Create-AzureDevOpsGroupRule.ps1

param (
    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [string] $PersonalAccessToken,

    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [string] $OrganizationName,

    [Parameter(Mandatory = $true)]
    [ValidateNotNullOrEmpty()]
    [string] $SecurityGroupId
)

$auth = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes(":$PersonalAccessToken"))
$body = @{
    "group"       = @{
        "origin"      = "aad"
        "originId"    = $SecurityGroupId
        "subjectKind" = "group"
    }
    "licenseRule" = @{
        "licensingSource"    = "account"
        "accountLicenseType" = "express"
        "licenseDisplayName" = "Basic"
    }
}

$invokeRestMethodSplat = @{
    Method      = "POST"
    Uri         = "https://vsaex.dev.azure.com/$OrganizationName/_apis/groupentitlements?api-version=7.1-preview.1"
    # Add the header for authentication
    Headers     = @{
        "Authorization" = "Basic $auth"
    }
    ContentType = "application/json"
    Body        = ($body | ConvertTo-Json -Depth 50)
}

Invoke-RestMethod @invokeRestMethodSplat