用这种方法解决这个问题：
1.像以前一样获取所有组
1.获取分配给应用程序graph.microsoft.com/beta/servicePrincipals/${applicationId}/appRoleAssignments的组和用户
回复：

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#appRoleAssignments",
    "value": [
        {
            "id": "tV-E7eUeFkmIemkoWcUgTkrT54btaddPtiLX96wVx0g",
            "creationTimestamp": "2018-07-06T10:43:32.548348Z",
            "principalDisplayName": "Pasha Kostohrys",
            "principalId": "${userID}",
            "principalType": "User",
            "resourceDisplayName": "azure-group-sync",
            "resourceId": "${applicationId}"
        },
        {
            "id": "ZRCxfjNVlUqrjp9Y3wuLJz6beU58dtNOvr41VsKwADo",
            "creationTimestamp": null,
            "principalDisplayName": "ops",
            "principalId": "${groupID}",
            "principalType": "Group",
            "resourceDisplayName": "azure-group-sync",
            "resourceId": "${applicationId}"
        }
    ] }

字符串
1.仅筛选不在工作分配列表中的组

获取分配给应用程序的组（服务主体）
Microsoft Graph API：

https://graph.microsoft.com/v1.0/servicePrincipals/<servicePrincipal_id/appRoleAssignedTo

字符串
Microsoft Graph powershell：

Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $servicePrincipalId

型