- Support for Connected Organizations (#156)
- Bugfix: Add nil slice check in
AccessPackageResourceClient.Get()(#187) - Bugfix:
AccessPackageResource.Descriptionhas changed from a*boolto a*string(#187)
- Environments: add Synapse API in USGovernment (#186)
- Service Principals: support for the
Oauth2PermissionScopesfield (jsonoauth2PermissionScopes), which is used by the v1.0 API (#183)
- Bug fix:
SynchronizationTaskExecution.CountEntitledhas changed from astringto anint64(#172) - Support for B2C User Flows (#179)
- Support for User Flow Attributes (#182)
- Add an
AdditionalDatafield of typemap[string]interface{}to theDirectoryObjectmodel, for returning additional untyped fields (#171) AppRoleAssignmentsClient.List()- support odata query parameters (#181)- Environments: add new well-known App IDs
MicrosoftAzureFrontDoor andMicrosoftAzureFrontDoorCdn` (#175) - OData: Support for a
ConsistencyLevelheader with the valuesession(#174)
Group.GroupTypeshas changed from a[]GroupTypeto a*[]GroupType(#160)Group.ResourceBehaviorOptionshas changed from a[]GroupResourceBehaviorOptionto a*[]GroupResourceBehaviorOption(#160)Group.ResourceProvisioningOptionshas changed from a[]GroupResourceProvisioningOptionto a*[]GroupResourceProvisioningOption(#160)
- Bugfix: Add missing configuration checks for OIDC methods in the
auth.Config.NewAuthorizer()method (#173)
- Support for OIDC federated authentication by supplying an ID token directly (#166)
- Support for Azure AD Synchronization (#167)
- Added Azure Security Insights to
environments.PublishedApis(#162) - Added
linuxto supportedmsgraph.ConditionalAccessDevicePlatformvalues (#163) - Added
SubscribeMembersToCalendarEventsDisabledto supportedmsgraph.GroupResourceBehaviorOptionvalues (#163)
- Removed
omitemptyfrom the JSON struct tag for theLocationsandPlatformsfields of themsgraph.ConditionalAccessConditionSetmodel (#161)
- Bugfix: Set the correct URL for
environments.KeyVaultUSGovEndpoint(#157) - Support for Token Signing Certificates for service principals (#151, #158)
- This release removes the following, which have been replaced by compatible equivalents in the new hamilton-autorest module (#154)
auth.AutorestAuthorizerWrapper{}structauth.CachedAuthorizer{}.BearerAuthorizerCallback()methodauth.CachedAuthorizer{}.WithAuthorization()methodauth.NewAutorestAuthorizerWrapper()functionauth.ServicePrincipalTokeninterfaceenvironments.EnvironmentFromMetadata()function
- Broaden the regular expression used for fixing up bad oData IDs when marshaling an
odata.Id(#152) - Support for Claims Mapping Policies (#147)
- Bug fix:
UnifiedRoleDefinition.Descriptionhas changed from a*stringto a*StringNullWhenEmpty(#148) - Bug fix:
UnifiedRolePermission.Conditionhas changed from a*stringto a*StringNullWhenEmpty(#148)
- Support for selecting GitHub OIDC authentication when using the
auth.NewAuthorizer()helper function (#145) - Bump supported Go version to 1.17.6 (#145)
- Bug fix: Correct the type for
AllowExternalSendersfield in theGroupmodel (#143) GroupsClient{}.Update()- Don't include the ID in the body when updating a group, as this prevents some Unified group fields from being updated (#143)
- Add a new authorizer
GitHubOIDCAuthorizerwhich supports OIDC token exchange for authenticating to Azure Active Directory (#142) - Support v1.0 API for Entitlement Management (#133)
AccessPackageQuestionmodel - add theChoicesandIsSingleLineQuestionfieldsAccessPackageCatalogmodel - add theStatefieldAssignmentReviewSettingsmodel - add theIsAccessRecommendationEnabled,IsApprovalJustificationRequiredandAccessReviewTimeoutBehaviorfieldsUserSetmodel - add theManagerLevelfield- New model:
AccessPackageMultipleChoiceQuestions
- Support for Role Definitions via the unified role management endpoint (#137)
- Support for Role Assignments via the unified role management endpoint (#137)
AccessPackagemodel - theCatalogIdfield is replaced by theCatalogfieldAssignmentReviewSettingsmodel - theRecurrenceTypefield now has a custom typeAssignmentReviewSettingsmodel - theReviewerTypefield now has a custom type
- Support for Federated Identity Credentials (beta-only) (#134)
- Bug fix: corrected the
DisplayNamestruct tag for theGroupAssignedLabelmodel (#135) - Bug fix: fixed a typo in the constant
AccessPackageResourceRequestTypeAdminRemove(wasAccessPackageResourceRequestTypeAdmminRemove) (#135)
- Add a helper function
environments.EnvironmentFromMetadata()which is intended to substitute theazure.EnvironmentFromURL()function from go-autorest (#131) - Fix an incorrect API ID for KeyVault (#131)
- Improve support for dynamic group memberships (#132)
- Bug fix:
Group.MembershipRulehas changed from a*stringto a*StringNullWhenEmpty(#132)
- Add some missing API endpoints for national cloud environments (#129)
- Add an
Api{}.IsAvailable()method to determine whether a service is supported for an environment (#129) - Fix an incorrect hostname for
environments.KeyVaultUSGovEndpoint(#128) - Support for
autorest.BearerAuthorizerCallbackinauth.CachedAuthorizer(#130)
- Fix an incorrect enum value for
ConditionalAccessDevicePlatformAll(#127)
- Support for administrative units (#124)
- Support for delegated permission grants (#126)
- Conditional Access Policies: support for
devicesanddeviceStatesin policyconditions(#125) - Conditional Access Policies: add type aliases and constants for enum values (#125)
-
Auth package refactoring (#123)
- Remove the
auth.Apitype and instead useenvironments.Apidirectly - Use the resource URI instead of the friendly name for Azure CLI auth tokens
- Remove the
-
Add the
AuxiliaryTokens()method to theauth.Authorizerinterface to support obtaining tokens for additional tenants (#123) -
Expand support in
auth.AutorestAuthorizerWrapperto support anyautorest.Authorizer(#123)autorest.BearerAuthorizerandautorest.MultiTenantBearerAuthorizerare fully supported with access tokens, refresh tokens and expiry- Other authorizers can supply access tokens only
-
Support auxiliary tenants with client secret and client certificate authorizers (#123)
-
Implement the
autorest.Authorizerinterface withauth.CachedAuthorizer(which wraps all supported Authorizers) (#123)- This allows authorizers to be used with https://github.com/Azure/go-autorest, with multi-tenant support, with the exception of
auth.MsiAuthorizer
- This allows authorizers to be used with https://github.com/Azure/go-autorest, with multi-tenant support, with the exception of
-
Export environment configs for more management plane APIs (#123)
- Resource Manager
- Batch Management
- Data Lake
- Gallery
- KeyVault
- Operational Insights
- OSS RDBMS
- Service Bus
- Service Management (Azure Classic)
- SQL Database
- Storage
- Synapse
-
Refactor and tidy up tests for the
msgraphpackage (#123) -
Say goodbye to Azure Germany 🇩🇪 (#123)
- The signatures for
auth.NewClientCertificateAuthorizer,auth.NewClientSecretAuthorizerandauth.NewAzureCliAuthorizerhave changed to accommodate passing additional tenant IDs for multi-tenant authorization (#123)
- Remove a surplus configuration check when using Managed Identity authentication, which improves compatibility with Azure Cloud Shell (#119)
- Add a new authorizer
AutorestAuthorizerWrapperwhich supports obtaining tokens from go-autorest viaautorest.BearerAuthorizer(#120)
- Support for specifying the client ID when using managed identity authentication (#115)
- Mitigation for breaking API changes around the
@odata.idfield (#114)- If
@odata.idis returned in the formobjectType('GUID')(i.e. not a valid URI), then attempt to reconstruct a URI - This currently hardcodes the
graph.microsoft.comhost in the generated URI but this does not appear to be a problem for other clouds - This field is exported in all structs that reference it, so it's possible to override this if necessary
- If
- Support for running
msgraphtests in national clouds (#114)
- The signatures for the
auth.NewMsiAuthorizer()andauth.NewMsiConfig()functions have changed to accommodate the client ID (#115)
- Support for setting OData-related HTTP headers
- Implement a new way to pass the entire
odata.Queryobject as part of request inputs - Update all existing clients to pass
odata.Queryin full- The existing method of passing a
url.Valuesmap still works, maintains compatibility and can be used for passing non-odata related query parameters
- The existing method of passing a
- Support setting OData-related HTTP headers including
OData-Version/OData-MaxVersion, odata-json parameters on theAcceptheader, and theConsistencyLevelheader which isn't strictly in the odata 'standard' but heavily related - Set the
odata.metadataparameter tofullwhen retrieving directory objects to ensure the@odata.idfield is returned- This dramatically increases the payload volume so we don't default it everywhere
- Implement a new way to pass the entire
- Support for assigning and retrieving a user's manager (#111)
- Add application ID for "Azure VPN" to environments package (#113)
- Bug fix:
User{}.EmployeeTypeis a nullable string (#110)
- Add support for Entitlement Management (beta-only API) (#93)
- Bug fix: handle inconsistent 400 error when listing sign-in reports with an OData filter (#108)
- Bug fix: work around an API consistency issue when creating service principals for new applications that have not fully replicated (#109)
- Support for the appRolesAssignedTo endpoint (#107)
- Bug fix:
odata.Odata{}- theCountfield is now a*int(#105)
- Applications: add consistency check for roles/scopes that may be in the process of being disabled, when updating an application (#102)
- Applications: support for uploading application logos via the
ApplicationsClient{}.UploadLogo()method(#103) - Directory Roles: add the
DirectoryROlesClient{}.GetByTemplateId()method for retrieving roles by their template ID (#101) Usermodel: support EmployeeOrgData (#99)
- Bug fix: Correctly handle HTTP responses after retries have been exhausted for a request, so that the correct status and error can be returned (#100)
- Bug fix: Try to detect when running in Azure Cloud Shell and avoid specifying the tenant ID for Azure CLI authentication (#98)
- Bug fix: Use the correct base64 decoder when parsing token claims (#97)
- Bug fix:
User.PasswordPolicieshas changed from a*stringto a*StringNullWhenEmpty(#96)
- Support for application templates (#95)
- Add some value types for
ConditionalAccessPolicyStateandInvitedUserType(#94)
auth.CachedAuthorizer- export this type and itsSourcefield so that consumers can inspect it (#90)- Bugfix: set the struct tag for
ServicePrincipal.Ownersfield so it is marshaled correctly (#91)
- The
auth.CachedAuthorizer()function has been renamed toauth.NewCachedAuthorizer()(#90)
- Support for authentication methods (#89)
- When authenticating using Azure CLI, access tokens are now cached to avoid repeatedly invoking
azto get the latest token (#88) - Support for authentication methods usage reports (#85)
- Support for generic directory objects (#86)
- Add the
MemberOffield to theUserstruct (#84)
- The
IDfield of theApplication,DirectoryRole,Group,ServicePrincipalandUsermodels has been removed and is now a field of the embeddedDirectoryObjectstruct (#86) - The
Membersand/orOwnersfields of theApplication,DirectoryRole,GroupandServicePrincipalmodels have changed from a*[]stringto a*Membersand*Ownersrespectively (#86)- The
MembersandOwnerstypes are based on[]DirectoryObjectand have methods to marshal/unmarshal theODataIdfields of the containedDirectoryObjects
- The
- The
AppendMember()and/orAppendOwner()methods of theApplication,GroupandServicePrincipalmodels are no longer required and have been removed (#86)
- Disable the default logger for
retryablehttp.Client{}(#83)
- Support for schema extension data for Groups and Users (#81)
- Marshaling of schema extension data is handled automatically by the Group and User structs, enabling use of the existing
Update()methods on the respective clients. - Unmarshaling is handled by either the provided
msgraph.SchemaExtensionMaptype, or a custom type supplied by the caller. Such a custom type must have an explicitUnmarshalJSON()method to satisfy theSchemaExtensionPropertiesinterface. Both approaches have examples in theTestSchemaExtensionsClient()test.
- Marshaling of schema extension data is handled automatically by the Group and User structs, enabling use of the existing
- Support for injecting and sequencing middleware functions for manipulating and/or copying requests and responses (#78)
- See example.go for an example that logs requests and responses
- Request retry handling for rate limiting, server errors and replication delays is now handled by go-retryablehttp (#78)
msgraph.Client{}.HttpClientis now exported so callers can supply their ownhttp.Client(#78)
- Support
odata.Query{}in more client methods (#80)ApplicationsClient{}.Get()ApplicationsClient{}.GetDeleted()ApplicationsClient{}.ListExtensions()ConditionalAccessPolicyClient{}.Get()DirectoryAuditReportsClient{}.Get()DomainsClient{}.List()DomainsClient{}.Get()GroupsClient{}.Get()GroupsClient{}.GetDeleted()MeClient{}.Get()MeClient{}.GetProfile()NamedLocationsClient{}.Get()NamedLocationsClient{}.GetCountry()NamedLocationsClient{}.GetIP()SchemaExtensionsClient{}.Get()ServicePrincipalsClient{}.Get()ServicePrincipalsClient{}.ListAppRoleAssignments()SignInReportsClient{}.Get()UsersClient{}.Get()UsersClient{}.GetDeleted()
msgraph.ServicePrincipal{}now supports theDescriptionfield (#77)msgraph.ServicePrincipal{}now supports theNotesfield (#77)msgraph.ServicePrincipal{}now supports theSamlMetadataUrlfield (#77)
environments.ApiAppIdis now a type aliasmsgraph.ServicePrincipal{}.LoginUrlis now aStringNullWhenEmptytype (#77)msgraph.ServicePrincipal{}.PreferredSingleSignOnModeis now a type alias pointer (formerly a string pointer) (#77)
msgraph.User{}now supports theAgeGroupfield (#76)msgraph.User{}now supports theConsentProvidedForMinorfield (#76)
msgraph.Application{}.SignInAudienceis now a pointer reference (#76)msgraph.ServicePrincipal{}.SignInAudienceis now a pointer reference (#76)msgraph.Group{}.ResourceBehaviorOptionsis now a custom type (#75)msgraph.Group{}.ResourceProvisioningOptionsis now a custom type (#75)msgraph.Group{}.Themeis now a custom type (#75)msgraph.Group{}.Visibilityis now a custom type (#75)msgraph.User{}.EmployeeIdis now aStringNullWhenEmptytype (#76)msgraph.User{}.FaxNumberis now aStringNullWhenEmptytype (#76)msgraph.User{}.Mailis now aStringNullWhenEmptytype (#76)msgraph.User{}.PreferredLanguageis now aStringNullWhenEmptytype (#76)msgraph.ApplicationExtensionTargetObjectis now a type alias (#76)msgraph.AppRoleAllowedMemberTypeis now a type alias (#76)msgraph.BodyTypeis now a type alias (#76)msgraph.ExtensionSchemaPropertyDataTypeis now a type alias (#76)msgraph.GroupTypeis now a type alias (#76)msgraph.GroupMembershipClaimis now a type alias (#76)msgraph.KeyCredentialTypeis now a type alias (#76)msgraph.KeyCredentialUsageis now a type alias (#76)msgraph.PermissionScopeTypeis now a type alias (#76)msgraph.ResourceAccessTypeis now a type alias (#76)msgraph.SignInAudienceis now a type alias (#76)
- Support the
spafield for applications (#74)
- Support for schema extensions (#68)
- Support for retrieving
SignInActivityfor users (#72)
- Support for passing the raw bytes of a PKCS#12 bundle when using client certificate authentication. This alters the method signature of
auth.NewClientCertificateAuthorizer()but does not affect the use of a PFX file read from the filesystem. See #65 for details and example usage.
- Support for application extensions (#61)
- Support for directory audit and sign-in reports (#61)
- This release introduces support for OData query parameters via a new type
odata.Query{}. Instead of accepting just a filter string, all clients now accept an instance ofodata.Query{}on relevant List methods which encapsulates any combination of odata queries such as$filter,$search,$topetc. All documented parameters are supported and wrapped lightly where appropriate. (#63) - Updating to this release will require changes to affected method calls, for example:
apps, status, err := appsClient.List(ctx, odata.Query{ Filter: fmt.Sprintf("startsWith(displayName,'%s')", searchTerm), OrderBy: odata.OrderBy{ Field: "displayName", Direction: "asc", }, Top: 10, })
- Where an empty filter string was previously specified, it should be replaced with an empty
odata.Query{}struct:apps, status, err := appsClient.List(ctx, odata.Query{})
- Support for restoring deleted applications/users/groups (#58)
- Support
PersonalMicrosoftAccountfor theSignInAudiencefield for Applications (#59)
- This release adds a new type alias
StringNullWhenEmptywhich has replaced several existing field string types - It enables zeroing field values that don't accept empty strings. See (#59) for details and example usage
BEHAVIORAL CHANGES:
- This release implements a retry mechanism for some types of failed requests where the likely cause is indicated to be replication delays in Azure Active Directory (#57)
- Client methods which retrieve, update or delete single, mutable objects will all exert this retry mechanism, and may take up to 2 minutes to return (successfully or not)
- To opt out of this behavior, simply set the
BaseClient.DisableRetriesfield totrueon your client(s), for example:client := msgraph.NewApplicationsClient(tenantId) client.BaseClient.DisableRetries = true
- Bug fix: Set correct OData types when updating named locations (#55)
- Support for permanently deleting applications, groups and service principals (#54)
- Add a
NamedLocationsClient{}.Get()method (#56)
- Bug fix: Restore a missing field
OnPremisesImmutableIdin the User model (#53)
- Bug fix: Correctly marshal the request body for
ApplicationsClient{}.AddPassword()andServicePrincipalsClient{}.AddPassword()(#49) - Bug fix: Resolve a potential race condition where a cached access token might be refreshed multiple times unnecessarily (#46)
- Support for app role assignments using the appRolesAssignedTo and appRoleAssignments endpoints (#39)
- Support for listing deleted applications, groups and users (#48)
- Support for retrieving deleted applications, groups and users (#51)
- Bug fix: Don't clear
GroupMembershipClaimswhen nil for an Application (#40) - Bug fix: Handle empty OData error collections (#43)
- Support for sending emails from the authenticated user principal or a specified user (#37)
- Support for the ownedObjects endpoint for service principals (#38)
- Support for managing identity providers (#41)
- Support adding and removing application passwords (#44)
- Support adding and removing service principal passwords (#45)
- Support for managing Directory Roles (#30)
- Support for activating Directory Roles (#31)
- Support for App Role Assignments (#32)
- Restore the retry mechanism previously introduced in v0.8.0
- Use the
odatapackage for parsing common error messages - Handle some additional errors, mainly for
ioutil.Read*() - Add more
ValidStatusFuncs for gracefully handling existing owner and member refs - Remove an unused struct field
auth.ClientCredentialsConfig{}.Expires
msgraph.Application{}.GroupMembershipClaimsis now a custom typemsgraph.Application{}.SignInAudienceis now a custom typemsgraph.AppRole{}.AllowedMemberTypesis now a custom typemsgraph.KeyCredential{}.Usageis now a custom typemsgraph.PermissionScope{}.Typeis now a custom typemsgraph.ResourceAccess{}.Typeis now a custom typemsgraph.ServicePrincipal{}.SignInAudienceis now a custom type
- Support for Conditional Access Policies (#23)
- Support for Named Locations (IP-based and Country-based) (#24)
- Support for Directory Role Templates (#27)
- Set a default User Agent string if not provided by the caller
- Improved error handling
- This release refactors various packages to make for a better import experience.
base,clientsandmodelspackages have been combined into a singlemsgraphpackage.base/aadgraphpackage has been moved toaadgraph.base/odatapackage has been moved toodata.
- Add support for guest user invitations (#21)
- Exponential backoff for handling rate limited and failed requests to MS Graph and AAD Graph
- Check for supported
azcommand version when using Azure CLI authentication - Remove dependency on deprecated package golang.org/x/oauth2/jws
- Merge the
auth/internal/microsoftpackage intoauthnow that it's stable - Validate the MSI auth configuration before returning an MsiAuthorizer - ensure the metadata endpoint is reachable
- Support authentication using VM managed identity.
- Add App ID for Teams Services API.
- All responses from Microsoft Graph and Azure Active Directory Graph are now parsed for OData metadata. Calls to
base.Client.Delete(),base.Client.Get(),base.Client.Patch(),base.Client.Post()andbase.client.Put()each now return OData metadata in addition to the complete response. - Support for v1 and v2 access tokens from Microsoft Identity Platform. Defaults to v2 tokens.
- Support for acquiring access tokens for Microsoft Graph or Azure Active Directory graph. Since the MSID platform only supports scopes from a single API per token, these must be requested separately if using both APIs.
- Token claims parsed now includes scopes (
scpclaim) - Export app IDs for several published APIs from Microsoft. These can be reliably consumed as
environments.PublishedApis. - Support for querying Azure Active Directory Graph API
- This is intended as a stopgap solution for when it's not possible to perform an action using Microsoft Graph.
- A number of endpoints do not yet have equivalents in MS Graph, notably those used by the Azure Portal.
- There is only a base client at present.
- Method signature for
auth.Config.NewAuthorizer()has changed to include the API to request tokens for. - Corresponding function signatures for
auth.NewAzureCliAuthorizer(),auth.NewClientCertificateAuthorizer()andauth.NewClientSecretAuthorizer()also now include anapiargument. - The
auth.NewAzureCliConfig()function also now includes anapiargument. - Functions implementing
base.ValidStatusFuncmust now accept a second argument as the pointer to abase.odata.ODatastruct. - The
environments.MsGraphEndpointtype has been removed in favor ofenvironments.ApiEndpoint. - The
endpointargument formodels.Application.AppendOwner(),models.Group.AppendMember()andmodels.Group.AppendOwner()methods should now be anenvironments.ApiEndpoint. - The environments package now exports
Apistructs for each national cloud and API combination, e.g.environments.MsGraphGermany. - The
Environmentstructs exports in the environments package have been changed to referenceApis and no longer includeMsGraphEndpoint.
- Adds the
ServicePrincipalsClient.ListGroupMemberships()method. - Adds the
UsersClient.ListGroupMemberships()method. - Pagination handling: multiple pages of results with OData metadata are now automatically retrieved and merged together in the BaseClient for GET requests.
- Methods on
models.ApplcationApito manageOauth2PermissionScopes. - Tests for
authandclientspackages.
Add support for all national clouds:
- Global: graph.microsoft.com
- Germany: graph.microsoft.de
- China: microsoftgraph.chinacloudapi.cn
- US Government L4: graph.microsoft.us
- US Government L5 (DOD): dod-graph.microsoft.us
Note that this is a breaking change from v0.1.0 as the signatures for all the clients have changed. If you are using the global cloud, you do not need to specify this when creating a new client as it is the default. However, you do need to specify a cloud environment when acquiring an access token using auth.NewAuthorizer.
Initial release. Working support for:
- Applications
- Domains
- Groups
- Service Principals
- Users