az rest --method PATCH on Applications doesn't seem to patch at all

Describe the bug

When trying to add a new redirect uri to an AAD application (registration) with az rest --method PATCH it overwrites the entire section instead of patching/appending. Possibly because it is an array? Just speculation here.

To Reproduce

Here are the steps to reproduce as commands in a pwsh 7.2.x shell window - I get the existing redirect uris just to see whats the state before, patch a new one in and get it again to see if it updated it.

>> az rest --method GET --uri 'https://graph.microsoft.com/v1.0/applications/MYAPPOID' -o json --query web.redirectUris
[
  "https://testapp2313213"
]

>> az rest --method PATCH --uri 'https://graph.microsoft.com/v1.0/applications/MYAPPOID' --body "{'web':{'redirectUris':['https://$(New-Guid)']}}" --headers Content-Type=application/json

>> az rest --method GET --uri 'https://graph.microsoft.com/v1.0/applications/MYAPPOID' -o json --query web.redirectUris
[
  "https://2ea6eeb1-2dfe-474e-adb9-31897bd865b0"
]

Expected behavior

I’d expect a new redirect uri to be added to the list when PATCH is used, not for the whole list to be overwritten by my value.

Environment summary

Installed via MSI. Windows 11 21H2 22000.194. Powershell 7.2.1.

azure-cli                         2.31.0

core                              2.31.0
telemetry                          1.0.6

Extensions:
azure-devops                      0.22.0

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\ransagy\.azure\cliextensions'

Python (Windows) 3.8.9 (tags/v3.8.9:a743f81, Apr  6 2021, 13:22:56) [MSC v.1928 32 bit (Intel)]

Additional context

I was trying to find a non-disruptive way that would work in parallel scripts that would do the same to add a redirect uri without hurting the current values. Azure Powershell doesn’t seem to have a “PATCH”-esque method and the az ad cli parts seem to be deprecated as per the whole AAD-graph > MSGraph push. Honestly any way to achieve this would be a good start.

[ransagy]

The problem with that, as with the Azure Powershell equiv command, is that two scripts running at the same time will probably overwrite each other. I misinterpreted the meaning of PATCH here, as you mentioned, to something that would solve that - if two scripts ran together they’d each add, rather than overwrite, the list. As said, that’s not the case, and as you rightly said as well - This is an issue to open against the Graph API probably, more than the CLI/Az Module. Thanks for the examples!

[jiasli]

@ransagy, this is the behavior of Microsoft Graph Update application API and we, as a client, have no control over it. PATCH means overwrite, not attach.

Instead, you may fetch the web.redirectUris first, manipulate with jq or other application and patch it back.

For example, you can just use the C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe bundled with Azure CLI:

> $object_id = 'f10187ba-fe09-4bfa-a33f-f4ec1bfa7cd4'

> az rest --method GET --uri "https://graph.microsoft.com/v1.0/applications/$object_id" -o json --query web.redirectUris
[
  "https://jlapp.com"
]

> az rest --method GET --uri "https://graph.microsoft.com/v1.0/applications/$object_id" -o json --query web.redirectUris `
| & "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -c "
import sys
import json

uris = json.load(sys.stdin) + ['https://2ea6eeb1-2dfe-474e-adb9-31897bd865b0']
body = {'web': {'redirectUris': uris}}
json.dump(body, sys.stdout)
" `
| az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/$object_id" --body "@-"

> az rest --method GET --uri "https://graph.microsoft.com/v1.0/applications/$object_id" -o json --query web.redirectUris
[
  "https://2ea6eeb1-2dfe-474e-adb9-31897bd865b0",
  "https://jlapp.com"
]

Note: I choose stdin and stdout pipe (@-) to pass the body instead of arguments to avoid all the shell interpretation complexity.

Also, I would like to give a kind reminder that using single quotes ' in JSON is only a trick of Azure CLI:

"{'web':{'redirectUris':['https://$(New-Guid)']}}"

https://github.com/Azure/azure-cli/blob/103c4e9636657fa307436c36ade1314831d05d62/src/azure-cli-core/azure/cli/core/util.py#L543-L544

For best compatibility, keep using double quotes " in JSON strings.