fix: use correct scope for group member resolution.

[gavinbarron]

Closes #2689

PR Type

• Bugfix

Description of the changes

PR checklist

• Project builds (yarn build) and changes have been tested in at least two supported browsers (Edge + non-Chromium based browser)
• All public APIs (classes, methods, etc) have been documented following the jsdoc syntax
• Stories have been added and existing stories have been tested
• Added appropriate documentation. Docs PR:

• License header has been added to all new source files (yarn setLicense)
• Contains NO breaking changes

Other information

[microsoft-github-policy-service]

Thank you for creating a Pull Request @gavinbarron.

This is a checklist for the PR reviewer(s) to complete before approving and merging this PR:

• I have verified a documentation PR has been linked and is approved (or not applicable)
• I have ran this PR locally and have tested the fix/feature
• I have verified that stories have been added to storybook (or not applicable)
• I have tested existing stories in storybook to verify no regression has occured
• I have tested the solution in at least two browsers (Edge + 1 non-Chromium based browser)

[sebastienlevert]

This might introduce a breaking change for existing applications. Either users would receive a new prompt to consent if gradual consent is available, but if not, this will just make the component fail. I'm wondering if we're using the right approach here... Do we need to "hide" this under a setting that we could get rid of in our future major version?

[gavinbarron]

The currently used scope is incorrect and cannot be used to load group data.
If people are using the code as-is then it is only working by virtue of the application having already requested a working scope for the request. At a guess I'd say that folk who have this working likely have the Group.Read.All scope as that is what is required in the people-picker control.

Do we want to use Group.Read.All by default here and use a config opt-in to use GroupMember.Read.All instead?

This would be an option we remove with the ongoing permissions changes, or at v4.

[sebastienlevert]

In that case... I feel this could be just a fix then, you are right!