azure - 使用 PowerShell 在 Azure 应用程序中创建多个委派权限？

Question

我正在创建一个脚本来在 Azure 中创建新的应用程序注册。

到目前为止，一切运行良好，我可以创建应用程序、创建服务主体、设置密码并添加重定向 uri。

我面临的问题是我可以使用以下函数为应用程序创建委派权限:

$graph = "00000003-0000-0000-c000-000000000000"
$sharePoint = "00000003-0000-0ff1-ce00-000000000000"
$userRead = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
$myFilesWrite = "2cfdc887-d7b4-4798-9b33-3d98d6b95dd2"
$allSitesWrite = "640ddd16-e5b7-4d71-9690-3f4022699ee7"

Function SetPermissions($resourceId, $argument)
{
    $rra = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $rra.ResourceAppId = $resourceId
    $rra.ResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $argument ,"Scope"
    Set-AzureADApplication -ObjectId $myApp.ObjectId -RequiredResourceAccess $rra
}

SetPermissions $graph $userRead

但我的应用程序需要三个权限 - 当我第二次调用该函数时，它只会覆盖现有权限，而不是添加新权限。

关于如何创建多个应用程序权限有什么建议吗？

Answer 1

我尝试在我的环境中重现相同的结果并得到以下结果。

当我运行与您相同的代码时，User.Read 权限被添加到应用程序中，如下所示:

现在我更改了参数并再次运行代码，如下所示:

$myApp = Get-AzureADApplication -SearchString MyApp
$graph = "00000003-0000-0000-c000-000000000000"
$sharePoint = "00000003-0000-0ff1-ce00-000000000000"
$userRead = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
$myFilesWrite = "2cfdc887-d7b4-4798-9b33-3d98d6b95dd2"
$allSitesWrite = "640ddd16-e5b7-4d71-9690-3f4022699ee7"

Function SetPermissions($resourceId, $argument)
{
    $rra = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $rra.ResourceAppId = $resourceId
    $rra.ResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $argument ,"Scope"
    Set-AzureADApplication -ObjectId $myApp.ObjectId -RequiredResourceAccess $rra
}

SetPermissions $sharePoint $allSitesWrite //Changed this

回应:

当我在 Portal 中检查相同内容时，删除了现有权限，并添加了新权限，如下所示:

要从 PowerShell 向 Azure AD 应用程序添加多个委派权限，您可以使用以下脚本:

$Graph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$Graph.ResourceAppId = "00000003-0000-0000-c000-000000000000"

$SharePoint = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$SharePoint.ResourceAppId = "00000003-0000-0ff1-ce00-000000000000"

$userRead = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "e1fe6dd8-ba31-4d61-89e7-88639da4683d","Scope" 
$myFilesWrite = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "2cfdc887-d7b4-4798-9b33-3d98d6b95dd2","Scope"
$allSitesWrite = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "640ddd16-e5b7-4d71-9690-3f4022699ee7","Scope" 
 
$Graph.ResourceAccess = $userRead
$SharePoint.ResourceAccess = $myFilesWrite, $allSitesWrite
   
$myApp = Get-AzureADApplication -SearchString MyApp 
Set-AzureADApplication -ObjectId $myApp.ObjectId -RequiredResourceAccess $Graph, $SharePoint

回应:

当我在门户中检查相同内容时，多个委派权限已成功添加到应用程序，如下所示:

引用:

How to assign Permissions to Azure AD App by using PowerShell by rajaniesh