Migrate ADGraph to MSGraph

[xuzhang3]

SUMMARY

ISSUE TYPE

• Bugfix Pull Request
• Docs Pull Request
• Feature Pull Request
• New Module Pull Request

COMPONENT NAME

ADDITIONAL INFORMATION

[l3ender]

We just updated to the 2.x version of the collection and started seeing the following errors with our Ansible service principal (app registration):

APIError
Code: 403
message: None
error: MainError(additional_data={}, code='Authorization_RequestDenied', details=None, inner_error=InnerError(additional_data={'date': DateTime(2024, 3, 13, 18, 50, 25, tzinfo=Timezone('UTC'))}, client_request_id='957e2f10-ffb6-4de3-b84b-eba7263ef1e3', date=None, odata_type=None, request_id='8102b970-a9c8-4b3b-be26-b7c5d53aa5b7'), message='Insufficient privileges to complete the operation.', target=None)

This was due to the change done to migrate from AD Graph to MS Graph (this PR).

To resolve, we had to add the necessary permission to our service principal (Entra ID > App Registrations > API Permissions). In our case, we are only using the azure_rm_adgroup_info module and so only need read access to directories.

The first entry is the legacy one, the second is the updated. After we fully migrate we will be removing the first entry.

I suggest the changelog/release notes be updated to clearly specify action is required for this change and that the graph update is a breaking change. As the notes currently stand, it wasn't quite clear (to me) that this was part of the breaking change. We believe this should have been more clearly mentioned as a breaking change, as mentioned back in 2021 - #573 (comment).

Hopefully this helps someone else. Thanks!