@pnp/cli-microsoft365 6.8.0 → 6.9.0-beta.bb31388

package/dist/chili/chili.js

@@ -38,7 +38,7 @@ function getPromptFromArgs(args) {
     showHelp = args.indexOf('--help') > -1 || args.indexOf('-h') > -1;
     if (showHelp) {
         const commandsFolder = path.join(__dirname, '..', 'm365');
-        const pathChunks = [commandsFolder, '..', '..', 'docs', 'docs', 'user-guide', 'chili.md'];
+        const pathChunks = [commandsFolder, '..', '..', 'docs', 'docs', 'user-guide', 'chili.mdx'];
         const helpFilePath = path.join(...pathChunks);
         if (fs.existsSync(helpFilePath)) {
             let helpContents = fs.readFileSync(helpFilePath, 'utf8');

package/dist/cli/Cli.js

@@ -571,14 +571,14 @@ class Cli {
         }
         const pathChunks = [this.commandsFolder, '..', '..', 'docs', 'docs', 'cmd'];
         if (commandNameWords.length === 1) {
-            pathChunks.push(`${commandNameWords[0]}.md`);
+            pathChunks.push(`${commandNameWords[0]}.mdx`);
         }
         else {
             if (commandNameWords.length === 2) {
-                pathChunks.push(commandNameWords[0], `${commandNameWords.join('-')}.md`);
+                pathChunks.push(commandNameWords[0], `${commandNameWords.join('-')}.mdx`);
             }
             else {
-                pathChunks.push(commandNameWords[0], commandNameWords[1], commandNameWords.slice(1).join('-') + '.md');
+                pathChunks.push(commandNameWords[0], commandNameWords[1], commandNameWords.slice(1).join('-') + '.mdx');
             }
         }
         helpFilePath = path.join(...pathChunks);

package/dist/utils/md.js

@@ -16,15 +16,20 @@ function convertHeadings(md) {
     });
 }
 function convertAdmonitions(md) {
-    const regex = new RegExp('^!!!\\s(.*)' + os_1.EOL + '\\s+', 'gm');
-    return md.replace(regex, (match, content) => {
-        return content.toLocaleUpperCase() + os_1.EOL + os_1.EOL;
-    });
+    const regex = new RegExp(/^:::(\w+)([\s\S]*?):::$/, 'gm');
+    return md.replace(regex, (_, label, content) => label.toLocaleUpperCase() + os_1.EOL + os_1.EOL + content.trim());
 }
 function includeContent(md, rootFolder) {
-    return md.replace(/^--8<-- "([^"]+)"/gm, (match, filePath) => {
-        return fs.readFileSync(path.join(rootFolder, filePath), 'utf8');
+    const mdxImports = [
+        { tag: "<Global />", location: "docs/cmd/_global.mdx" },
+        { tag: "<CLISettings />", location: "docs/_clisettings.mdx" }
+    ];
+    mdxImports.forEach(mdxImport => {
+        md = md.replace(mdxImport.tag, () => {
+            return fs.readFileSync(path.join(rootFolder, mdxImport.location), 'utf8');
+        }).replace(/(```\r\n)\r\n(```md defintion-list\r\n)/g, "$1$2");
     });
+    return md;
 }
 function convertDd(md) {
     return md.replace(/^:\s(.*)/gm, (match, content) => {
@@ -47,16 +52,11 @@ function convertHyperlinks(md) {
     });
 }
 function convertContentTabs(md) {
-    const regex = new RegExp('^=== "(.+?)"(?:\r\n|\n){2}((?:^    (?:.*?(?:\r\n|\n))?)+)', 'gms');
-    return md.replace(regex, (match, title, content) => {
-        return `  ${title}${os_1.EOL}${os_1.EOL}${content.replace(/^    /gms, '')}`;
-    });
-}
-function convertMdOutput(md) {
-    const regex = new RegExp('(?<=^    ```md)(.*)(?=    ```)', 'gms');
-    return md.replace(regex, (match, content) => {
-        return content.replace(/^    /gms, '');
-    });
+    return md
+        .replace(/<TabItem value="([^"]+)">/gm, '$1')
+        .replace(/.*<\/?(Tabs|TabItem)>.*\n?/g, '')
+        .replace(/```(?:\w+)?\s*([\s\S]*?)\s*```/g, '$1')
+        .trim();
 }
 function convertCodeFences(md) {
     const regex = new RegExp('^```.*?(?:\r\n|\n)(.*?)```(?:\r\n|\n)', 'gms');
@@ -72,6 +72,12 @@ function removeTooManyEmptyLines(md) {
     const regex = new RegExp('(' + os_1.EOL + '){4,}', 'g');
     return md.replace(regex, Array(4).join(os_1.EOL));
 }
+function removeFrontmatter(md) {
+    return md.replace(/^---[\s\S]*?---/gm, '').trim();
+}
+function removeImports(md) {
+    return md.replace(/^import .+;$/gms, '').trim();
+}
 function escapeMd(mdString) {
     if (!mdString) {
         return mdString;
@@ -86,11 +92,12 @@ const convertFunctions = [
     convertAdmonitions,
     convertDd,
     convertHyperlinks,
-    convertMdOutput,
-    convertContentTabs,
     convertCodeFences,
+    convertContentTabs,
     removeInlineMarkup,
-    removeTooManyEmptyLines
+    removeTooManyEmptyLines,
+    removeFrontmatter,
+    removeImports
 ];
 exports.md = {
     md2plain(md, rootFolderDocs) {

package/docs/docs/cmd/_global.mdx

@@ -0,0 +1,16 @@
+```md defintion-list
+`-h, --help [help]`
+: Output usage information. Optionally, specify which section of command's help you want to see. Allowed values are `options`, `examples`, `remarks`, `response`, `full`. Default is `full`.
+
+`--query [query]`
+: JMESPath query string. See [http://jmespath.org/](http://jmespath.org/) for more information and examples.
+
+`-o, --output [output]`
+: Output type. `json`, `text`, `csv`, `md`. Default `json`.
+
+`--verbose`
+: Runs command with verbose logging.
+
+`--debug`
+: Runs command with debug logging.
+```

package/docs/docs/cmd/aad/app/app-add.mdx

@@ -0,0 +1,184 @@
+import Global from '/docs/cmd/_global.mdx';
+
+# aad app add
+
+Creates new Azure AD app registration
+
+## Usage
+
+```sh
+m365 aad app add [options]
+```
+
+## Options
+
+```md defintion-list
+`-n, --name [name]`
+: Name of the app. Specify either `name` or `manifest` but not both.
+
+`--multitenant`
+: Specify, to make the app available to other tenants.
+
+`-r, --redirectUris [redirectUris]`
+: Comma-separated list of redirect URIs. Requires `platform` to be specified.
+
+`-p, --platform [platform]`
+: Platform for which the `redirectUris` should be configured. Allowed values `spa`, `web`, `publicClient`.
+
+`--implicitFlow`
+: Specify, to indicate that the authorization endpoint should return ID and access tokens.
+
+`-s, --withSecret`
+: When specified, will create a secret named `Default` and set it to expire 1 year in the future.
+
+`--apisDelegated [apisDelegated]`
+: Comma-separated list of delegated permissions to register with the app.
+
+`--apisApplication [apisApplication]`
+: Comma-separated list of application permissions to register with the app.
+
+`-u, --uri [uri]`
+: Application ID URI.
+
+`--scopeName [scopeName]`
+: Name of the scope to add. Requires `uri` to be specified.
+
+`--scopeConsentBy [scopeConsentBy]`
+: Specifies if the scope can be consented only by admins or by admins and users. Allowed values `admins`, `adminsAndUsers`. Default `admins`.
+
+`--scopeAdminConsentDisplayName [scopeAdminConsentDisplayName]`
+: Scope admin consent display name.
+
+`--scopeAdminConsentDescription [scopeAdminConsentDescription]`
+: Scope admin consent description.
+
+`--certificateFile [certificateFile]`
+: Path to the file with certificate public key. Specify either `certificateFile` or `certificateBase64Encoded`.
+
+`--certificateBase64Encoded [certificateBase64Encoded]`
+: Base64-encoded string with certificate public key. Specify either `certificateFile` or `certificateBase64Encoded`.
+
+`--certificateDisplayName [certificateDisplayName]`
+: Display name for the certificate. If not given, the displayName will be set to the certificate subject. When specified, also specify either `certificateFile` or `certificateBase64Encoded`.
+
+`--grantAdminConsent`
+: When specified, grants application & delegated permissions through admin consent.
+
+`--manifest [manifest]`
+: Azure AD app manifest as retrieved from the Azure Portal to create the app registration from. Specify either `name` or `manifest` but not both.
+
+`--save`
+: Use to store the information about the created app in a local file.
+```
+
+<Global />
+
+## Remarks
+
+You can use this command to create a new Azure AD app registration either by specifying the different configuration settings through the corresponding options or by using the manifest.
+
+If you don't use the manifest, you must specify the name of the Azure AD app registration using the `name` option. If you use the manifest, you can skip the `name` option assuming the manifest contains the `displayName` property.
+
+You can also use the manifest to provision some of the configuration settings of your Azure AD app. All properties specified in the manifest are optional and will set if specified.
+
+If you specify the manifest along with some options, values specified in the options will override settings from the manifest. One exception is the name specified in the `name` option which will be overridden by the `displayName` property from the manifest if specified.
+
+The following properties specified in the manifest retrieved from Azure AD are not supported by this command:
+
+- accessTokenAcceptedVersion
+- disabledByMicrosoftStatus
+- errorUrl
+- oauth2RequirePostResponse
+- oauth2AllowUrlPathMatching
+- orgRestrictions
+- samlMetadataUrl
+
+When specifying the value for the `uri`, you can use the `_appId_` token, to include the ID of the newly generated Azure AD app registration in the Application ID URI, eg. URI `api://caf406b91cd4.ngrok.io/_appId_` will become `api://caf406b91cd4.ngrok.io/ab3bd119-faf7-4db5-ba99-eb7e748f778a` where the last portion is the app ID of the created Azure AD app registration.
+
+When using the `withSecret` option, this command will automatically generate a secret named `Default` and set it to expire 1 year in the future.
+
+After creating the Azure AD app registration, this command returns the app ID and object ID of the created app registration. If you used the `withSecret` option, it will also return the generated secret.
+
+If you want to store the information about the created Azure AD app registration, use the `--save` option. This is useful when you build solutions connected to Microsoft 365 and want to easily manage app registrations used with your solution. When you use the `--save` option, after you create the app registration, the command will write its ID and name to the `.m365rc.json` file in the current directory. If the file already exists, it will add the information about the to it, allowing you to track multiple apps. If the file doesn't exist, the command will create it.
+
+When specifying `--grantAdminConsent` option, a service principal will be created for the app registration.
+
+## Examples
+
+Create new Azure AD app registration with the specified name
+
+```sh
+m365 aad app add --name 'My AAD app'
+```
+
+Create new Azure AD app registration from the manifest retrieved from the Azure Portal stored in a local file named _manifest.json_
+
+```sh
+m365 aad app add --manifest @manifest.json
+```
+
+Create new multitenant Azure AD app registration
+
+```sh
+m365 aad app add --name 'My AAD app' --multitenant
+```
+
+Create new Azure AD app registration for a web app with the specified redirect URIs
+
+```sh
+m365 aad app add --name 'My AAD app' --redirectUris 'https://myapp.azurewebsites.net,http://localhost:4000' --platform web
+```
+
+Create new Azure AD app registration for a desktop app
+
+```sh
+m365 aad app add --name 'My AAD app' --redirectUris 'https://login.microsoftonline.com/common/oauth2/nativeclient' --platform publicClient
+```
+
+Create new Azure AD app registration with an auto-generated secret (secret returned in the command output)
+
+```sh
+m365 aad app add --name 'My AAD app' --withSecret
+```
+
+Create new Azure AD app registration for a daemon app with specified Microsoft Graph application permissions
+
+```sh
+m365 aad app add --name 'My AAD app' --withSecret --apisApplication 'https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Directory.Read.All'
+```
+
+Create new Azure AD app registration for a single-page app with specified Microsoft Graph delegated permissions
+
+```sh
+m365 aad app add --name 'My AAD app' --platform spa --redirectUris 'https://myspa.azurewebsites.net,http://localhost:8080' --apisDelegated 'https://graph.microsoft.com/Calendars.Read,https://graph.microsoft.com/Directory.Read.All' --implicitFlow
+```
+
+Create new Azure AD app registration with Application ID URI set to a fixed value
+
+```sh
+m365 aad app add --name 'My AAD app' --uri https://contoso.onmicrosoft.com/myapp
+```
+
+Create new Azure AD app registration with Application ID URI set to a value that contains the ID of the app registration, designated with the `_appId_` token and a custom API scope that can be consented by both admins and users
+
+```sh
+m365 aad app add --name 'My AAD app' --uri api://caf406b91cd4.ngrok.io/_appId_ --scopeName access_as_user --scopeAdminConsentDescription 'Access as a user' --scopeAdminConsentDisplayName 'Access as a user' --scopeConsentBy adminsAndUsers
+```
+
+Create new Azure AD app registration for a daemon app with specified Microsoft Graph application permissions, including admin consent
+
+```sh
+ m365 aad app add --name 'My AAD app' --apisApplication 'https://graph.microsoft.com/Group.ReadWrite.All' --grantAdminConsent
+```
+
+Create new Azure AD app registration with the specified name. Store information about the created app registration in the _.m365rc.json_ file in the current directory.
+
+```sh
+m365 aad app add --name 'My AAD app' --save
+```
+
+Create new Azure AD app registration with a certificate
+
+```sh
+m365 aad app add --name 'My AAD app' --certificateDisplayName "Some certificate name" --certificateFile "c:\temp\some-certificate.cer"
+```

package/docs/docs/cmd/aad/app/app-get.mdx

@@ -0,0 +1,63 @@
+import Global from '/docs/cmd/_global.mdx';
+
+# aad app get
+
+Gets an Azure AD app registration
+
+## Usage
+
+```sh
+m365 aad app get [options]
+```
+
+## Options
+
+```md defintion-list
+`--appId [appId]`
+: Application (client) ID of the Azure AD application registration to get. Specify either `appId`, `objectId` or `name`
+
+`--objectId [objectId]`
+: Object ID of the Azure AD application registration to get. Specify either `appId`, `objectId` or `name`
+
+`--name [name]`
+: Name of the Azure AD application registration to get. Specify either `appId`, `objectId` or `name`
+
+`--save`
+: Use to store the information about the created app in a local file
+```
+
+<Global />
+
+## Remarks
+
+For best performance use the `objectId` option to reference the Azure AD application registration to get. If you use `appId` or `name`, this command will first need to find the corresponding object ID for that application.
+
+If the command finds multiple Azure AD application registrations with the specified app name, it will prompt you to disambiguate which app it should use, listing the discovered object IDs.
+
+If you want to store the information about the Azure AD app registration, use the `--save` option. This is useful when you build solutions connected to Microsoft 365 and want to easily manage app registrations used with your solution. When you use the `--save` option, after you get the app registration, the command will write its ID and name to the `.m365rc.json` file in the current directory. If the file already exists, it will add the information about the App registration to it if it's not already present, allowing you to track multiple apps. If the file doesn't exist, the command will create it.
+
+## Examples
+
+Get the Azure AD application registration by its app (client) ID
+
+```sh
+m365 aad app get --appId d75be2e1-0204-4f95-857d-51a37cf40be8
+```
+
+Get the Azure AD application registration by its object ID
+
+```sh
+m365 aad app get --objectId d75be2e1-0204-4f95-857d-51a37cf40be8
+```
+
+Get the Azure AD application registration by its name
+
+```sh
+m365 aad app get --name "My app"
+```
+
+Get the Azure AD application registration by its name. Store information about the retrieved app registration in the _.m365rc.json_ file in the current directory.
+
+```sh
+m365 aad app get --name "My app" --save
+```

package/docs/docs/cmd/aad/app/app-list.mdx

@@ -0,0 +1,163 @@
+import Global from '/docs/cmd/_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# aad app list
+
+Retrieves a list of Azure AD app registrations
+
+## Usage
+
+```sh
+m365 aad app list [options]
+```
+
+## Options
+
+<Global />
+
+## Examples
+
+Retrieve a list of Azure AD app registrations
+
+```sh
+m365 aad app list
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+      "id": "ff2798f7-1c7a-4607-8a7b-3d5e0c18c756",
+      "deletedDateTime": null,
+      "appId": "61ed4fab-a861-4307-bb87-a6a53dbe39f5",
+      "applicationTemplateId": null,
+      "disabledByMicrosoftStatus": null,
+      "createdDateTime": "2021-03-16T14:51:28Z",
+      "displayName": "TestAppPermissions",
+      "description": null,
+      "groupMembershipClaims": null,
+      "identifierUris": [],
+      "isDeviceOnlyAuthSupported": null,
+      "isFallbackPublicClient": null,
+      "notes": null,
+      "publisherDomain": "Contoso.onmicrosoft.com",
+      "serviceManagementReference": null,
+      "signInAudience": "AzureADMyOrg",
+      "tags": [],
+      "tokenEncryptionKeyId": null,
+      "samlMetadataUrl": null,
+      "defaultRedirectUri": null,
+      "certification": null,
+      "optionalClaims": null,
+      "addIns": [],
+      "api": {
+        "acceptMappedClaims": null,
+        "knownClientApplications": [],
+        "requestedAccessTokenVersion": null,
+        "oauth2PermissionScopes": [],
+        "preAuthorizedApplications": []
+      },
+      "appRoles": [],
+      "info": {
+        "logoUrl": null,
+        "marketingUrl": null,
+        "privacyStatementUrl": null,
+        "supportUrl": null,
+        "termsOfServiceUrl": null
+      },
+      "keyCredentials": [
+        {
+          "customKeyIdentifier": "7D20AB8DD09B653E9A3880F9046314B76917EF62",
+          "displayName": "CN=TestCertificate",
+          "endDateTime": "2022-01-01T00:00:00Z",
+          "key": null,
+          "keyId": "8928a06f-fa2d-4d92-98c3-b0f544804f64",
+          "startDateTime": "2020-01-01T00:00:00Z",
+          "type": "AsymmetricX509Cert",
+          "usage": "Verify"
+        }
+      ],
+      "parentalControlSettings": {
+        "countriesBlockedForMinors": [],
+        "legalAgeGroupRule": "Allow"
+      },
+      "passwordCredentials": [
+        {
+          "customKeyIdentifier": null,
+          "displayName": "TestSecret",
+          "endDateTime": "2022-03-16T14:58:45.602Z",
+          "hint": "~03",
+          "keyId": "714c9628-4bb8-4f08-84b4-7fd8d7a7b8c5",
+          "secretText": null,
+          "startDateTime": "2021-03-16T14:59:07.642Z"
+        }
+      ],
+      "publicClient": {
+        "redirectUris": []
+      },
+      "requiredResourceAccess": [
+        {
+          "resourceAppId": "00000003-0000-0000-c000-000000000000",
+          "resourceAccess": [
+            {
+              "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
+              "type": "Scope"
+            },
+            {
+              "id": "18228521-a591-40f1-b215-5fad4488c117",
+              "type": "Role"
+            },
+            {
+              "id": "09850681-111b-4a89-9bed-3f2cae46d706",
+              "type": "Role"
+            }
+          ]
+        }
+      ],
+      "verifiedPublisher": {
+        "displayName": null,
+        "verifiedPublisherId": null,
+        "addedDateTime": null
+      },
+      "web": {
+        "homePageUrl": null,
+        "logoutUrl": null,
+        "redirectUris": [],
+        "implicitGrantSettings": {
+          "enableAccessTokenIssuance": false,
+          "enableIdTokenIssuance": false
+        },
+        "redirectUriSettings": []
+      },
+      "spa": {
+        "redirectUris": []
+      }
+    }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  appId                                 id                                    displayName                                                              signInAudience
+  ------------------------------------  ------------------------------------  -----------------------------------------------------------------------  ----------------------------------
+  61ed4fab-a861-4307-bb87-a6a53dbe39f5  ff2798f7-1c7a-4607-8a7b-3d5e0c18c756  TestAppPermissions                                                       AzureADMyOrg
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  appId,id,displayName,signInAudience
+  61ed4fab-a861-4307-bb87-a6a53dbe39f5,ff2798f7-1c7a-4607-8a7b-3d5e0c18c756,TestAppPermissions,AzureADMyOrg
+  ```
+
+  </TabItem>
+</Tabs>
+

package/docs/docs/cmd/aad/app/app-remove.mdx

@@ -0,0 +1,59 @@
+import Global from '/docs/cmd/_global.mdx';
+
+# aad app remove
+
+Removes an Azure AD app registration
+
+## Usage
+
+```sh
+m365 aad app remove [options]
+```
+
+## Options
+
+```md defintion-list
+`--appId [appId]`
+: Application (client) ID of the Azure AD application registration to remove. Specify either `appId`, `objectId` or `name` but not multiple.
+
+`--objectId [objectId]`
+: Object ID of the Azure AD application registration to remove. Specify either `appId`, `objectId` or `name` but not multiple.
+
+`--name [name]`
+: Name of the Azure AD application registration to remove. Specify either `appId`, `objectId` or `name` but not multiple.
+
+`--confirm`
+: Don't prompt for confirmation to remove the app.
+```
+
+<Global />
+
+## Remarks
+
+For best performance use the `objectId` option to reference the Azure AD application registration to remove. If you use `appId` or `name`, this command will first need to find the corresponding object ID for that application.
+
+If the command finds multiple Azure AD application registrations with the specified app name, it will prompt you to disambiguate which app it should use, listing the discovered object IDs.
+
+## Examples
+
+Remove the Azure AD application registration by its app (client) ID.
+
+```sh
+m365 aad app remove --appId d75be2e1-0204-4f95-857d-51a37cf40be8
+```
+
+Remove the Azure AD application registration by its object ID.
+
+```sh
+m365 aad app remove --objectId d75be2e1-0204-4f95-857d-51a37cf40be8
+```
+
+Remove the Azure AD application registration by its name. Will NOT prompt for confirmation before deleting.
+
+```sh
+m365 aad app remove --name "My app" --confirm
+```
+
+## Response
+
+The command won't return a response on success.

package/docs/docs/cmd/aad/app/app-role-add.mdx

@@ -0,0 +1,64 @@
+import Global from '/docs/cmd/_global.mdx';
+
+# aad app role add
+
+Adds role to the specified Azure AD app registration
+
+## Usage
+
+```sh
+m365 aad app role add [options]
+```
+
+## Options
+
+```md defintion-list
+`--appId [appId]`
+: Application (client) ID of the Azure AD application registration to which to add the role. Specify either `appId`, `appObjectId` or `appName`
+
+`--appObjectId [appObjectId]`
+: Object ID of the Azure AD application registration to which to add the role. Specify either `appId`, `appObjectId` or `appName`
+
+`--appName [appName]`
+: Name of the Azure AD application registration to which to add the role. Specify either `appId`, `appObjectId` or `appName`
+
+`-n, --name <name>`
+: Name of the role to add
+
+`-d, --description <description>`
+: Description of the role to add
+
+`-m, --allowedMembers <allowedMembers>`
+: Types of members that can be added to the group. Allowed values: `usersGroups`, `applications`, `both`
+
+`-c, --claim <claim>`
+: Claim value
+```
+
+<Global />
+
+## Remarks
+
+For best performance use the `appObjectId` option to reference the Azure AD application registration for which to add the role. If you use `appId` or `appName`, this command will first need to find the corresponding object ID for that application.
+
+If the command finds multiple Azure AD application registrations with the specified app name, it will prompt you to disambiguate which app it should use, listing the discovered object IDs.
+
+## Examples
+
+Add role to the Azure AD application registration specified by its object ID
+
+```sh
+m365 aad app role add --appObjectId d75be2e1-0204-4f95-857d-51a37cf40be8 --name Managers --description "Managers" --allowedMembers usersGroups --claim managers
+```
+
+Add role to the Azure AD application registration specified by its app (client) ID
+
+```sh
+m365 aad app role add --appId e75be2e1-0204-4f95-857d-51a37cf40be8 --name Managers --description "Managers" --allowedMembers usersGroups --claim managers
+```
+
+Add role to the Azure AD application registration specified by its name
+
+```sh
+m365 aad app role add --appName "My app" --name Managers --description "Managers" --allowedMembers usersGroups --claim managers
+```