azure - 尝试从自动化 Runbook 帐户连接 Azure AD 但收到代码 : Authorization_RequestDenied

Question

运行以下代码并尝试使用自动化 Runbook 帐户从 Azure AD 获取值。它给出权限被拒绝错误。我有Followed these steps ，还是拿不出结果。如果有人遇到类似问题或知道如何解决，请告诉我

代码:

$connectionName = "AzureRunAsConnection"
# Get the Service Principal connection details for the Connection name
$servicePrincipalConnection = Get-AutomationConnection -Name $connectionName         

# Logging in to Azure AD with Service Principal
"Logging in to Azure AD..."
Connect-AzureAD -TenantId $servicePrincipalConnection.TenantId `
    -ApplicationId $servicePrincipalConnection.ApplicationId `
    -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint

"List Tenant Org Details:"
Get-AzureADTenantDetail | Select DisplayName, Street, PostalCode, City, CountryLetterCode

"Member Account Synced Count:"
(Get-AzureADUser -All $true -Filter "userType eq 'Member' and accountEnabled eq true" | Where-Object {$_.DirSyncEnabled -eq $true}).Count
"Disabled Users Count:"
(Get-AzureADUser -All $true -Filter 'accountEnabled eq false').Count
"Guest User Count:"
(Get-AzureADUser -All $true -Filter "userType eq 'Guest'").Count
"Cloud Only Account Count:"
(Get-AzureADUser -All $true -Filter "userType eq 'Member'" | Where-Object {$_.userPrincipalName -like "*onmicrosoft.com"}).Count

错误:

Get-AzureADUser:执行 GetUsers 时发生错误代码:Authorization_RequestDenied消息:权限不足，无法完成操作。请求ID:“”日期时间戳:2020 年 6 月 26 日星期五 04:07:45 GMTHttpStatusCode:禁止HttpStatusDescription:禁止HttpResponseStatus:已完成

行:21 字符:2

• (Get-AzureADUser -All $true -Filter "userType eq 'Guest'").Count

•  + CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiException
   + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUser
  
  
  

Answer 1

@沉急

找到答案

转到 Azure 门户 --> Azure AD --> 角色和管理员 --> 目录读取器角色 --> 将此角色分配给 Runbook 帐户名称