在PowerShell上使用Azure Active Directory进行身份验证

Question

我正在尝试探索Azure Active Directory V2 PowerShell Module

的功能

我有一个Azure帐户，我已经设置了一个包含多个用户的Active Directory。

我的第一个目标很简单：向我显示用户列表。

所以我输入：

Connect-AzureAD

我看到一个对话框并输入我的用户帐户和密码。它返回Microsoft.Open.Azure.AD.CommonLibrary.PSAzureContext类型的对象。

然后我输入

Get-AzureADUser

错误是：

  

Get-AzureADUser：执行GetUsers时发生错误

     

代码：Authentication_Unauthorized

     

消息：未找到用户

     

HttpStatusCode：Forbidden

我仍然可以使用Azure RM Powershell模块列出用户。以下代码有效：

Add-AzureRmAccount
Get-AzureRmADUser

如何让Get-AzureADUser工作？

Answer 1

The cmdlet Connect-AzureAD establishes connection to ADD domian, after we login successed a confirmation will display:

PS C:\windows\system32> connect-azuread

Account                                Environment Tenant
-------                                ----------- ------
jasontest1@xxxxxx.onmicrosoft.com AzureCloud  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The connection can be vaildated with this cmdlet Get-AzureADDomain, if the user is connected to AAD domain, where he has management privileges - the information about the domain will be displayed:

PS C:\windows\system32> get-azureaddomain

Name                                        AvailabilityStatus AuthenticationType
----                                        ------------------ ------------------
hcl.com                                                        Managed
msgamestudios.com                                              Managed
foobar.local                                                   Managed
multimap.com                                                   Managed
skypestaytogether.com                                          Managed
insightsquarterly.com.au                                       Managed
calanit.onmicrosoft.com                                        Federated
msft.ccsctp.net                                                Managed
ruffiangames.com                                               Managed
xn--m1bg0b0byewac1j8b.com                                      Managed
VoicesforInnovation.org                                        Managed
shaanximic.com                                                 Managed
www.yunnanmic.com                                              Managed
wsmbela.pss.com                                                Managed
fornax.off                                                     Managed
api.staging.yammer.com                                         Managed
codenauts.net                                                  Managed
acompli.com                                                    Managed
testdomains.co                                                 Managed
microsoft.hr                                                   Managed
Bayportali.mmdservice.com                                      Managed
contoso.com                                                    Managed
api.swrepository.com                                           Managed
Equivio.com                                                    Managed
sunshine.am                                                    Managed
microsoftaffiliates.com                                        Managed

If user has no admin privileges, we will get the error same as you.

Get-AzureADDomain : Error occurred while executing GetDomains
Code: Authentication_Unauthorized
Message: User was not found
HttpStatusCode: Forbidden

The reason is that, the cmdlet GetAzureADDomian has no tenant specified, so the connection was established to a domian, where user has no admin privileges.

To ensure connection to expected AAD domian, the tenant ID must specified in call to Connect-AzureAD cmdlet.

PS C:\windows\system32> Connect-AzureAD -TenantId

Answer 2

如此处已回答，请使用：

PS C:\windows\system32> Connect-AzureAD -TenantId {YOUR_TENANT_ID}
Example:
PS C:\windows\system32> Connect-AzureAD -TenantId ce1af0ab-ae35-4f60-8f2d-944444444444

执行Connect-AzureAd时使用我们得到的TenantId是一个常见错误，如下所示：

但是请使用TenantId中的Azure Portal --> Azure Active Directory --> Properties --> Directory Id。

Directory Id = TenantId。