如何将“offline_access”权限添加到 Azure AD 中的新应用程序注册？

Question

请参阅我的代码，为新的应用程序注册添加权限：

# Define variables
$AppName = "Test Application 5"
$CertSubject = "CN=$AppName"
$StartDate = Get-Date
$EndDate = $StartDate.AddMonths(3) # Adjust certificate validity period as needed

# Create a new Azure AD application
$App = New-AzureADApplication -DisplayName $AppName -IdentifierUris "test9" -HomePage "https://yourapphomepage"

# Generate a new self-signed certificate
$Cert = New-SelfSignedCertificate -Subject $CertSubject -CertStoreLocation "Cert:\CurrentUser\My" -NotBefore $StartDate -NotAfter $EndDate

# Convert the certificate to a base64-encoded string
$CertBytes = [System.Convert]::ToBase64String($Cert.RawData)
$CertValue = [System.Text.Encoding]::UTF8.GetString([System.Text.Encoding]::ASCII.GetBytes($CertBytes))

# Create a new certificate credential for the application
New-AzureADApplicationKeyCredential -ObjectId $App.ObjectId -CustomKeyIdentifier "CertKey" -Type AsymmetricX509Cert -Usage Verify -Value $CertValue -StartDate $StartDate -EndDate $EndDate

# Create a new password credential for the application (secret)
$PasswordCredential = New-AzureADApplicationPasswordCredential -ObjectId $App.ObjectId -CustomKeyIdentifier "PasswordKey" -StartDate $StartDate -EndDate $EndDate


#-------------------------------------------------------------
# Add Permissions


$spForApp = New-AzureADServicePrincipal -AppId $App.AppId -PasswordCredentials @($PasswordCredential)


$appPermissionsRequired = @('offline_access','User.Read.All','Group.Read.All','GroupMember.ReadWrite.All','Directory.Read.All','AuditLog.Read.All')
$targetServicePrincipalName = 'Microsoft Graph'

$targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq '$($targetServicePrincipalName)'"


$RoleAssignments = @()

Foreach ($AppPermission in $appPermissionsRequired) {
    $RoleAssignment = $targetSp.AppRoles | Where-Object { $_.Value -eq $AppPermission}
    $RoleAssignments += $RoleAssignment
}

$ResourceAccessObjects = New-Object 'System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.ResourceAccess]'

foreach ($RoleAssignment in $RoleAssignments) {
    $resourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess"
    $resourceAccess.Id = $RoleAssignment.Id
    $resourceAccess.Type = 'Role'
    $ResourceAccessObjects.Add($resourceAccess)
}
    
$requiredResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$requiredResourceAccess.ResourceAppId = $targetSp.AppId
$requiredResourceAccess.ResourceAccess = $ResourceAccessObjects

# set the required resource access
Set-AzureADApplication -ObjectId $App.ObjectId -RequiredResourceAccess $requiredResourceAccess
Start-Sleep -s 1

# grant the required resource access
foreach ($RoleAssignment in $RoleAssignments) {
    Write-Output -InputObject ('Granting admin consent for App Role: {0}' -f $($RoleAssignment.Value))
    New-AzureADServiceAppRoleAssignment -ObjectId $spForApp.ObjectId -Id $RoleAssignment.Id -PrincipalId $spForApp.ObjectId -ResourceId $targetSp.ObjectId
    Start-Sleep -s 1
}

除“offline_access”之外的所有权限均已成功添加。

当我使用以下命令在命令行中查找应用程序角色时：

$targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"
$targetSp.AppRoles

我在 Microsoft Graph 中获得了大量应用程序角色列表。我可以找到除“offline_access”之外的所有应用程序角色。就好像它不存在一样。但我可以在 azure 门户中手动添加它。

有谁知道我如何定位“offline_access”？我尝试使用权限 ID 但没有成功，但也许有人知道如何使用它。谢谢！

Answer 1

注意：

Offline_access

是委托的API权限，而不是应用程序API权限。因此，您必须使用 Oauth2Permissions 而不是 AppRoles 列出它。

要列出委派的 API 权限，使用以下命令：

$targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"
$targetSp.Oauth2Permissions

要仅获取所需的委派 API 权限，请执行以下命令：

$targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"
$offlineAccessId = $targetSp.Oauth2Permissions | Where-Object { $_.Value -eq 'offline_access' } 

您可以使用以下代码添加

offline_access

API权限：

# Create a new Azure AD application
$myapp = New-AzureADApplication -DisplayName "RukApptest" 
$myappId = $myapp.ObjectId
$MSGraph = Get-AzureADServicePrincipal -All $true | Where-Object { $_.DisplayName -eq "Microsoft Graph" }

# Retrieve the ID of the 'offline_access' permission from Microsoft Graph
$offlineAccessPermission = $MSGraph.Oauth2Permissions | Where-Object { $_.Value -eq 'offline_access' }
$Graph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$Graph.ResourceAppId = $MSGraph.AppId
$Per1 = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $offlineAccessPermission.Id,"Scope"
$Graph.ResourceAccess = $Per1
Set-AzureADApplication -ObjectId $myappId -RequiredResourceAccess $Graph