Azure-cli: az ad group show - prefix match means that group is not displayed if more than one group is matched

[rtcn2]

if I have 2 groups:
az ad group list --display-name "test-group" -o json
[
{
"...",
"displayName": "test-group",
"..",
"objectId": "03596561-4ccf-a017-fad9-3dfae434d7fe",
"objectType": "Group",
"...."
},
{
"...",
"displayName": "test-group-ro",
"...",
"objectId": "7bc4868c-4889-adc6-eb8a-38a246b65606",
"objectType": "Group",
"..."
}
]
If I try to show the group:
az ad group show -g test-group -o json
you get the error:
More than one groups match the name of 'test-group'

I thought the prefix was only used if unique:

'--group -g
Group's object id or display name(prefix also works if there is a unique match).'

I seem to need to do some extra processing of the list output to extra the group details if it happens to be a prefix on another group name, Is this behaviour correct?

az --version
azure-cli (2.0.54)

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 34960494-f5eb-4144-b508-0573f7382e40
• Version Independent ID: 0c7138d1-9849-0b71-8e76-22d0116ff663
• Content: az ad group
• Content Source: src/command_modules/azure-cli-role/azure/cli/command_modules/role/_help.py
• Service: active-directory
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[lwillek]

My goal was to find the objectId of a given group, i.e az ad group show --group "test-group" --query objectId -o tsv should return the oid 03596561-4ccf-a017-fad9-3dfae434d7fe and az ad group show --group "test-group-ro" --query objectId -o tsv should return the other oid 7bc4868c-4889-adc6-eb8a-38a246b65606

Well, I ran into the same problem: More than one groups match the name of 'test-group'.
I was confused, because this behave was not expected by me too.

Is this behaviour correct?

dunno.
I ended up using az ad group list and jq as json filter. For your given example, this would be something like:

az ad group list --display-name "test-group" -o json \
   | jq -r '.[]|select(.displayName == "test-group")|.objectId'`

and

az ad group list --display-name "test-group-ro" -o json \
   | jq -r '.[]|select(.displayName == "test-group-ro")|.objectId'`

Maybe this approach help's you too.

However, having a --group_regex parameter for az ad group show would be very useful. And maybe the current behave of the --group parameter should be explained in more detail.

[yugangw-msft]

For consistency, show command is supposed to output one item instead of a list. I can update CLI to update the error with all the matches, so you can at least select the objectId and use the show command for more information.
For general searching using display name, az ad group list is a better command to use.
Let me know if you have any comments.

[rtcn2]

I would have expected when you use the show command that you already know the specific group you want to obtain the details of, so it should return the entry for 'test-group' in the above example. So it should be an exact string match, not a string starts with.

[lukasmrtvy]

I have to do:

az ad group show -g $(az ad group list --display-name "MyGroup" --query "[?securityEnabled ].objectId" -o tsv)

Seems that We have two groups with same name (Distribution and Security Group type), one synced from AD and second one created in AAD ? :/

I am not sure what prefix means.

Arguments
    --group -g [Required] : Group's object id or display name(prefix also works if there is a unique
                            match).

[yonzhan]

add to S164.

[alexisP]

@lwillek You can also get the element without jq. Here is how I did it:
az ad group list --filter "displayName eq 'test-group'" --out tsv

It is not clean because you remain on the usage of list instead of show... but it works.

I agree that the result is of the show command is weird. Using the show command with the exact group should return the result.

[arrownj]

Hi @rtcn2 , this should be fixed in our new release. You can upgrade to the latest version to solve this. I will close this issue first, you can create a new one if you have other problems. Thanks