无法更新本地控制的目录同步对象或当前正在进行迁移的对象的指定属性

将成员添加到 Azure AD 中的组时出现问题，收到以下错误消息：

无法更新本地掌握的指定属性 目录同步对象或当前正在进行迁移的对象

我正在尝试将 azure AD 的现有成员添加到现有组，但我收到的响应为“错误请求”。对于某些调用 updateasync 工作正常，但成员未添加到组中。我已经提供了我正在尝试解决以下错误的代码。请建议是否有人遇到过同样的问题并解决了它。谢谢。

Code:-

 IUser newUser = await GetUser(userKey);
                Microsoft.Azure.ActiveDirectory.GraphClient.Group retrievedGroup = new Microsoft.Azure.ActiveDirectory.GraphClient.Group();
                List<IGroup> foundGroups = null;
                foundGroups = adClient.Groups
                         .Where(group => group.DisplayName.StartsWith(groupName))
                         .ExecuteAsync().Result.CurrentPage.ToList();
                if (foundGroups != null && foundGroups.Count > 0)
                {
                    retrievedGroup = foundGroups.First() as Microsoft.Azure.ActiveDirectory.GraphClient.Group;
                }
                if (retrievedGroup.ObjectId != null)
                {
                    retrievedGroup.Members.Add(newUser as DirectoryObject);
                    await retrievedGroup.UpdateAsync();
                }

Error:-

{"odata.error":{"code":"Request_BadRequest","message":{"lang":"en","value":"Unable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migration."},"date":"2016-10-18T08:02:22","requestId":"c757689c-6135-4198-9e4d-6a7aaa1135e7","values":null}}

根据描述和错误消息，您正在使用 Azure Graph 客户端将成员添加到在本地创建的组中。这是预期的，它无法更新从本地同步到 Azure AD 的这些对象。

要为此类组添加成员，我们需要在本地环境中对其进行操作，然后将其同步到Azure。

Update

使用 Azure AD Graph 客户端创建组并添加成员：

var client = GraphHelper.CreateGraphClient();

var group = new Microsoft.Azure.ActiveDirectory.GraphClient.Group();
group.DisplayName = "newGroup";
group.MailNickname = "newGroup";
group.MailEnabled = false;
group.SecurityEnabled = true;
await client.Groups.AddGroupAsync(group);

var newGroup = client.Groups.ExecuteAsync().Result.CurrentPage.First(a => a.DisplayName == "newGroup") as Microsoft.Azure.ActiveDirectory.GraphClient.Group;

var user = client.Users.ExecuteAsync().Result.CurrentPage.First(u => u.DisplayName == "user2") as Microsoft.Azure.ActiveDirectory.GraphClient.DirectoryObject;

group.Members.Add(user);
await group.UpdateAsync();


public static ActiveDirectoryClient CreateGraphClient()
{
        string accessToken = "";
        string tenantId = "xxx.onmicrosoft.com"; 
        string graphResourceId = "https://graph.windows.net";

        Uri servicePointUri = new Uri(graphResourceId);
        Uri serviceRoot = new Uri(servicePointUri, tenantId);

        ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await Task.FromResult(accessToken));

        return activeDirectoryClient;
}