az ad group member list does not list service principals

Related command
az ad group member list

Describe the bug
az ad group member list does not list service principals.

To Reproduce
Run az ad group member list --group <group_name> on a group with members of type Service Principal.

Expected behavior
Returns all members of the group, including Service Principals.

Additional context

{
  "azure-cli": "2.37.0",
  "azure-cli-core": "2.37.0",
  "azure-cli-telemetry": "1.0.6",
  "extensions": {
    "account": "0.2.1",
    "aks-preview": "0.5.10",
    "application-insights": "0.1.13",
    "datafactory": "0.5.0"
  }
}

Jiashuo Li (@jiasli)

Jiashuo Li (@jiasli) for awareness

Please also see #16123 (comment)

According to List members API's documentation:

https://docs.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0&tabs=http

Currently service principals are not listed as group members due to staged roll-out of service principals on Graph V1.0 endpoint.

This is a feature gap between AD Graph and Microsoft Graph.

As a workaround, you may use az rest to call beta API: https://docs.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-beta&tabs=http

bump

We've discovered that if we log into azure cloud shell (azure-cli v2.48.1) as the service principal behind our Azure DevOps service connection, we can't use az cli to add, list, or check group members of a security group, even though our service principal owns the group. (Yields Insufficient privileges to complete the operation.)

We've also discovered that if we add a managed identity to said group manually, the managed identity isn't listed as a group member by az ad group list --group '...' (no matter who you run as)

#!/bin/bash
# running as the service principal behind an ADO service connection
principal="xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # where $principal is a system managed identity from a linux web app
group="yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" # where $group is an AAD security group with nobody in it owned by a service principal

echo "##[command]az ad group member check --group \"$group\" --member-id \"$principal\""
is_member=$(az ad group member check --group "$group" --member-id "$principal" | jq -r '.value')
if [ "$is_member" = "false" ]; then
    echo "##[command]az ad group member add --group \"$group\" --member-id \"$principal\""
    az ad group member add --group "$group" --member-id "$principal"
else
    echo "##[warning]principal \"$principal\" is already a member of group \"$group\""
fi

echo "##[command]az ad group member list --group \"$group\""
az ad group member list --group "$group"

The bug is still present, four years after being explained to Microsoft.

Please correct the error. Yes, this defect actually matters for customers who use something called "computers".

do you ever wonder what the environmental impact is of

bot notes stale issue
bot emails everyone
someone turns up to poke the issue

I do. I bet it's non-negligible.

Not a fraction of the cost of

Non microsoft people detect the bug, and document the bug
Microsoft ignores the bug
More customers notice the bug and document the bug, surprised that it really is not corrected yet
Real human people beg Microsoft to fix their bug or explain a workaround or add a new API, or add a command line program with just one purpose, to work around the microsoft bug. Or at least update the documentation to explain that the api is broken, but they can't afford to hire a programmer to implement it.

Hi, I still have the issue with the lastest az cli.

Jiashuo Li (@jiasli)

As a workaround, you may use az rest to call beta API: https://docs.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-beta&tabs=http

Well, 4 years (minus 1 week) later, is there a chance we see the beta endpoint go GA anytime soon Jiashuo Li (@jiasli) ?

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

Well, we haven't heard back from Microsoft in years on this issue...

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

Navigation Menu

Repository navigation

`az ad group member list` does not list service principals #22664

30 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

az ad group member list does not list service principals #22664

Description

Activity

yonzhan commented on May 30, 2022

jiasli commented on May 30, 2022

ncook-hxgn commented on Jun 29, 2023

30 remaining items

uffehellum-boeing commented on Apr 15, 2026

uffehellum-boeing commented on Apr 15, 2026

pierrejeandev commented on May 22, 2026

FlorentATo commented on May 22, 2026

microsoft-github-policy-service commented on Sep 24, 2026

FlorentATo commented on Sep 26, 2026

microsoft-github-policy-service commented on Oct 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`az ad group member list` does not list service principals #22664