将具有角色的用户添加到应用程序注册中 [英] Adding users with roles into app registration

问题描述

我可以看到您可以使用图形API创建应用注册，但是可以向应用注册中添加用户和角色吗?

I can see you can create app registrations with graph API but is it possible to add users and roles to an app registration?

推荐答案

如果要将用户分配给该应用程序，则需要以指定的应用程序角色之一在该用户上设置appRoleAssignment.如果使用Azure AD Graph api，则可以使用以下rest api:

If you want to assign a user to that application, in one of the specified app roles, you'll need to set the appRoleAssignment on the user . If using Azure AD Graph api , you could use below rest api :

https://graph.windows.net/{tenant-id}/users/{username}/appRoleAssignments?api-version={api-version}
Content-Type:application/json
Authorization: Bearer {token}
{
    "id": "RoleID", 
    "principalId":  "UserObjectID", 
    "principalType": "User", 
    "resourceId":  "servicePrincipalID"
}

id :这是您分配的角色的ID.这些ID可以在应用程序清单中找到.或者，您可以使用下面的api获取为您的应用程序定义的特定角色(appRoles声明):

id: This is the Id for the Role you are assigning. These Ids can be found in the Application's Manifest. Or you could use below api to get the specific role defined for your application(appRoles claim):

https://graph.windows.net/{tenant}/applications/{ObjectIDOfApplication}?api-version=1.6

principalId :这是您要为其分配角色的用户的对象ID.

principalId :This is the Obeject Id of the User you are assigning the role to.

principalType :如果您要将此角色分配给User，则将其设置为字符串User.

principalType :If you are assigning this role to a User then this is set to the string User .

resourceId :应用程序的服务主体ID.要获取服务主体ID，可以使用以下api(objectId声明):

resourceId : Service Principal ID of the application . To get service principal id , you could use below api (objectId claim) :

https://graph.windows.net/{tenant}/servicePrincipals?api-version=1.6&$filter=appId eq 'appid'

这篇关于将具有角色的用户添加到应用程序注册中的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！