoleAssignmentParams = @{
	action = "adminAssign"
	justification = "github-2759"
	roleDefinitionId = "ffd52fa5-98dc-465c-991d-fc073eb59f8f" # Attribute Assignment Reader
	directoryScopeId = "/"
	principalId = $user.Id
	scheduleInfo = @{
		expiration = @{
			type = "NoExpiration"
		}
	}
}
$builtInRoleAssignmentRequest = New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -BodyParameter $builtInRoleAssignmentParams 

$builtInRoleAssignment = Get-MgRoleManagementDirectoryRoleAssignmentSchedule -UnifiedRoleAssignmentScheduleId $builtInRoleAssignmentRequest.Id

# returns empty result
Get-MgDirectoryObjectById -BodyParameter @{ ids = @( $builtInRoleAssignment.RoleDefinitionId ) } | fl * -force

# returns generic DirectoryObject instead of DirectoryRoleTemplate
Get-MgDirectoryObject -DirectoryObjectId $builtInRoleAssignment.RoleDefinitionId | fl * -force

# DeletedDateTime      :
# Id                   : ffd52fa5-98dc-465c-991d-fc073eb59f8f
# AdditionalProperties : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#directoryObjects/$entity], [@odata.type, #microsoft.graph.directoryRoleTemplate], [description, Read custom security attribute keys and values for supported Microsoft Entra objects.], [displayName, Attribute Assignment Reader]}

[andrueastman]

@tlrdstd Will follow up with you separately on how to follow this up with the relevant API teams. As the response is indeed invalid json, this should be resolved with the relevant API teams.