Manage Group Lifecycle with Microsoft Graph

Key Takeaways

welcome to the module on managing group lifecycle with microsoft graph in this module you'll learn how to manage the lifecycle of groups the different types of groups and obtain information about users associated with a group using microsoft graph hi i'm andrew connell i'm a microsoft mvp in the area of microsoft 365 development i have a lot of experience with sharepoint development microsoft graph microsoft teams developing add-ins for microsoft office as well as developing applications for microsoft identity including azure active directory this video is the first in a series of videos on this microsoft learning module this video is also part of a playlist that includes all the videos that are associated with this module so you can watch them in order the playlist and all its included videos are associated with a microsoft learning module that includes hands-on lab exercises and additional resources check the notes for this video in the associated playlist for more information and where to find the microsoft learning module okay let's get started in this section you'll learn what groups are and the basics of working with groups using microsoft graph including the required permissions and the differences between security groups and office 365 groups finally you're also going to learn how to work with groups including how to get information about a specific group and the users who manage that group and the users that are members of that group as well the microsoft 365 developer vision focuses on the user experience and their data and as a developer you can bring your application into the user experience with over 1.2 billion users of office worldwide this is a huge opportunity to provide a window into your application to connect their data to your application there are currently over 850 million events created each month and a total of over 400 petabytes of data stored in the service that can add value to your users the microsoft graph is the gateway to your data in the microsoft cloud as you can see the microsoft cloud includes multiple services and data types that we can take advantage of from office 365 and it's all considered part of the microsoft 365 platform developers can integrate the signed in user's email calendar contacts and tasks into custom apps we can work with content in sharepoint lists and files and document libraries and in onedrive channels and content within microsoft teams and users within azure active directory there are many different services that developers can take advantage of in their custom apps many of these services have their own apis that developers can interact with however this can be challenging to go to each of these individual services with their individual endpoints each api may have its own permission model which means that they can have individual access control configurations different endpoints for each service mean our custom application will need to obtain an access token from azure id for each of the different endpoints one of the benefits of microsoft graph is that it serves as a proxy endpoint to all these other services microsoft graph encompasses things such as office 365 windows 10 enterprise mobility and security and it brings all of these different services under one unified endpoint graph.microsoft.com the advantage to using microsoft graph is that it allows developers to have just a single endpoint a resource which means you're only going to need a single access token to authenticate the different services each service still has its own individual permissions so that everything is still secured in an individual way a single endpoint makes it easier for developers to build applications microsoft graph also enables easy navigation of entities and the relationships between these entities and while there are many different microsoft 365 services such as onedrive for business or outlook for contacts and calendars these different entities are related to each other and these relationships are in the microsoft graph which makes it easy to navigate from one entity to another even if it's across different underlying endpoints microsoft graph supports two options to authenticate one option is with azure active directory only or a work in school account and the other option is converged off which means that you can either use azure id or a microsoft account and in this case you can use the exact same code in the microsoft graph the same endpoints in the same sdk to get my files either if they're in onedrive consumer or in onedrive for business and the same is true for calendar contacts and email in outlook.com or in office 365. and the nice thing about this is that the data that you fetch is all dependent on the login of the site user that signed in so you don't have to write special code or use different apis or endpoints to get the data for consumer accounts or for business accounts as previously stated microsoft graph supports both microsoft accounts and azure ad accounts also referred to as work and school accounts nothing in microsoft graphs apis or sdks is unique to the sign in process the code is the same and the sign in determines which services in microsoft graph will access if the user is signed in with a microsoft account the files endpoint maps to the onedrive consumer endpoint and while the work in school sign-ins map to onedrive for business this is just but one example to determine which account type your app supports or if it supports both you set a specific setting in the associated azure ad app in the azure ad admin center microsoft graph enables developers to work with groups in microsoft 365. groups are collections of users and other principles that share access to resources in microsoft services of your app using the microsoft graph developers can view and manage groups within microsoft 365. the group's resource with microsoft graph represents multiple things as there are different types of groups the types of groups accessible for microsoft graph include office 365 groups and security groups office 365 groups enable people to collaborate on a project or a team the members within the group share resources such as outlook conversations and a calendar sharepoint files a onenote notebook and sharepoint team site planner plans and in tune device management within microsoft graph these groups are referred to as a unified group unlike office 365 group security groups are used to control access to resources apps can check if a user is a member of a security group to determine if they can access specific resources within the app another capability of security groups is that while they can contain users like office 365 groups security groups can also contain other security groups and this allows admins added flexibility in determining the users who can access secured resources all types of groups can have dynamic group membership rules that automatically or add or remove members from a group based on the user's properties and this prize provides additional flexibility in managing group membership and that users don't have to be manually added or removed from a group attribute-based rules derived from user properties enable administrators to specify for example all users in the marketing department should have access to the group developers can use microsoft graph to manage dynamic membership or groups on groups through group properties such as membership rule and membership rule processing state the specific permissions required will depend on the operation that you want to perform for example if you're creating editing or deleting a group one of the right permissions is required granting any of the group related operations to an app requires administrator consent developers can get a list of groups or specific groups with the microsoft graph api or one of the multiple microsoft graph sdks microsoft graph can be used to get a list of all groups within an organization and this list includes all office 365 groups and security groups to request a list of groups you're going to submit an http request to the group's endpoint the same request can be done using the microsoftgraph.net sdk using the code that you see here on the slide i'm getting an authenticated microsoft graph client first and then i'm going to request all the groups then i can enumerate through each of the groups that have been returned and i can display their id display name and the email address associated with that group the list of groups returned by group's endpoint includes a subset of all the properties available on a group if the query parameter dollar select is not specified if you want to control the specific properties that are returned in the request you include the dollar select query parameter with a comma delimited list of all the properties that you want returned and if you want to list the specific type of a group such as all the office 365 groups which is known as a unified group then you can use the filter query parameter on the group types property to get a specific group you're going to include the id of the group in the http request on the group's endpoint the same request can be done using the.net sdk for microsoft graph non-admin users can be assigned as an owner of a group that grants them permission to modify the group to get a list of all the group owners you can access the owner's property on a group as you see there on the slide to get a list of the users who have been added as members to a group you can use the members property on the group