azure - 检索 Microsoft Graph API 的权限 ID - 各种范围的委派/应用程序权限 GUID

Question

有没有一种快速、简单的方法来查找 Microsoft Graph API - 委派/应用程序权限 GUID(甚至已弃用的 Azure AD API 权限)。

尝试遵循官方文档但发现它不是很直观。 https://learn.microsoft.com/en-us/graph/permissions-reference

由于权限名称相似，例如:委托(delegate)与应用程序之间的 group.readwrite.all，是否有任何工具或技术可以轻松找到这些 ID。

az ad sp list --query "[?appDisplayName=='Microsoft Graph'].{permissions:oauth2Permissions}[0].permissions[?value=='Group.ReadWrite.All'].{id: id, value: value, adminConsentDisplayName: adminConsentDisplayName, adminConsentDescription: adminConsentDescription}[0]" --all
{
  "adminConsentDescription": "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.",
  "adminConsentDisplayName": "Read and write all groups",
  "id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
  "value": "Group.ReadWrite.All"
}

这似乎不正确，因为正确的 ID 是:

        Group_ReadWrite_All = {
          id   = "62a82d76-70ea-41e2-9197-370581804d09"
          type = "Role"
        }

我在这里遗漏了一些明显的东西吗？特别是角色/范围或其委托(delegate)与应用程序问题？

Answer 1

查询列出所有应用程序

az ad sp list  --query '[].{appDisplayName:appDisplayName, appId:appId}'

查询“Microsoft Graph”应用，查找“Group.ReadWrite.All”权限的“oauth2”范围

az ad sp list --query "[?appDisplayName=='Microsoft Graph'].{permissions:oauth2Permissions}[0].permissions[?value=='Group.ReadWrite.All'].{id: id, value: value, adminConsentDisplayName: adminConsentDisplayName, adminConsentDescription: adminConsentDescription}[0]" --all

{
  "adminConsentDescription": "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.",
  "adminConsentDisplayName": "Read and write all groups",
  "id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
  "value": "Group.ReadWrite.All"
}

查询“Microsoft Graph”应用，找到“Group.ReadWrite.All”权限的应用“Role”

az ad sp list --query "[?appDisplayName=='Microsoft Graph'].{permissions:appRoles}[0].permissions[?value=='Group.ReadWrite.All'].{id: id, value: value, adminConsentDisplayName: adminConsentDisplayName, adminConsentDescription: adminConsentDescription}[0]" --all

{
  "adminConsentDescription": null,
  "adminConsentDisplayName": null,
  "id": "62a82d76-70ea-41e2-9197-370581804d09",
  "value": "Group.ReadWrite.All"
}