- Support v1.0 API for Entitlement Management (#133)
AccessPackageQuestion
model - add theChoices
andIsSingleLineQuestion
fieldsAccessPackageCatalog
model - add theState
fieldAssignmentReviewSettings
model - add theIsAccessRecommendationEnabled
,IsApprovalJustificationRequired
andAccessReviewTimeoutBehavior
fieldsUserSet
model - add theManagerLevel
field- New model:
AccessPackageMultipleChoiceQuestions
AccessPackage
model - theCatalogId
field is replaced by theCatalog
fieldAssignmentReviewSettings
model - theRecurrenceType
field now has a custom typeAssignmentReviewSettings
model - theReviewerType
field now has a custom type
- Support for Federated Identity Credentials (beta-only) (#134)
- Bug fix: corrected the
DisplayName
struct tag for theGroupAssignedLabel
model (#135) - Bug fix: fixed a typo in the constant
AccessPackageResourceRequestTypeAdminRemove
(wasAccessPackageResourceRequestTypeAdmminRemove
) (#135)
- Add a helper function
environments.EnvironmentFromMetadata()
which is intended to substitute theazure.EnvironmentFromURL()
function from go-autorest (#131) - Fix an incorrect API ID for KeyVault (#131)
- Improve support for dynamic group memberships (#132)
- Bug fix:
Group.MembershipRule
has changed from a*string
to a*StringNullWhenEmpty
(#132)
- Add some missing API endpoints for national cloud environments (#129)
- Add an
Api{}.IsAvailable()
method to determine whether a service is supported for an environment (#129) - Fix an incorrect hostname for
environments.KeyVaultUSGovEndpoint
(#128) - Support for
autorest.BearerAuthorizerCallback
inauth.CachedAuthorizer
(#130)
- Fix an incorrect enum value for
ConditionalAccessDevicePlatformAll
(#127)
- Support for administrative units (#124)
- Support for delegated permission grants (#126)
- Conditional Access Policies: support for
devices
anddeviceStates
in policyconditions
(#125) - Conditional Access Policies: add type aliases and constants for enum values (#125)
-
Auth package refactoring (#123)
- Remove the
auth.Api
type and instead useenvironments.Api
directly - Use the resource URI instead of the friendly name for Azure CLI auth tokens
- Remove the
-
Add the
AuxiliaryTokens()
method to theauth.Authorizer
interface to support obtaining tokens for additional tenants (#123) -
Expand support in
auth.AutorestAuthorizerWrapper
to support anyautorest.Authorizer
(#123)autorest.BearerAuthorizer
andautorest.MultiTenantBearerAuthorizer
are fully supported with access tokens, refresh tokens and expiry- Other authorizers can supply access tokens only
-
Support auxiliary tenants with client secret and client certificate authorizers (#123)
-
Implement the
autorest.Authorizer
interface withauth.CachedAuthorizer
(which wraps all supported Authorizers) (#123)- This allows authorizers to be used with https://github.com/Azure/go-autorest, with multi-tenant support, with the exception of
auth.MsiAuthorizer
- This allows authorizers to be used with https://github.com/Azure/go-autorest, with multi-tenant support, with the exception of
-
Export environment configs for more management plane APIs (#123)
- Resource Manager
- Batch Management
- Data Lake
- Gallery
- KeyVault
- Operational Insights
- OSS RDBMS
- Service Bus
- Service Management (Azure Classic)
- SQL Database
- Storage
- Synapse
-
Refactor and tidy up tests for the
msgraph
package (#123) -
Say goodbye to Azure Germany 🇩🇪 (#123)
- The signatures for
auth.NewClientCertificateAuthorizer
,auth.NewClientSecretAuthorizer
andauth.NewAzureCliAuthorizer
have changed to accommodate passing additional tenant IDs for multi-tenant authorization (#123)
- Remove a surplus configuration check when using Managed Identity authentication, which improves compatibility with Azure Cloud Shell (#119)
- Add a new authorizer
AutorestAuthorizerWrapper
which supports obtaining tokens from go-autorest viaautorest.BearerAuthorizer
(#120)
- Support for specifying the client ID when using managed identity authentication (#115)
- Mitigation for breaking API changes around the
@odata.id
field (#114)- If
@odata.id
is returned in the formobjectType('GUID')
(i.e. not a valid URI), then attempt to reconstruct a URI - This currently hardcodes the
graph.microsoft.com
host in the generated URI but this does not appear to be a problem for other clouds - This field is exported in all structs that reference it, so it's possible to override this if necessary
- If
- Support for running
msgraph
tests in national clouds (#114)
- The signatures for the
auth.NewMsiAuthorizer()
andauth.NewMsiConfig()
functions have changed to accommodate the client ID (#115)
- Support for setting OData-related HTTP headers
- Implement a new way to pass the entire
odata.Query
object as part of request inputs - Update all existing clients to pass
odata.Query
in full- The existing method of passing a
url.Values
map still works, maintains compatibility and can be used for passing non-odata related query parameters
- The existing method of passing a
- Support setting OData-related HTTP headers including
OData-Version
/OData-MaxVersion
, odata-json parameters on theAccept
header, and theConsistencyLevel
header which isn't strictly in the odata 'standard' but heavily related - Set the
odata.metadata
parameter tofull
when retrieving directory objects to ensure the@odata.id
field is returned- This dramatically increases the payload volume so we don't default it everywhere
- Implement a new way to pass the entire
- Support for assigning and retrieving a user's manager (#111)
- Add application ID for "Azure VPN" to environments package (#113)
- Bug fix:
User{}.EmployeeType
is a nullable string (#110)
- Add support for Entitlement Management (beta-only API) (#93)
- Bug fix: handle inconsistent 400 error when listing sign-in reports with an OData filter (#108)
- Bug fix: work around an API consistency issue when creating service principals for new applications that have not fully replicated (#109)
- Support for the appRolesAssignedTo endpoint (#107)
- Bug fix:
odata.Odata{}
- theCount
field is now a*int
(#105)
- Applications: add consistency check for roles/scopes that may be in the process of being disabled, when updating an application (#102)
- Applications: support for uploading application logos via the
ApplicationsClient{}.UploadLogo()
method(#103) - Directory Roles: add the
DirectoryROlesClient{}.GetByTemplateId()
method for retrieving roles by their template ID (#101) User
model: support EmployeeOrgData (#99)
- Bug fix: Correctly handle HTTP responses after retries have been exhausted for a request, so that the correct status and error can be returned (#100)
- Bug fix: Try to detect when running in Azure Cloud Shell and avoid specifying the tenant ID for Azure CLI authentication (#98)
- Bug fix: Use the correct base64 decoder when parsing token claims (#97)
- Bug fix:
User.PasswordPolicies
has changed from a*string
to a*StringNullWhenEmpty
(#96)
- Support for application templates (#95)
- Add some value types for
ConditionalAccessPolicyState
andInvitedUserType
(#94)
auth.CachedAuthorizer
- export this type and itsSource
field so that consumers can inspect it (#90)- Bugfix: set the struct tag for
ServicePrincipal.Owners
field so it is marshaled correctly (#91)
- The
auth.CachedAuthorizer()
function has been renamed toauth.NewCachedAuthorizer()
(#90)
- Support for authentication methods (#89)
- When authenticating using Azure CLI, access tokens are now cached to avoid repeatedly invoking
az
to get the latest token (#88) - Support for authentication methods usage reports (#85)
- Support for generic directory objects (#86)
- Add the
MemberOf
field to theUser
struct (#84)
- The
ID
field of theApplication
,DirectoryRole
,Group
,ServicePrincipal
andUser
models has been removed and is now a field of the embeddedDirectoryObject
struct (#86) - The
Members
and/orOwners
fields of theApplication
,DirectoryRole
,Group
andServicePrincipal
models have changed from a*[]string
to a*Members
and*Owners
respectively (#86)- The
Members
andOwners
types are based on[]DirectoryObject
and have methods to marshal/unmarshal theODataId
fields of the containedDirectoryObject
s
- The
- The
AppendMember()
and/orAppendOwner()
methods of theApplication
,Group
andServicePrincipal
models are no longer required and have been removed (#86)
- Disable the default logger for
retryablehttp.Client{}
(#83)
- Support for schema extension data for Groups and Users (#81)
- Marshaling of schema extension data is handled automatically by the Group and User structs, enabling use of the existing
Update()
methods on the respective clients. - Unmarshaling is handled by either the provided
msgraph.SchemaExtensionMap
type, or a custom type supplied by the caller. Such a custom type must have an explicitUnmarshalJSON()
method to satisfy theSchemaExtensionProperties
interface. Both approaches have examples in theTestSchemaExtensionsClient()
test.
- Marshaling of schema extension data is handled automatically by the Group and User structs, enabling use of the existing
- Support for injecting and sequencing middleware functions for manipulating and/or copying requests and responses (#78)
- See example.go for an example that logs requests and responses
- Request retry handling for rate limiting, server errors and replication delays is now handled by go-retryablehttp (#78)
msgraph.Client{}.HttpClient
is now exported so callers can supply their ownhttp.Client
(#78)
- Support
odata.Query{}
in more client methods (#80)ApplicationsClient{}.Get()
ApplicationsClient{}.GetDeleted()
ApplicationsClient{}.ListExtensions()
ConditionalAccessPolicyClient{}.Get()
DirectoryAuditReportsClient{}.Get()
DomainsClient{}.List()
DomainsClient{}.Get()
GroupsClient{}.Get()
GroupsClient{}.GetDeleted()
MeClient{}.Get()
MeClient{}.GetProfile()
NamedLocationsClient{}.Get()
NamedLocationsClient{}.GetCountry()
NamedLocationsClient{}.GetIP()
SchemaExtensionsClient{}.Get()
ServicePrincipalsClient{}.Get()
ServicePrincipalsClient{}.ListAppRoleAssignments()
SignInReportsClient{}.Get()
UsersClient{}.Get()
UsersClient{}.GetDeleted()
msgraph.ServicePrincipal{}
now supports theDescription
field (#77)msgraph.ServicePrincipal{}
now supports theNotes
field (#77)msgraph.ServicePrincipal{}
now supports theSamlMetadataUrl
field (#77)
environments.ApiAppId
is now a type aliasmsgraph.ServicePrincipal{}.LoginUrl
is now aStringNullWhenEmpty
type (#77)msgraph.ServicePrincipal{}.PreferredSingleSignOnMode
is now a type alias pointer (formerly a string pointer) (#77)
msgraph.User{}
now supports theAgeGroup
field (#76)msgraph.User{}
now supports theConsentProvidedForMinor
field (#76)
msgraph.Application{}.SignInAudience
is now a pointer reference (#76)msgraph.ServicePrincipal{}.SignInAudience
is now a pointer reference (#76)msgraph.Group{}.ResourceBehaviorOptions
is now a custom type (#75)msgraph.Group{}.ResourceProvisioningOptions
is now a custom type (#75)msgraph.Group{}.Theme
is now a custom type (#75)msgraph.Group{}.Visibility
is now a custom type (#75)msgraph.User{}.EmployeeId
is now aStringNullWhenEmpty
type (#76)msgraph.User{}.FaxNumber
is now aStringNullWhenEmpty
type (#76)msgraph.User{}.Mail
is now aStringNullWhenEmpty
type (#76)msgraph.User{}.PreferredLanguage
is now aStringNullWhenEmpty
type (#76)msgraph.ApplicationExtensionTargetObject
is now a type alias (#76)msgraph.AppRoleAllowedMemberType
is now a type alias (#76)msgraph.BodyType
is now a type alias (#76)msgraph.ExtensionSchemaPropertyDataType
is now a type alias (#76)msgraph.GroupType
is now a type alias (#76)msgraph.GroupMembershipClaim
is now a type alias (#76)msgraph.KeyCredentialType
is now a type alias (#76)msgraph.KeyCredentialUsage
is now a type alias (#76)msgraph.PermissionScopeType
is now a type alias (#76)msgraph.ResourceAccessType
is now a type alias (#76)msgraph.SignInAudience
is now a type alias (#76)
- Support the
spa
field for applications (#74)
- Support for schema extensions (#68)
- Support for retrieving
SignInActivity
for users (#72)
- Support for passing the raw bytes of a PKCS#12 bundle when using client certificate authentication. This alters the method signature of
auth.NewClientCertificateAuthorizer()
but does not affect the use of a PFX file read from the filesystem. See #65 for details and example usage.
- Support for application extensions (#61)
- Support for directory audit and sign-in reports (#61)
- This release introduces support for OData query parameters via a new type
odata.Query{}
. Instead of accepting just a filter string, all clients now accept an instance ofodata.Query{}
on relevant List methods which encapsulates any combination of odata queries such as$filter
,$search
,$top
etc. All documented parameters are supported and wrapped lightly where appropriate. (#63) - Updating to this release will require changes to affected method calls, for example:
apps, status, err := appsClient.List(ctx, odata.Query{ Filter: fmt.Sprintf("startsWith(displayName,'%s')", searchTerm), OrderBy: odata.OrderBy{ Field: "displayName", Direction: "asc", }, Top: 10, })
- Where an empty filter string was previously specified, it should be replaced with an empty
odata.Query{}
struct:apps, status, err := appsClient.List(ctx, odata.Query{})
- Support for restoring deleted applications/users/groups (#58)
- Support
PersonalMicrosoftAccount
for theSignInAudience
field for Applications (#59)
- This release adds a new type alias
StringNullWhenEmpty
which has replaced several existing field string types - It enables zeroing field values that don't accept empty strings. See (#59) for details and example usage
BEHAVIORAL CHANGES:
- This release implements a retry mechanism for some types of failed requests where the likely cause is indicated to be replication delays in Azure Active Directory (#57)
- Client methods which retrieve, update or delete single, mutable objects will all exert this retry mechanism, and may take up to 2 minutes to return (successfully or not)
- To opt out of this behavior, simply set the
BaseClient.DisableRetries
field totrue
on your client(s), for example:client := msgraph.NewApplicationsClient(tenantId) client.BaseClient.DisableRetries = true
- Bug fix: Set correct OData types when updating named locations (#55)
- Support for permanently deleting applications, groups and service principals (#54)
- Add a
NamedLocationsClient{}.Get()
method (#56)
- Bug fix: Restore a missing field
OnPremisesImmutableId
in the User model (#53)
- Bug fix: Correctly marshal the request body for
ApplicationsClient{}.AddPassword()
andServicePrincipalsClient{}.AddPassword()
(#49) - Bug fix: Resolve a potential race condition where a cached access token might be refreshed multiple times unnecessarily (#46)
- Support for app role assignments using the appRolesAssignedTo and appRoleAssignments endpoints (#39)
- Support for listing deleted applications, groups and users (#48)
- Support for retrieving deleted applications, groups and users (#51)
- Bug fix: Don't clear
GroupMembershipClaims
when nil for an Application (#40) - Bug fix: Handle empty OData error collections (#43)
- Support for sending emails from the authenticated user principal or a specified user (#37)
- Support for the ownedObjects endpoint for service principals (#38)
- Support for managing identity providers (#41)
- Support adding and removing application passwords (#44)
- Support adding and removing service principal passwords (#45)
- Support for managing Directory Roles (#30)
- Support for activating Directory Roles (#31)
- Support for App Role Assignments (#32)
- Restore the retry mechanism previously introduced in v0.8.0
- Use the
odata
package for parsing common error messages - Handle some additional errors, mainly for
ioutil.Read*()
- Add more
ValidStatusFunc
s for gracefully handling existing owner and member refs - Remove an unused struct field
auth.ClientCredentialsConfig{}.Expires
msgraph.Application{}.GroupMembershipClaims
is now a custom typemsgraph.Application{}.SignInAudience
is now a custom typemsgraph.AppRole{}.AllowedMemberTypes
is now a custom typemsgraph.KeyCredential{}.Usage
is now a custom typemsgraph.PermissionScope{}.Type
is now a custom typemsgraph.ResourceAccess{}.Type
is now a custom typemsgraph.ServicePrincipal{}.SignInAudience
is now a custom type
- Support for Conditional Access Policies (#23)
- Support for Named Locations (IP-based and Country-based) (#24)
- Support for Directory Role Templates (#27)
- Set a default User Agent string if not provided by the caller
- Improved error handling
- This release refactors various packages to make for a better import experience.
base
,clients
andmodels
packages have been combined into a singlemsgraph
package.base/aadgraph
package has been moved toaadgraph
.base/odata
package has been moved toodata
.
- Add support for guest user invitations (#21)
- Exponential backoff for handling rate limited and failed requests to MS Graph and AAD Graph
- Check for supported
az
command version when using Azure CLI authentication - Remove dependency on deprecated package golang.org/x/oauth2/jws
- Merge the
auth/internal/microsoft
package intoauth
now that it's stable - Validate the MSI auth configuration before returning an MsiAuthorizer - ensure the metadata endpoint is reachable
- Support authentication using VM managed identity.
- Add App ID for Teams Services API.
- All responses from Microsoft Graph and Azure Active Directory Graph are now parsed for OData metadata. Calls to
base.Client.Delete()
,base.Client.Get()
,base.Client.Patch()
,base.Client.Post()
andbase.client.Put()
each now return OData metadata in addition to the complete response. - Support for v1 and v2 access tokens from Microsoft Identity Platform. Defaults to v2 tokens.
- Support for acquiring access tokens for Microsoft Graph or Azure Active Directory graph. Since the MSID platform only supports scopes from a single API per token, these must be requested separately if using both APIs.
- Token claims parsed now includes scopes (
scp
claim) - Export app IDs for several published APIs from Microsoft. These can be reliably consumed as
environments.PublishedApis
. - Support for querying Azure Active Directory Graph API
- This is intended as a stopgap solution for when it's not possible to perform an action using Microsoft Graph.
- A number of endpoints do not yet have equivalents in MS Graph, notably those used by the Azure Portal.
- There is only a base client at present.
- Method signature for
auth.Config.NewAuthorizer()
has changed to include the API to request tokens for. - Corresponding function signatures for
auth.NewAzureCliAuthorizer()
,auth.NewClientCertificateAuthorizer()
andauth.NewClientSecretAuthorizer()
also now include anapi
argument. - The
auth.NewAzureCliConfig()
function also now includes anapi
argument. - Functions implementing
base.ValidStatusFunc
must now accept a second argument as the pointer to abase.odata.OData
struct. - The
environments.MsGraphEndpoint
type has been removed in favor ofenvironments.ApiEndpoint
. - The
endpoint
argument formodels.Application.AppendOwner()
,models.Group.AppendMember()
andmodels.Group.AppendOwner()
methods should now be anenvironments.ApiEndpoint
. - The environments package now exports
Api
structs for each national cloud and API combination, e.g.environments.MsGraphGermany
. - The
Environment
structs exports in the environments package have been changed to referenceApi
s and no longer includeMsGraphEndpoint
.
- Adds the
ServicePrincipalsClient.ListGroupMemberships()
method. - Adds the
UsersClient.ListGroupMemberships()
method. - Pagination handling: multiple pages of results with OData metadata are now automatically retrieved and merged together in the BaseClient for GET requests.
- Methods on
models.ApplcationApi
to manageOauth2PermissionScopes
. - Tests for
auth
andclients
packages.
Add support for all national clouds:
- Global: graph.microsoft.com
- Germany: graph.microsoft.de
- China: microsoftgraph.chinacloudapi.cn
- US Government L4: graph.microsoft.us
- US Government L5 (DOD): dod-graph.microsoft.us
Note that this is a breaking change from v0.1.0 as the signatures for all the clients have changed. If you are using the global cloud, you do not need to specify this when creating a new client as it is the default. However, you do need to specify a cloud environment when acquiring an access token using auth.NewAuthorizer.
Initial release. Working support for:
- Applications
- Domains
- Groups
- Service Principals
- Users