powershell - 使用PowerShell Invoke-RestMethod查询MSGraph API不会返回与MSGraph Explorer相同数量的详细信息

Question

我使用MSGraph Explorer和PowerShell Invoke-RestMethod来查询相同的MSGraph API，但是MSGraph Explorer返回的详细信息比PowerShell命令多。这可能是权限问题，还是我错过了PowerShell命令中的某些内容。

这是URI，用于检索特定目录更改的审核日志。

https://graph.microsoft.com/beta/auditLogs/directoryAudits/Directory_029A8_49125229

这是MSGraph Explorer的输出:

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/directoryAudits/$entity",
    "id": "Directory_029A8_49125229",
    "category": "Core Directory",
    "correlationId": "d534994f-61f4-4015-8040-c16f728ec8b3",
    "result": "success",
    "resultReason": "",
    "activityDisplayName": "Update user",
    "activityDateTime": "2018-10-04T05:41:19.9668303Z",
    "loggedByService": null,
    "initiatedBy": {
        "app": null,
        "user": {
            "id": "1f5c2159-f515-4cea-a99c-11c6ce1f7a5e",
            "displayName": null,
            "userPrincipalName": "tom-admin@contoso.onmicrosoft.com",
            "ipAddress": "<null>"
        }
    },
    "targetResources": [
        {
            "@odata.type": "#microsoft.graph.targetResourceUser",
            "id": "498b3884-f723-444c-9c01-b75ec2c0ef08",
            "displayName": null,
            "userPrincipalName": "Tom.Real@contoso.com",
            "modifiedProperties": [
                {
                    "displayName": "AssignedLicense",
                    "oldValue": "[\"[SkuName=ENTERPRISEPACK, AccountId=cdc4b90d-7fa9-4a, SkuId=6f94b900, DisabledPlans=[]]\"]",
                    "newValue": "[]"
                },
                {
                    "displayName": "AssignedPlan",
                    "oldValue": "[{\"SubscribedPlanId\":..., \"ServicePlanId\":\"50e68c76-46c6-4674-81f9-75456511b170\"}]",
                    "newValue": "[{\"SubscribedPlanId\":... 50e68c76-46c6-4674-81f9-75456511b170\"}]"
                },
                {
                    "displayName": "Included Updated Properties",
                    "oldValue": null,
                    "newValue": "\"AssignedLicense, AssignedPlan\""
                },
                {
                    "displayName": "TargetId.UserType",
                    "oldValue": null,
                    "newValue": "\"Member\""
                }
            ]
        }
    ],
    "additionalDetails": [
        {
            "key": "UserType",
            "value": "Member"
        }
    ]
}

这是Invoke-RestMethod的输出:

{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#auditLogs/directoryAudits/$entity",
"id": "Directory_029A8_49125229",
"category": "Core Directory",
"correlationId": "d534994f-61f4-4015-8040-c16f728ec8b3",
"result": "success",
"resultReason": "",
"activityDisplayName": "Update user",
"activityDateTime": "2018-10-04T05:41:19.9668303Z",
"loggedByService": null,
"initiatedBy": {
"app": null,
"user": {
"id": "1f5c2159-f515-4cea-a99c-11c6ce1f7a5e",
"displayName": null,
"userPrincipalName": "tom-admin@contoso.onmicrosoft.com",
"ipAddress": "\u003cnull\u003e"
}
},
"targetResources": [
{
"@odata.type": "#microsoft.graph.targetResourceUser",
"id": "498b3884-f723-444c-9c01-b75ec2c0ef08",
"displayName": null,
"userPrincipalName": "Tom.Real@contos.com",
"modifiedProperties": " "
}
],
"additionalDetails": [
{
"key": "UserType",
"value": "Member"
}
]
}

如您所见，Invoke-RestMethod不会在“additionalDetails”下返回任何详细信息。

这是我的PowerShell脚本

Function GetAuthToken
{
    param
        (
        [Parameter(Mandatory=$true)]
        $TenantName
        )
    Import-Module Azure
    $clientId = "ef9bcdf0-a675-4cd5-9ec3-fa549f9ee4cf" 
    $redirectUri      = "https://RedirectURI.com" 
    $resourceAppIdURI = "https://graph.microsoft.com"
    $authority = "https://login.microsoftonline.com/$TenantName"
    $authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority
    $Credential = Import-Clixml -Path "C:\MIMA\tom_admin_cred.xml"
    $AADCredential = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.UserCredential" -ArgumentList $credential.UserName,$credential.Password
    $authResult = $authContext.AcquireToken($resourceAppIdURI, $clientId,$AADCredential)
    return $authResult
}
    if($Version -eq $null) {$Version='Beta'}
    #------Get the authorization token------#
    $token = GetAuthToken -TenantName $tenant 

    #------Building Rest Api header with authorization token------#
    $authHeader = @{
        'Content-Type'='application\json'
        'Authorization'=$token.CreateAuthorizationHeader()
        }

    $uri = "https://graph.microsoft.com/beta/auditlogs/directoryAudits/Directory_029A8_49125229"
     $results = Invoke-RestMethod -Uri $uri –Headers $authHeader –Method Get
     $results |ConvertTo-Json

Answer 1

我相信查询和权限都可以，结果是不同的，因为对于 ConvertTo-Json cmdlet，默认情况下JSON表示中包含2级包含的对象。

因此，如果您希望directoryAudit所有属性都包含在结果中，则需要显式指定Depth参数，例如:

$results |ConvertTo-Json -Depth 3   #at least 3 levels for directoryAudit entry