title: Azure Active Directory - how to assign application role to group programmatically
body: <p>I am looking to create a role based authorization mvc application using Azure AD:</p>
  
  <ul>
  <li><a href="https://azure.microsoft.com/en-us/documentation/articles/web-sites-dotnet-lob-application-azure-ad/" rel="nofollow">Create a .NET MVC web app in Azure App Service with Azure Active Directory authentication</a></li>
  <li><a href="https://azure.microsoft.com/en-us/documentation/articles/role-based-access-control-configure/" rel="nofollow">Azure Role-based Access Control</a></li>
  </ul>
  
  <p>From the Azure Portal, I am able :</p>
  
  <ul>
  <li>To create user and groups.</li>
  <li>To assign user to group.</li>
  <li>To create applications roles.</li>
  <li>To create application roles (by modifying the manifest)</li>
  <li>To assign an application role to a user.</li>
  </ul>
  
  <p>I've just had a <strong>free Azure Active Directory edition</strong> and I've readed that we can use the <a href="https://www.nuget.org/packages/Microsoft.Azure.ActiveDirectory.GraphClient/" rel="nofollow">Microsoft Azure Active Directory</a> to perform these actions :</p>
  
  <ul>
  <li>To assign multiple application roles to users.</li>
  <li>To assign multiple application roles to groups.</li>
  </ul>
  
  <p>Microsoft provides <a href="https://github.com/Azure-Samples/active-directory-dotnet-graphapi-web" rel="nofollow">good samples</a> to query the AAD and I've started with it but I can't figured out how to assign an application to a group.</p>
  
  <p>Here is my pseudo code to get the group:</p>
  
  <pre><code>ActiveDirectoryClient client = AuthenticationHelper.GetActiveDirectoryClient();
  var app = (await client.Applications.GetByObjectId("applicationObjectId").ExecuteAsync());
  var servicePrincipal = await client.ServicePrincipals.GetByObjectId("servicePrincipalObjectId").ExecuteAsync();
  var appRole = app.AppRoles.First(r =&gt; r.DisplayName == "my role");
  var mygroup = (await client.Groups.ExecuteAsync()).CurrentPage.FirstOrDefault();           
  </code></pre>
  
  <p>What I would like to do is something like that :</p>
  
  <pre><code>mygroup .AppRoleAssignments.Add(new AppRoleAssignment()
  {
      ResourceId = Guid.Parse(servicePrincipal.ObjectId),
      Id = appRole.Id,
      PrincipalType = "Group",
      PrincipalId = Guid.Parse(mygroup .ObjectId),
  });
  await group.UpdateAsync();
  </code></pre>
  
  <p>But the type of the AppRoleAssignments is <code>IPagedCollection&lt;IAppRoleAssignment&gt;</code> and there is no Add method.</p>
  
  <p>Does anyone knows what I need to chage in my code ?</p>