Azure Multi-Tenancy 应用程序对某些租户不可见

Question

我们有一个 Multi-Tenancy Azure 广告应用程序，该应用程序在某些其他租户中不可见。是否有允许第三方应用程序的租户级别设置？

我们从 azure cli 运行以下命令来查看 hte 应用程序是否可见

az ad app show --id appID

我们收到以下错误:

(我有 xxx 的应用程序 ID)

Resource 'xxxxx' does not exist or one of its queried reference-property objects are not present. Traceback (most recent call last): File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\main.py", line 36, in main cmd_result = APPLICATION.execute(args) File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\application.py", line 216, in execute result = expanded_arg.func(params) File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands__init__.py", line 381, in call return self.handler(*args, **kwargs) File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands__init__.py", line 640, in _execute_command raise client_exception File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands__init__.py", line 628, in _execute_command exception_handler(ex) File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\util.py", line 49, in empty_on_404 raise ex File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\core\commands__init__.py", line 612, in _execute_command result = op(client, **kwargs) if client else op(**kwargs) File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\cli\command_modules\role\custom.py", line 455, in show_application return client.get(object_id) File "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\lib\site-packages\azure\graphrbac\operations\applications_operations.py", line 272, in get raise models.GraphErrorException(self._deserialize, response) azure.graphrbac.models.graph_error.GraphErrorException: Resource 'xxxx' does not exist or one of its queried reference-property objects are not present.

Answer 1

其他租户的用户需要同意 Multi-Tenancy 应用的权限。然后应用程序将作为 sp 出现在该租户中。因此您可能会忘记执行此步骤:

When a user from a different tenant signs in to the application for the first time, Azure AD asks them to consent to the permissions requested by the application. If they consent, then a representation of the application called a service principal is created in the user’s tenant, and sign-in can continue.

完成此操作后，您可以使用 az ad sp list 检查 sp 是否在该租户中。

此外，您需要确保您的 Multi-Tenancy 应用程序在开始登录之前已配置良好。有关如何使用 Multi-Tenancy 应用程序登录任何 AAD 用户的更多详细信息，请参阅this document .