Question

我在powershell的Az模块中有一个代码，用于创建appID，app secret和分配API权限。如何授予管理员同意我分配给AzApp的所有API权限？

...
$context = Get-AzContext
$ResourceAppIdURI = "https://graph.windows.net/"
$token = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, $ResourceAppIdURI).AccessToken

$headers = @{ }
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Bearer $($token)")

$objectID = $myApp.ObjectId
$url = "https://graph.windows.net/$tenant/applications/{0}?api-version=1.6" -f $objectID
Write-Host "URL: " $url

$postData = "{`"requiredResourceAccess`":[
    {`"resourceAppId`":`"00000003-0000-0000-c000-000000000000`",
    `"resourceAccess`":[
        {`"id`":`"e1fe6dd8-ba31-4d61-89e7-88639da4683d`",`"type`":`"Scope`"},
        {`"id`":`"7ab1d382-f21e-4acd-a863-ba3e13f7da61`",`"type`":`"Role`"},
        {`"id`":`"5b567255-7703-4780-807c-7be8301ae99b`",`"type`":`"Role`"},
        {`"id`":`"e2a3a72e-5f79-4c64-b1b1-878b674786c9`",`"type`":`"Role`"},
        {`"id`":`"df021288-bdef-4463-88db-98f22de89214`",`"type`":`"Role`"}
        ]
    }]
}";
Invoke-RestMethod -Uri $url -Method "PATCH" -Headers $headers -Body $postData

Write-Host "App created..."
Write-Host "AppID: " $myApp.ApplicationId
Write-Host "App Secret: " $secret
Write-Host "TenantID: " $tenant.Id

Answer 1

Microsoft没有公开任何API来授予Azure AD应用程序/服务主体的管理员同意。您可以在用户语音中对此post进行投票。

有一个解决方法：

在Powershell中调用Microsoft Graph API Create a delegated permission grant和Grant an appRoleAssignment to a service principal。

示例供您参考：

STATIC_URL = '/static/'
STATICFILES_DIRS = [
    os.path.join(BASE_DIR, "staticfiles"), 
]

对于第一次通话$context = Get-AzContext $ResourceAppIdURI = "https://graph.windows.net/" $ResourceGraphURI = "https://graph.microsoft.com/" $token = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, $ResourceAppIdURI).AccessToken $graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, $ResourceGraphURI).AccessToken $clientID = "d154cc56-f1a2-4906-9f26-bfb4756f9c20" $resourceID = "08a1faff-51c1-4cbb-81c4-1bc11286da76" $scopes = "Sites.Read.All User.Read User.Read.All User.ReadBasic.All" $body = @{ clientId = $clientID consentType = "AllPrincipals" principalId = $null resourceId = $resourceID scope = $scopes startTime = "2019-10-19T10:37:00Z" expiryTime = "2020-10-19T10:37:00Z" } $apiUrl = "https://graph.microsoft.com/beta/oauth2PermissionGrants" Invoke-RestMethod -Uri $apiUrl -Headers @{Authorization = "Bearer $($graphToken)" } -Method POST -Body $($body | convertto-json) -ContentType "application/json" $principalId = "d154cc56-f1a2-4906-9f26-bfb4756f9c20" $body1 = @{ principalId = $principalId resourceId = $resourceID appRoleId = "df021288-bdef-4463-88db-98f22de89214" } $apiUrl1 = "https://graph.microsoft.com/beta/servicePrincipals/$($principalId)/appRoleAssignedTo" Invoke-RestMethod -Uri $apiUrl1 -Headers @{Authorization = "Bearer $($graphToken)" } -Method POST -Body $($body1 | convertto-json) -ContentType "application/json"：

https://graph.microsoft.com/beta/oauth2PermissionGrants是服务主体（不是Azure AD应用程序）的对象ID，可以使用Get-AzADServicePrincipal找到它。您还可以在 Azure门户网站- Azure Active Directory -企业应用程序中找到它，搜索您的Azure AD应用程序的名称。

clientID是Microsoft Graph服务主体的对象ID。您可以在企业应用程序下找到（搜索“ 00000003-0000-0000-c000-000000000000”）。

resouceID是您要授予管理员同意的已授予权限。

第二次通话scopes：

https://graph.microsoft.com/beta/servicePrincipals/$($principalId)/appRoleAssignedTo与上述principalId相同。

clientID是应用程序权限 ID。

Answer 2

实际上，Azure AD PowerShell模块提供了一个与应用程序权限等效的cmdlet：New-AzureADServiceAppRoleAssignment。

即使文档记录不充分，该命令（通过服务主体）也会将请求的应用程序权限（如果您有权，请授予管理员同意）添加到您的AAD应用程序中。

# If it's not the case, declare your AAD Application as a service principal (Enterprise Application)
$aadappsp = New-AzureADServicePrincipal -AppId "AAD_APPLICATION_ID"

# Id of the application permission (role)
$roleId = "2a8d57a5-4090-4a41-bf1c-3c621d2ccad3" # TermStore.Read.All

# Object Id of the concerned Service Principal (could be Graph or SharePoint for example)
# (Not the Application Id like "00000003-0000-0ff1-ce00-000000000000" for SharePoint)
$aadSpObjectId = "c30e8a24-ff90-464e-aed3-7c39a7bdc280"

# Register the application permission
New-AzureADServiceAppRoleAssignment -ObjectId $aadappsp.ObjectId -Id $roleId -PrincipalId $aadappsp.ObjectId -ResourceId $aadSpObjectId

它使用的是dedicated endpoint，因此一旦正确执行了命令，如果显示以下内容，请不要感到惊讶：

（通过PowerShell添加的权限显示为“为...授予的其他权限”）

为避免这种情况，您必须首先通过界面或使用New-AzureADApplication（将权限注册为“已配置”）和New-AzureADServicePrincipal（为您的组织正确授予管理员同意）添加它们。< / p>

遗憾的是，没有用于授予管理员对“委派权限”的同意的cmdlet，因此在这种情况下@Allen Wu提供的答案仍然有效（只需将URI更新为使用v1.0版本而不是beta）即可。

我想通过Powershell脚本向管理员授予API权限的同意

2 个答案: