将Microsoft Graph权限分配给Azure托管服务身份 [英] Assigning Microsoft Graph permissions to Azure Managed Service Identity
问题描述
我正在尝试为我的Azure Logic应用程序分配权限到Azure托管服务身份，但是遇到错误.
I'm trying to assign permissions to an Azure Managed Service Identity for my Azure Logic App, but am running into errors.
我正在使用AzureAD powershell模块的2.0.1.16版本.
I'm using the 2.0.1.16 version of the AzureAD powershell module.
我要做的是以下事情:
- 创建逻辑应用
- 在该逻辑应用程序的工作流设置中生成一个Azure托管服务身份.
- 执行以下PowerShell，为group.readwrite.all角色分配托管服务标识.
它首先抛出访问被拒绝的错误，随后的尝试将抛出"InvalidRequest"错误.我是全球管理员，并且拥有对资源组的完全访问权限(这是我拥有完全权限的基本开发租户)
It first throws an access denied error, and subsequent tries will throw a "InvalidRequest" Error. I'm a global administrator, and have full access to the resource group (it is a basic dev tenant where I have full permissions)
我在不同的租户上尝试过.有人能使它正常工作吗?
I have tried it on different tenants. Has anyone been able to get this to work?
PS C:\Users\markp> $msi = Get-AzureADServicePrincipal | ?{$_.DisplayName -ieq "test"}
PS C:\Users\markp> $mai
PS C:\Users\markp> $msi
ObjectId AppId DisplayName
-------- ----- -----------
8d87a1f9-fab0-45a9-a6f3-1e93b2d99b52 032c3c1c-2530-4eae-b390-153e3b0eb3c6 TEST
PS C:\Users\markp> $graph = Get-AzureADServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
PS C:\Users\markp> $graph
ObjectId AppId DisplayName
-------- ----- -----------
5a634981-6bbe-4c81-9aef-185a71df56f7 00000003-0000-0000-c000-000000000000 Microsoft Graph
PS C:\Users\markp> $role = $graph.AppRoles | ?{$_.Value -imatch "group.read.all" }
PS C:\Users\markp> $role
AllowedMemberTypes : {Application}
Description : Allows the app to read group properties and memberships, and read the calendar and conversations f
or all groups, without a signed-in user.
DisplayName : Read all groups
Id : 5b567255-7703-4780-807c-7be8301ae99b
IsEnabled : True
Value : Group.Read.All
PS C:\Users\markp> New-AzureADServiceAppRoleAssignment -ObjectId $msi.ObjectId -PrincipalId $msi.ObjectId -Id $role.Id -ResourceId $graph.ObjectId
New-AzureADServiceAppRoleAssignment : Error occurred while executing NewServicePrincipalAppRoleAssignment
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed
At line:1 char:1
+ New-AzureADServiceAppRoleAssignment -ObjectId $msi.ObjectId -Principa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-AzureADServiceAppRoleAssignment], ApiException
+ FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.NewServ
icePrincipalAppRoleAssignment
PS C:\Users\markp> New-AzureADServiceAppRoleAssignment -ObjectId $msi.ObjectId -PrincipalId $msi.ObjectId -Id $role.Id -ResourceId $graph.ObjectId
New-AzureADServiceAppRoleAssignment : Error occurred while executing NewServicePrincipalAppRoleAssignment
Code: Request_BadRequest
Message: One or more properties are invalid.
RequestId: 57ef7908-dd8b-4a21-b48e-f2692d324264
DateTimeStamp: Fri, 28 Sep 2018 14:36:55 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At line:1 char:1
+ New-AzureADServiceAppRoleAssignment -ObjectId $msi.ObjectId -Principa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-AzureADServiceAppRoleAssignment], ApiException
+ FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.NewServ
icePrincipalAppRoleAssignment
推荐答案
初始设置
我设置了一个名为"test"的新逻辑应用，在我的试用订阅中，就像您在上面说明的那样，并通过工作流程设置为其启用了MSI.然后，我使用了与上面完全相同的PowerShell命令.
Initial Setup
I setup a new logic app named "test" in my trial subscription just like you have explained above and enabled the MSI for it through workflow settings. Then I used the exact same PowerShell commands that you have above.
-
首次运行-即使您在使用代码Authorization_RequestDenied时出错，添加新角色分配的操作实际上也已完成.新的权限已添加. (我将在下面的部分中对此提供一些证据)
First Run - Even though you get error with Code: Authorization_RequestDenied, the operation of adding new role assignments has actually done it's work. New permissions have been added. (I'll give a little evidence on this in section below)
第一次运行后的后续运行-您遇到错误代码:Request_BadRequest，因为您要添加的权限/角色分配已在第一次运行中添加.
Subsequent Runs after the first run - You get an error with Code: Request_BadRequest, because the permissions/role assignments you're trying to add had already been added in the first run.
证据
-
PowerShell脚本完全来自您的帖子.
PowerShell Scripts exactly from your post.
这些查询仅从Azure AD Graph Explorer(而不是新的Microsoft Graph Explorer)为我工作.此外，查询是区分大小写的，因此即使很小的差异也会生效.
These queries worked for me only from Azure AD Graph Explorer (and NOT the new Microsoft Graph Explorer). Also, queries are case sensitive, so even a small difference will effect.
您基本上可以在第一次运行PowerShell脚本之前和之后查看服务主体的角色分配，以了解实际上已添加了必需的权限(我创建了一个新的逻辑应用，其中没有任何内容，仅启用了MSI测试这部分)
You can basically look at the role assignments for the Service Principal, before and after running your PowerShell script the first time to see that the required permissions actually get added (I created a new logic app with nothing in it and just MSI enabled to test this part)
Azure AD图形查询:
Azure AD Graph Query:
Azure AD Graph Query: https://graph.windows.net/{tenant Id}/servicePrincipals/{MSI Service Principal ID}/appRoleAssignments
{MSI Service Principal ID} is 8d87a1f9-fab0-45a9-a6f3-1e93b2d99b52 in your case.
在使用上述查询的New-AzureADServiceAppRoleAssignment首次运行之前，MSI服务主体的角色分配.
使用上述查询在New-AzureADServiceAppRoleAssignment首次运行后为MSI服务主体的角色分配.
这篇SO帖子提到了几乎与您使用的PowerShell脚本相同的内容.有趣的是，对于许多人来说，脚本也可以正常工作. 但是请注意用户Olandese的最新评论
This SO post mentions almost the same PowerShell scripts that you are using. Interesting thing being it looks like scripts worked without error for many people as well. But notice the last comment by user Olandese
这篇关于将Microsoft Graph权限分配给Azure托管服务身份的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
