具有托管标识的 Runbook 中的 Azure Connect-AzAccount 失败

Question

我正在尝试在 azure 中的自动化帐户中执行 Runbook。

我已按照说明设置托管身份 here ，然后我在运行手册中发出以下内容:

Connect-AzAccount -Identity
Set-AzContext -Subscription Subscription1

按照指示here

但是我收到以下错误:

Set-AzContext : Please provide a valid tenant or a valid subscription.
 At line:134 char:1
 + Set-AzContext -Tenant $tenantId -Subscription $subscriptionId

我将tenantId和subscriptionId作为参数传递，并将它们写出来以确认它们是正确的。

谁能看出我哪里出错了？

更新

我已将 owner 角色添加到系统分配的托管标识中，现在按照 Dilly B 的以下建议似乎可以正常连接:

$null = Disable-AzContextAutosave -Scope Process # Ensures you do not inherit an AzContext in your runbook

$AzureContext = (Connect-AzAccount -Identity -AccountId $managedIdentity).context  # Connect to Azure with user-assigned managed identity

$connectionResult = Set-AzContext -Subscription $subscriptionId -DefaultProfile $AzureContext

但是当我这样做时:

$virtualMachine = Get-AzVM -ResourceGroupName $resourceGroupName -Name $virtualMachineName

我现在收到以下错误:

Get-AzVM : The client '****************' with object id '*****************' does 
 not have authorization to perform action 'Microsoft.Compute/virtualMachines/read' over scope '/subscriptions/******************/resourceGroups/***************/providers/Microsoft.Compute/virtualMachines/************' or the scope is invalid. If access was recently granted, please refresh your credentials.
 ErrorCode: AuthorizationFailed
 ErrorMessage: The client '******************' with object id '*****************************' 
 does not have authorization to perform action 'Microsoft.Compute/virtualMachines/read' over scope '/subscriptions/******************/resourceGroups/**************/providers/Microsoft.Compute/virtualMachines/**************' or the scope is invalid.

Answer 1

请找到下面的示例代码。希望这有帮助!

$subscription = "000000-0000-0000-0000-000000000"
$identity = "000000-0000-0000-0000-000000000"

$null = Disable-AzContextAutosave -Scope Process # Ensures you do not inherit an AzContext in your runbook

$AzureContext = (Connect-AzAccount -Identity -AccountId $identity).context  # Connect to Azure with user-assigned managed identity

$connectionResult = Set-AzContext -Subscription $subscription -DefaultProfile $AzureContext