azure - 使用 az powershell 创建 azure AD 应用程序

Question

我正在创建一个 azure 的 AD 应用程序，为其生成客户端 key ，并使用 az PowerShell 授予读者角色我想给 Microsoft Graph。对应用程序的 Directory.readAll 权限，但不确定如何使用 PowerShell 进行操作。有人可以帮忙吗？这是我编写的代码:

#Connect to Azure AD
Connect-AzAccount -TenantId <tenant-id>
Connect-AzureAD
#Set variables for the app
$appName = "test"
$secret = "MySecret"

#Create the app
$app = New-AzureADApplication -DisplayName $appName -PublicClient $false

#Create the client secret
$bytes = [System.Text.Encoding]::Unicode.GetBytes($secret)
$base64 = [System.Convert]::ToBase64String($bytes)
$startDate = Get-Date
$endDate = $startDate.AddYears(1)
$secret = New-AzureADApplicationPasswordCredential -ObjectId $app.ObjectId -CustomKeyIdentifier "MyCustomKeyIdentifier" -Value $base64 -StartDate $startDate -EndDate $endDate

#Retrieve the tenant ID
$tenantId = (Get-AzureADTenantDetail).ObjectId

#giving Reader Role
New-AzRoleAssignment -ObjectId $app.ObjectId -RoleDefinitionName "Reader" -PrincipalType "ServicePrincipal"

#Print the App-ID, tenant ID, and client secret
Write-Host "App-ID: $($app.AppId)"
Write-Host "Tenant ID: $tenantId"
Write-Host "Client Secret: $($secret.Value)"

Answer 1

我尝试在我的环境中重现相同的结果并得到以下结果:

我运行了与您相同的 PowerShell 脚本，并得到了如下响应:

#Connect to Azure AD
Connect-AzAccount -TenantId <tenantID>
Connect-AzureAD

#Set variables for the app
$appName = "test"
$secret = "MySecret"

#Create the app
$app = New-AzureADApplication -DisplayName $appName -PublicClient $false

#Create the client secret
$bytes = [System.Text.Encoding]::Unicode.GetBytes($secret)
$base64 = [System.Convert]::ToBase64String($bytes)
$startDate = Get-Date
$endDate = $startDate.AddYears(1)
$secret = New-AzureADApplicationPasswordCredential -ObjectId $app.ObjectId -CustomKeyIdentifier "MyCustomKeyIdentifier" -Value $base64 -StartDate $startDate -EndDate $endDate

#Retrieve the tenant ID
$tenantId = (Get-AzureADTenantDetail).ObjectId

#giving Reader Role
New-AzRoleAssignment -ObjectId $app.ObjectId -RoleDefinitionName "Reader" -PrincipalType "ServicePrincipal" -Scope "/subscriptions/<subID>/resourcegroups/<myRGname>"

#Print the App-ID, tenant ID, and client secret
Write-Host "App-ID: $($app.AppId)"
Write-Host "Tenant ID: $tenantId"
Write-Host "Client Secret: $($secret.Value)"

回应:

当我在 Portal 中检查相同内容时，名为 test 的应用程序已成功创建，如下所示:

要向此应用程序添加 Microsoft Graph Directory.Read.All 权限，您可以运行以下 PowerShell 脚本:

$Graph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$Graph.ResourceAppId = "00000003-0000-0000-c000-000000000000"
$DirectoryReadAll = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "7ab1d382-f21e-4acd-a863-ba3e13f7da61","Role"
$Graph.ResourceAccess = $DirectoryReadAll
$app = Get-AzureADApplication -SearchString "test" 
  
Set-AzureADApplication -ObjectId $app.ObjectId -RequiredResourceAccess $Graph

回应:

当我在 Portal 中检查相同内容时，Directory.Read.All 权限已成功添加到应用程序，如下所示:

要向上述权限授予管理员同意，您需要创建服务主体并运行 PowerShell 脚本，如下所示:

$sp = New-AzureADServicePrincipal -AccountEnabled $true -AppId $app.AppId -AppRoleAssignmentRequired $true -DisplayName "test"
$graphsp = Get-AzureADServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"

New-AzureADServiceAppRoleAssignment `
             -Id $DirectoryReadAll.Id `
             -ObjectId $sp.ObjectId `
             -PrincipalId $sp.ObjectId `
             -ResourceId $graphsp.ObjectId

回应:

要确认，您可以检查已成功授予管理员同意的门户，如下所示: